Why is it better for a security tester to test a virtual copy of a server e.g. eBay server and test it on a virtual machine rather than on the real eBay server?

E.g. Doing security on the real server can cause damage and cause the eBay services to be unavailable. (e.g. use SQL injection attacks to erase all the eBay database)

Testing on a copy of the system,will not cause damage to the live server during testing but how does testing on a virtual machine prevent the security tester from breaching the misuse act.

closed as unclear what you're asking by Steffen Ullrich, Matthew, AndrolGenhald, forest, kasperd Dec 2 '18 at 14:44

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • This question is also very confusing. You appear to answer yourself with the obvious answer. "Why is it better to practice firefighting on a mock-up of a house rather than lighting a real house on fire when there are people living in it?" – schroeder Dec 4 '18 at 9:49
  • Why do you need more detail? How much detail is enough? Is there someone else who is asking for these details? Why is the Misuse Act a factor? How is the answer below not acceptable? – schroeder Dec 4 '18 at 10:46
  • You might not understand: I'm a moderator here. I'm the one who can re-open this and I am trying to help you do that. As the question stands, it is still unclear what you are asking. My questions above might help clarify things. – schroeder Dec 4 '18 at 10:52
  • Its ok ill just carry one from what I've already got I understand that doing testing on a real server can cause damage to there to live Data and on a test of the server you Avoid this since it only a copy. – Darkshow Rider Dec 4 '18 at 10:54

The Act says you need permission to use a computer system. Someone performing security testing on a system that is not theirs needs to obtain the permission of the system’s owner first, or they risk violating the CMA. This is a fact regardless of whether or not the system to be tested is a physical server or a virtual server rented from the cloud.

A system owner might choose to make an image of their live system, and provide that copy to a tester, rather than risk damaging their live server during testing. This image can then be sanitized to remove real customer data, passwords to access to other systems, etc.

The tester could then run the image on a virtual machine, or they could load it on to a physical server. Practically speaking, due to both cost and convenience, the tester will almost always use a virtual machine for the task.

In neither case was the tester given permission to access the real system. However, he or she does have permission to test the copy of the system, because it was provided to them by the owner.

The most accurate answer to your original question is “it can’t”, because they are unrelated. As written, the question confuses the difference between “physical/virtual” and “original/copy”. They are technically two very different concepts.

If you want to avoid running afoul of the CMA, you need permission to test the system. That’s all the law says.

  • @DarkshowRider - Virtualization, by itself, has no effect. For one thing, (almost) all servers host websites/apis in a virtualized machine or container to begin with, so you're already dealing with a virtualized environment. For another thing, a "perfect" virtualization would be indistinguishable from a real, physical, environment, and so would be just as susceptible to the same set of compromises. – Clockwork-Muse Nov 29 '18 at 22:36
  • To prevent the leak of live data, you test against a copy of the system, not the real system. The easiest way to run a copy is on a virtual machine. If the system owner gives you an image to test against, that implies you are also being given consent to legitimately access it (avoiding the CMA violation.) – John Deters Nov 29 '18 at 23:19

Not the answer you're looking for? Browse other questions tagged or ask your own question.