Abstract
The goal of security testing is to verify and validate the potentiality of different vulnerabilities. For identified threats ensure that security mechanism deployed during design really mitigate the threats at vulnerable points. This requires checking that during functionality execution the threats to the assets really get mitigated. In this paper we propose a Framework for Security Testing that involves identifying different attacks that are possible by different stakeholders or intruders for each functionality offered by the system. Next we validate that the design decision taken to implement the security requirement associated with that functionality is appropriate to mitigate identified threats and risks on assets involved. Finally a test report template is designed which can be used to review the deployed security mechanism.
This is a preview of subscription content, log in via an institution.
Buying options
Tax calculation will be finalised at checkout
Purchases are for personal use only
Learn about institutional subscriptionsPreview
Unable to display preview. Download preview PDF.
References
Benjamin, F., Seda, G., Marittal, H., Thomas, S., Holger, S.: A comparison of security require-ments engineering methods. Requirements Engineering 15(1), 7–40 (2010)
Firesmith, D.G.: Engineering Security Requirements. Journal of Object Technology 2(1), 53–68 (2003)
Agarwal, A., Gupta, D.: Security Requirement Elicitation Using View Points for online System. In: Emerging Trends in Engineering and Technology, ICETET 2008, pp. 1238–1243. IEEE Computer Society (2008)
Jaiswal, S., Gupta, D.: Security Requirement Prioritization. In: The Proceeding of SERP 2009, pp. 673–679 (2009)
Chatterjee, K., Gupta, D., De, A.: A Framework for Security Design Engineering Process. In: Venugopal, K.R., Patnaik, L.M. (eds.) ICIP 2011. CCIS, vol. 157, pp. 287–293. Springer, Heidelberg (2011)
David, B., Jurgen, D., Lodderstedt, T.: Model Driven Security: From UML Models to Access Control Infrastructures. ACM Transactions on Software Engineering and Methodology 15(1), 39–91 (2006)
Schieferdecker, I., Grossmann, J., Schneider, M.: Model Based Security Testing. In: Workshop on Model- Based Testing 2012 (MBT 2012). EPTCS, vol. 80, pp. 1–12 (2012)
Wang, L., Wong, E., Xu, D.: A Threat Model Driven Approach for Security Testing. In: Third International Workshop on Software Engineering for Secure Systems (SESS 2007). IEEE Computer Society (2007)
Mouratidis, H., Giorgini, P.: Security Attack Testing (SAT) – testing the security of information systems at design time. Journal of Information Systems 32(8), 1166–1183 (2007)
The Logic behind CRAMM’s Assessment of Measures of Risk and Determination of Appropriate Countermeasures, http://www.cramm.com
Gupta, D., Chatterjee, K., De, A.: A Framework for Development of Secure Software. CSI Transaction on ICT (2013)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2013 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Gupta, D., Chatterjee, K., Jaiswal, S. (2013). A Framework for Security Testing. In: Murgante, B., et al. Computational Science and Its Applications – ICCSA 2013. ICCSA 2013. Lecture Notes in Computer Science, vol 7973. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-39646-5_14
Download citation
DOI: https://doi.org/10.1007/978-3-642-39646-5_14
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-39645-8
Online ISBN: 978-3-642-39646-5
eBook Packages: Computer ScienceComputer Science (R0)