Security Testing Flashcards
Software Testing
Connectivity
Vulnerability
Security Testing
Software Testing: Software Evaluation against (Functional/Non-functional) Requirements.
Connectivity: e.g., Cloud Computing, Location-based Services
Vulnerability: A weakness of an asset or group of assets that can be exploited by one or more threats
Security Testing: Software Evaluation against Security Requirements
Static Testing
Dynamic Testing
Test Suite
Static Testing: Review software development artifacts without executing them
Dynamic Testing: Execute and Verify Software against expected behaviours from a finite set of Test Cases
Test Suite = A finite set of test cases
Test Case Execution
Verdict: Pass / Fail / Inclusive
Failure: an undesired behaviour
Fault: the cause of the failure
Security functional testing
Security vulnerability testing
Security functional testing: To validate intended security functionality
Security vulnerability testing: To identify unintended system vulnerabilities
Exploitation
Attack
Exploitation: malicious input/steps to make use of a vulnerability
Attack: perform an exploitation to violate related security property of an asset
Model-Based Testing (MBT)
Automatic and systematic generation of test cases from models of systems under test and their environments
MBT Benefits
Better documentation of test cases
The ability to automatically generate useful tests and measure and optimize test coverage
Higher test quality through model-based quality analysis
Shorter schedules and lower costs
Model-Based Security Testing (MBST)
Input Models:
Attacker models: attackers’ targets, capabilities and steps
Vulnerability models: Weakness encoding in system models
Properties models: Asset not-to-be-violated security properties (CIA) encoding in system models
Abstract Test Cases (ATC)
ATC = A sequence of Attack Actions.
ATC Execution = Execute every attack action in order.
Successful Execution/Attack = All attack actions are successfully executed.
Failed Execution/Attack = All attack actions are successfully executed.
An ATC passes if its execution is not successful.
An ATC fails if its execution is successful.
Coded-Base Security Testing (CBST)
To detect vulnerabilities by examining the source code.
Input: Source code (non-executable system under test)
Approaches: Manual vs Automatic
Manual Code Review
Expert to read source code line-by-line
Steps:
To understand attack surfaces
To review code
To report the result
Static Application Security Testing
(SAST)
Syntactic checks: e.g., calling insecure APIs, using insecure configuration options
Semantic checks: using models of data flow and/or control flow.
E.g., SQL Injection vulnerability due to an unsanitised data flow
from input to a SQL statement.
Penetration Testing
To mimic real-world attacks on real systems and data.
To use tools and techniques commonly used by attackers.
To avoid the security features.
To seek combinations of vulnerabilities on one or more systems to gain more access
Pen-Testing Pros
Pen-testing helps determine:
The system tolerance under real-world attacks.
The level of sophistication an attacker needs.
Additional countermeasures to mitigate threats.
Defenders’ ability to detect and respond to attacks
Pen-Testing Cons
Labour intensive.
Require great expertise.
Cause SUT (or even relevant systems) damaged or inoperative.
Need careful consideration, notification and planning
