Security Testing

Abstract

Identifying vulnerabilities and ensuring security functionality by security testing is a widely applied measure to evaluate and improve the security of software. Due to the openness of modern software-based systems, applying appropriate security testing techniques is of growing importance and essential to perform effective and efficient security testing. Therefore, an overview of actual security testing techniques is of high value both for researchers to evaluate and refine the techniques and for practitioners to apply and disseminate them. This chapter fulfills this need and provides an overview of recent security testing techniques. For this purpose, it first summarize the required background of testing and security engineering. Then, basics and recent developments of security testing techniques applied during the secure software development life cycle, ie, model-based security testing, code-based testing and static analysis, penetration testing and dynamic analysis, as well as security regression testing are discussed. Finally, the security testing techniques are illustrated by adopting them for an example three-tiered web-based business application.

Introduction

Modern IT systems based on concepts like cloud computing, location-based services, or social networking are permanently connected to other systems and handle sensitive data. These interconnected systems are subject to security attacks that may result in security incidents with high severity affecting the technical infrastructure or its environment. Exploited security vulnerabilities can cause drastic costs, eg, due to downtimes or the modification of data. A high proportion of all software security incidents is caused by attackers who exploit known vulnerabilities [1]. An important, effective, and widely applied measure to improve the security of software are security testing techniques which identify vulnerabilities and ensure security functionality.

Software testing is concerned with evaluation of software products and related artifacts to determine that they satisfy specified requirements, to demonstrate that they are fit for purpose and to detect defects. Security testing verifies and validates software system requirements related to security properties like confidentiality, integrity, availability, authentication, authorization, and nonrepudiation. Sometimes security properties come as classical functional requirements, eg, “user accounts are disabled after three unsuccessful login attempts” which approximates one part of an authorization property and is aligned with the software quality standard ISO/IEC 9126 [2] defining security as functional quality characteristic. However, it seems desirable that security testing directly targets the above security properties, as opposed to taking the detour of functional tests of security mechanisms. This view is supported by the ISO/IEC 25010 [3] standard that revises ISO/IEC 9126 and introduces Security as a new quality characteristic which is not included in the characteristic functionality any more.

Web application security vulnerabilities such as Cross-Site Scripting or SQL Injection, which can adequately be addressed by security testing techniques, are acknowledged problems [4] with thousands of vulnerabilities reported each year [5]. Furthermore, surveys as published by the National Institute of Standards and Technology [6] show high cost of insecure software due to inadequate testing even on an economic level. Therefore, support for security testing, which is still often considered as a “black art,” is essential to increase its effectiveness and efficiency in practice. This chapter intends to contribute to the growing need for information on security testing techniques by providing an overview of actual security testing techniques. This is of high value both for researchers to evaluate and refine existing techniques and practitioners to apply and disseminate them. In this chapter, security testing techniques are classified (and also the discussion thereof) according to their test basis within the secure software development life cycle into four different types: (1) model-based security testing is grounded on requirements and design models created during the analysis and design phase, (2) code-based testing and static analysis on source and byte code created during development, (3) penetration testing and dynamic analysis on running systems, either in a test or production environment, as well as (4) security regression testing performed during maintenance.

This chapter provides a comprehensive survey on security testing and is structured as follows. Section 2 provides an overview of the underlying concepts on software testing. Section 3 discusses the basic concepts of security engineering and the secure software development life cycle. Section 4 provides an overview of security testing and its integration in the secure software development life cycle. Section 5 discusses the security testing techniques model-based security testing, code-based testing and static analysis, penetration testing, and dynamic analysis as well as security regression testing in detail. Section 6 discusses the application of security testing techniques to three tiered business applications. Finally, Section 7 summarizes this chapter.