Software Security - Week 12

Flashcards for reviewing software security concepts from lecture notes.

Black Box Testing

Testing the functionality of an application without knowledge of its internal implementation or code paths.

White Box Testing

A software testing technique where the tester has complete knowledge of the internal structure, code, and implementation of the system.

Grey Box Testing

A testing technique that combines elements of both white box and black box testing, where the tester has partial knowledge of the internal workings of the system.

Matrix Security Testing

Focuses on the variables within a program, enumerating them, evaluating risks, and ensuring they are used correctly and efficiently.

Regression Testing

Verifies that an application still passes tests after being modified to add functionality or fix security issues.

Pattern Testing

Investigates the past of an application to identify trends that have caused defects, predicting future issues.

Orthogonal Array Testing (OAT)

Uses statistics to create a set of test cases that provides good test coverage without exhaustive testing, optimizing test cases to reduce redundancy.

Penetration Testing (Pen Testing)

A security testing technique used to evaluate the security of a system by simulating a real-world attack.

Network Penetration Testing

Tests network infrastructure, including routers and firewalls, for vulnerabilities.

Web Application Penetration Testing

Tests web applications for vulnerabilities such as SQL injection or XSS.

Mobile Penetration Testing

Focuses on mobile apps to find security loopholes, such as testing API calls.

Wireless Penetration Testing

Analyzes Wi-Fi networks for weaknesses, such as cracking weak encryption.

Social Engineering Penetration Testing

Tests human factors by tricking users into revealing data, such as through phishing emails.

Cloud Penetration Testing

Tests vulnerabilities specific to cloud environments, such as misconfigured S3 buckets.

WHOIS

A widely used internet protocol and database that provides information about registered domain names.

Network Enumeration and Scanning

Scanning programs that identify live hosts, open ports, services, and other information on a network.

Vulnerability Testing and Exploitation

Checking hosts for known exploitable vulnerabilities to assess their potential severity.

Security Development Lifecycle (SDL)

A process for integrating security measures into software development to reduce vulnerabilities.

Input Validation

Always validate and sanitize user input to prevent security vulnerabilities such as SQL injection and XSS.

Wireshark

A widely-used open-source network protocol analyzer and packet sniffing tool.