An asset is safe & secure if it is free from unwanted damage.

1. Safety vs. Security An asset is safe & secure if it is free from unwanted damage. What’s the difference? safety security Traditional software testing doesn’t distinguish.

2. What Makes Security Testing More Difficult? “The difference between software safety and software security is therefore the presence of an intelligent adversary bent on breaking the system.” http://www.cigital.com/papers/download/bsi4-testing.pdf

3. Security Flaw Sources Coding (implementation) Vulnerabilities What to look for and how to search? Design Flaws Use threat/risk analysis to discover what needs testing. Testing needs to ensure… 1) functionality is properly implemented, and 2) risk is acceptable.

4. Security Testing Open Source Security Testing Methodology Manual http://www.isecom.org/mirror/OSSTMM.3.pdf

5. Types tester knows nothing about assets and defenses; target knows test details Blind tester knows nothing about assets and defenses; target is unaware of test Double Blind tester has incomplete knowledge of assets and defenses; target knows test details Gray Box tester has incomplete knowledge of assets and defenses; target expects test, but doesn’t know details Double Gray Box both tester and target know details of the assets, defense and test Tandem tester knows details of assets and defenses, but target unaware of test Reversal

6. Reasons Testing Fail ____________ testing discovers an error that isn’t real _____________ testing fails to discover an existing vulnerability _____ testing outcomes don’t necessarily reveal problems accurately (gray positives and gray negatives) ________ a test cannot be completed and is therefore inconclusive ____________ a test is bungled