stephen
Joined: 31 Aug 2007
Posts: 13
|
 Posted: Sat Sep 01, 2007 6:40 pm Post subject: Technologies for Black Box Security Testing... |
 |
|
Black box testing for security has a different technological focus than traditional black box testing. [Fink 04] defines positive requirements as those requirements that state what a software system should do, while negative requirements state what it should not do. Although security testing deals with positive requirements as well as negative ones, the emphasis is on negative requirements. In contrast, traditional software testing focuses on positive requirements. This difference in emphasis is reflected in the test tools that support black box test activities.
The technology incorporated in such tools can be classified as follows, according to its functionality:
Fuzzing: the injection of random or systematically-generated data at various interfaces, with various levels of human intervention to specify the format of the data
Syntax testing: generating a wide range of legal and illegal input values, usually with some knowledge of the protocols and data formats used by the software
Exploratory testing: testing without specific expectation about test outcomes, and generally without a precise test plan
Data analysis: testing the data created by an application, especially in the context of cryptography
Test scaffolding: providing testers with support tools they need in order to carry out their own black box tests. For example, if the tester wants to inject a certain error code when an application tries to open a pipe, support technology is needed to actually carry out this test.
Monitoring program behavior: When a large number of tests are automatically applied, it is useful to also have automatic techniques for monitoring how the program responds. This saves testers from having to check for anomalous behavior manually. Of course, a human is better at seeing anomalous behavior, but the anomalies that signal the presence of a security vulnerability are often quite obvious. |
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
