Advertisement

Proactive Security Testing and Fuzzing

  • Ari Takanen

Abstract

Software is bound to have security critical flaws, and no testing or code auditing can ensure that software is flaw-less. But software security testing requirements have improved radically during the past years, largely due to criticism from security conscious consumers and Enterprise customers. Whereas in the past, security flaws were taken for granted (and patches were quietly and humbly installed), they now are probably one of the most common reasons why people switch vendors or software providers. The maintenance costs from security updates often add to become one of the biggest cost items to large Enterprise users. Fortunately test automation techniques have also improved. Techniques like model-based testing (MBT) enable efficient generation of security tests that reach good confidence levels in discovering zero-day mistakes in software. This technique is called fuzzing.

Keywords

Security Test Static Analysis Tool Remote Interface Fuzz Test Pass Pass 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

References

  1. Eronen, Juhani; Laakso, Marko: A Case for Protocol Dependency. In proceedings of the First IEEE In-ternational Workshop on Critical Infrastructure Protection. Darmstadt, Germany. November 3-4, 2005.Google Scholar
  2. Kaksonen, Rauli: A Functional Method for Assessing Protocol Implementation Security (Licentiate thesis). Espoo. 2001. Technical Research Centre of Finland, VTT Publications 447. 128 p. + app. 15 p. ISBN 951-38-5873-1 (soft back ed.) ISBN 951-38-5874-X (on-line ed.).Google Scholar
  3. McGraw, Gary; Chess, Brian and Migues, Sammy: Building Security In Maturity Model, http://www.bsi-mm.com, 2009, 53 p.
  4. Puolitaival, Olli-Pekka: Model-based testing tools. Presentation at Software Testing Day at TUT. March 25-26, 2008.Google Scholar
  5. Takanen, Ari; DeMott, Jared and Miller, Charlie: Fuzzing for Software Security Testing and Quality Assurance. Artech House. 2008. 230p. ISBN 978-1-59693-214-2.Google Scholar

Copyright information

© Vieweg+Teubner | GWV Fachverlage GmbH 2010

Authors and Affiliations

  • Ari Takanen

There are no affiliations available

Personalised recommendations