CSSLP Chapter 5 - Secure Software Testing

CSSLP Chapter 5 - Secure Software Testing

List software security testing standards.

ISO 9126, Open Source Security Testing Methodology Manual (OSSTMM), System Security Engineering Capability Maturity Model (SSE-CMM)

What are the different kinds of reliability testing?

Unit, Integration, Logic, Regression

What are the different kinds of recoverability testing?

Performance (Load, Stress), Scalability

What are the different types of resiliency testing, and what's another name for it?

White box, Black box. Also called security testing.

What other kinds of software QA testing are there besides reliability, recoverability, and resiliency?

Environment, Privacy, User acceptance

What is reliability testing?

Functional testing. Does the software function as it is supposed to according to the requirements of the business owner.

Who conducts unit testing?

Typically developers.

What does unit testing do?

Tests each part in isolation for build and compilation errors as well as functional logic.

What are drivers and stubs in the software testing context?

Drivers are testing code that simulates a function's caller. Stubs are testing code that simulates a called unit. Both can be used to mock objects to remove testing dependencies.

What are the benefits of unit testing?

Validate functional logic. Find out inefficiencies, complexities, and vulnerabilities in code, as the code is tested after being isolated into units, as opposed to being integrated and tested as a whole. Automate testing processes by integrating easily with automated build scripts and tools. Extend test coverage. Enable collective code ownership in agile development.

What is integration testing?

Aggregating multiple units of code together for testing.

What is logic testing?

Testing that validates the accuracy of the software processing logic.

When is logic testing most important?

When software has high cyclomatic complexity.

What kind of testing tests predicates, and what are they?

Logic testing. A predicate is something that is affirmed or denied of the subject in a proposition in logic.

What is regression testing? What is its other name?

Regression testing is testing that is performed to ensure that changes to software don't reintroduce old defects. Also called verification testing.

What is the recommended method to perform regression testing?

Create a library of tests that includes a predefined set of tests to be conducted before the release of any new version. These should always test boundary conditions and timing.

Who usually performs regression testing?

QA teams.

What is recoverability testing?

Performance or scalability testing to ensure that software will be available when required.

What is the difference between load and stress testing?

Load testing determines software's maximum capacity. Stress testing exceeds it, in part to determine if the software recovers gracefully.

What is fuzzing?

A kind of software testing where random or pseudorandom input is injected and the behavior of the software under test observed.

What does fuzzing test?

The effectiveness of input validation.

What is synthesized fuzzing data?

Data that is generated from scratch without being based on previous input.

What is mutated fuzzing data?

Data created from valid data, but corrupted so it's not what the application expects.

What is the difference between dumb and smart fuzzing?

Dumb fuzzing uses truly random data without any consideration for data structure. Smart fuzzing uses data structure (encoding, checksums, etc).

What is the difference between dumb and smart fuzzing?

Dumb fuzzing uses truly random data without any consideration for data structure. Smart fuzzing uses data structure (encoding, checksums, etc).

What is the difference between static and dynamic software scanning?

Static scanning scans the source code for vulnerabilities. Dynamic scanning scans the software at runtime.

What kinds of scans does PCI-DSS require?

Network, host, and applications in the card holder data environment.

What is scanning used for?

Map the computing ecosystems, infrastructural, and application interfaces. Identify server versions, open ports, and running services. Inventory and validate asset management databases. Identify patch levels. Prove due diligence and due care for compliance reasons.