Section 3 - Software Security Test Plan Flashcards
What is the 3rd Phase of the SDL
Design and Development (A3)
In A2 Architecture we perform a compliance review. In A3 what the next step is
Perform Policy Compliance Analysis
For Security Test Planning which is method is best - Risk Based vs Requirements based
Neither. Both and they should augment them due to the challenges of software development
What are the 3 security testing techniques
White Box - Source Code analysis, property-based, source code fault injection
Grey Box - has insight but uses Black Box - Source code fault injection, Dynamic code analysis
Black box - fuzzing, binary code analysis, Byte code analysis, vulnerability scanning and penetration testing.
What are the Key Success Factors for 3rd Phase of SDL
What are the deliverables of the 3rd Phase of SDL
What are the types of Testing Strategy
Units Tests to Start
Integrated Tests
Systems Test - Alpha
Quality Assurance Tests - not on project team - Beta Testing
Production Testing - Penetration Testing and Vulnerability Testing -
What type of testing would be using fault injection
Failure Testing
Test in a way if something with invalid input
What type of testing is based on normal user activity and normal errors
Application Testing
What type of testing uses transactions, loads and stress testing
Capacity Testing
Attempt to overwhelm and break testing
Systems should fail secure
What is the testing when changes are made they do not effect other functions
Regression Testing
performance of database transactions
overwrite previous changes
T or F Dynamic Testing is Black Box
True
that is functional testing
What is Interactive Application Security Testing (IAST)
IAST
Enhancement to Dynamic or run time testing
Sensors monitor software operations
May integrated with software composition analysis
T or F Static Testing is White Box
True
checking for back doors and other anomalies
One key point for Peer Review
Independence
What is a test methodology in which assessor under specific constraints, attempt to defeat the security
Penetration Testing
Vulnerability assessment are precursors to this
What is the most common Penetration Testing when it comes to knowledge
Partial Knowledge - gives us an advantage to expedite tests
Zero Knowledge - allows us to look at bigger picture. Much more expensive
Full Knowledge - Red Team and they know everything
What are the “Hats” in Security Testing
White Hat - Ethical Testing
Grey Hat - Semi Ethical & tolerated
Black Hat - Unauthorized
Internal Awareness Options
Blind Test - for example a vulnerability scan without notice
Double Blind - Do not tell security team either
Challenges with Cryptography
Lost Key
History
split knowledge
Cryptoperiod - expiration of keys
Hard Coded Credentials
What type of testing tests the edges of what is allowed or not allowed.
Fuzzing
for example days of month such as 31st on all months.
Mutated data
What type of testing is a simulation that works well with Web Application
Synthetic Testing
simulates the actions of the user
Enables faster detection of failed or compromised system
What is the name for Certifications and Accreditation
Systems Authorization
What is the next step in A4 (Design and Development) regarding compliance
This is the continuing effort to review and perform analysis on compliance requirements.
What are the 4 steps in the Code Review Process
Identify Security Code Review Objectives
Perform Preliminary Scan
Review Code for Security Issues
Review for Security Issues Unique to the Architecture
What is an ideal flow of activities for code review success
Threat Modeling
Code Reviews
Resolve Problems
Learn the Lesson
T or F - there is no false positives in Fuzz Testing
True
every flaw is discovered as a result of a simulated attack
What are the two types of Fuzz Testing
Smart - pushes data in logical ways due to in-depth knowledge
Dumb - system pushes data without waiting for response.
What is the type of code testing that is done line-by-line inspection
Manual Code Review
most expensive
understand Control Flow - logical conditions vs
Data Flow Analysis
What are the key success factors in the 4th phase of SDL
Security Testing Execution
Security Testing and Remediation
Privacy Validation and remediation
Policy Compliance Review
What are the Deliverables in A4 of SDL
Security Test Execution Report
Updated Compliance Policy Analysis
Privacy Compliance Report
Security Testing Reports
Remediation Reports
