A while ago I answered the following question on SearchSoftwareQuality.com’s Ask The Software Quality Expert: Questions & Answers.

Are there any automated test tools that can be used to test a payment gateway?

Here is a clip from my answer:

There are many tools out there that will aid you in the testing of the connection and transport. A couple of tools that come to mind are Mindreef SOAPscope, IBM Rational for SOA Quality, and SoapUI. Each of those will allow you to build test beds of request and response XMLs for testing a Web service. If your payment gateway isn't a Web service (and it very well may not be), you'll need to find or build a tool that allows you to connect to that interface. In most cases, building a lightweight tool to aid with manual testing or to allow for regression testing isn't too difficult.

If you're testing authorization, most likely you're just designing test cases focused on that aspect of system functionality or data. If you have the right amount of test data available, you can automate the generation of the test cases based on a model, but most likely just thinking about the problem and designing and executing the right tests will be less cumbersome than worrying about automation. If you are just looking for regression tests for authorization, use the same tool you use for testing the connection and transport.

If you want to test the encryption, there are a number of tools that can help, but I don't know of any that automate that testing. (Disclaimer: this doesn't mean automated encryption testing tools don't exist.) I would start by looking at Wireshark or WebScarab. I've used both and found them easy to get set up and started with.

You can find the full posting here.

I'd be interested to know what tools others have used for these types of things. I've also worked with a lot of homegrown tools for things like this, and I know there are several large commercial security testing suites out there that I've not used yet which might solve these problems.

A while ago I answered the following question on SearchSoftwareQuality.com’s Ask The Software Quality Expert: Questions & Answers.

What's the exact difference between an error, a defect and a bug?

Here is a clip from my answer:

I like James Bach's and Michael Bolton's definition of a bug:

"A bug is something that bugs somebody who matters."

I find I use this definition for many reasons:

1. It's easy to remember: I don't have to go look it up in a slide I saw six months ago (like I did with the above definitions). I can remember it and explain it to someone off the top of my head, with little to no effort and with no appeal to authority. I don't even need to attribute it to James and Michael if it's a hallway conversation with a programmer or manager.


2. It's consistent with my experience: I find that this definition has applied to every project I've worked on. I've logged deviations from requirements that were closed as functions as designed. Those weren't bugs. I've logged inconsistencies in implementation that were closed as functions as designed. Those weren't bugs. I've even logged a security issue that allowed me to log into the production environment of a very large company without a user id or password. But that wasn't a bug either. None of those bugged the people who mattered. They only bugged me.


3. It's simple to explain: When I tell someone a bug is something that bugs somebody who matters, about the only follow up question I get is "Well, who matters?" Everyone seems to intuitively understand that this definition has a ring of truth. I find that it keeps me out of debates on word definitions and spares me from appealing to authorities that no one agrees on.

You can find the full posting here.