A Systematic Approach to Generate and Conduct Destructive Security Test Sets

Abstract:

Security testing involves two approaches; the question of who should do it has two answers. Standard testing organizations using a traditional approach can perform functional security testing. For example, ensuring that access control mechanisms work as advertised is a classic functional testing exercise. Systematic security testing approaches should be seamlessly incorporated into software engineering curricula and software development process. Traditional software engineering textbooks failed to provide adequate methods and techniques for students and software engineers to bring security engineering approaches to software development process generating secure software as well as correct software. This paper argues that a security testing phase should be added to software development process with systematic approach to generating and conducting destructive security test sets following a complete coverage principle. Software engineers must have formal training on writing secure code. The security testing tasks include penetrating and destructive tests that are different from functional testing tasks currently covered in software engineering textbooks Moreover, component-based development and formal methods could be useful to produce secure code, as well as automatic security checking tools. Some experience of applying security testing principles in our software engineering method teaching is reported.

• Periodical: Advanced Materials Research (Volumes 403-408)
• Pages: 4495-4498
• DOI: https://doi.org/10.4028/www.scientific.net/AMR.403-408.4495
• Online since: November 2011
• Authors: K. Madhuri, M. Suman, M. Nalini Sri, K. Ravi Kumar, U. Jyothi Kameswari
• Keywords: Destructive Tests, Distributed System, Functional Testing, Software Quality

References

[1] Computer Emergency Response Team (CERT) Coordination Center, http: /www. cert. org/, August (2003).

[2] Hao Chen and David Wagner, MOSPS: an Infrastructure for Examining Security Properties of Software, Proceedings of CCS'02, November 18 - 22, 2002, Washington, DC, USA.

[3] Carlo Ghezzi, Mehdi Jazayeri, and Dino Mandrioli, Fundamentals of Software Engineering, Prentice Hall, (1991).

[4] Frank Hayes, The Story So Far, ComputerWorld, Vol. 37, No 28, July 14, (2003).

[5] John E. Hopcroft, Rajeev Motwani, and Jeffery D. Ullman, Introduction to Automata Theory, Languages, and Computation, 2nd edition, Addison Wesley, (2001).

DOI: 10.1145/568438.568455

[6] Russell Kay, Buffer Overflow, Computer World, Vol. 37, No 28, July 14, (2003).

[7] Roger S. Pressman, Software Engineering, A Practitioner's Approach, 5th edition, McGraw Hill, (2001).

[8] Johnn M. Schumann, Automated Theorem Proving in Software Engineering, Springer-Verlag, Berlin, (2001).

[9] Ian Sommerville, Software Engineering, 6th edition, Addison Wesley, (2001).

[10] SECURITY WIRE DIGEST, VOL. 5, NO. 59, AUGUST 7, (2003).

[11] John Viega and Gary McGraw, Building Secure Software, Addison Wesley, (2002).

[12] James A. Whittaker and Herbert H. Thompson, How to Break Software Security, Addison Wesley, (2003).

[13] Clemens Szyperski, Component Software: Beyond Object-Oriented Programming, Addison-Wesley, 2nd eds., 2002. ISBN: 0-201-74572-0.

[14] Ivica Crnkovic and Magnus Larsson, Building Reliable Component-Based Software Systems, Artech House, Norwood, MA 02062, 2002. ISBN: 1-58053-327-2.

[15] George T. Heineman and William T. Councill eds: Component-Based Software Engineering, Putting the Pieces Together, Addison-Wisley.