Software Security
Software Security
Renewed interest
“idea of engineering software so that it continues
to function correctly under malicious attack”
Existing software is riddled with design flaws and
implementation bugs
“any program, no matter how innocuous it seems,
can harbor security holes”
•Security Testing
– Security is a protection system that is needed to
assure the customers that their data will be
protected.
• For example, internet users feel that their personal data/
information is not secure, the system loses its
accountability.
– Security may include controlling access to data,
encrypting data in communication, ensuring
secrecy of stored data, auditing security events,
etc.
• Security breaches can result in loss of information,
privacy violations, denial of service, etc.
•Types of security requirements
•While performing security testing, the following
security requirements must be considered:
– Security requirements should be associated with each
fundamental requirement.
• Each functional requirement, most likely, has a specific set
of related security issues to be addressed in the software
implementation.
• For example, the log on requirement in a client server
system must specify the number of retries allowed, the
action to be taken if the log-on fails, and so on.
4
– In addition to the security concerns that are directly
related to particular requirements, a software project
has security issues that are global in nature, and are
therefore, related to the application’s architecture and
overall implementation.
• For example, a web application may have a global requirement
that all private customer data of any kind is stored in
encrypted form in the database.
• In another example, a system wide security requirement is to
use SSL to encrypt the data sent between the client browser
and the web server- the testing team should verify the
correctness of SSL.
5
