Proactive Security Testing and Fuzzing
Software is bound to have security critical flaws, and no testing or code auditing can ensure that software is flaw-less. But software security testing requirements have improved radically during the past years, largely due to criticism from security conscious consumers and Enterprise customers. Whereas in the past, security flaws were taken for granted (and patches were quietly and humbly installed), they now are probably one of the most common reasons why people switch vendors or software providers. The maintenance costs from security updates often add to become one of the biggest cost items to large Enterprise users. Fortunately test automation techniques have also improved. Techniques like model-based testing (MBT) enable efficient generation of security tests that reach good confidence levels in discovering zero-day mistakes in software. This technique is called fuzzing.
KeywordsSecurity Test Static Analysis Tool Remote Interface Fuzz Test Pass Pass
Unable to display preview. Download preview PDF.
- Eronen, Juhani; Laakso, Marko: A Case for Protocol Dependency. In proceedings of the First IEEE In-ternational Workshop on Critical Infrastructure Protection. Darmstadt, Germany. November 3-4, 2005.Google Scholar
- Kaksonen, Rauli: A Functional Method for Assessing Protocol Implementation Security (Licentiate thesis). Espoo. 2001. Technical Research Centre of Finland, VTT Publications 447. 128 p. + app. 15 p. ISBN 951-38-5873-1 (soft back ed.) ISBN 951-38-5874-X (on-line ed.).Google Scholar
- McGraw, Gary; Chess, Brian and Migues, Sammy: Building Security In Maturity Model, http://www.bsi-mm.com, 2009, 53 p.
- Puolitaival, Olli-Pekka: Model-based testing tools. Presentation at Software Testing Day at TUT. March 25-26, 2008.Google Scholar
- Takanen, Ari; DeMott, Jared and Miller, Charlie: Fuzzing for Software Security Testing and Quality Assurance. Artech House. 2008. 230p. ISBN 978-1-59693-214-2.Google Scholar