Software Security Testing Process: Phased Approach

Background: Software testing and software security have become one of the most important parts of an application. Many studies have explored each of these topics but there is a gap wherein the relation of software security and software testing in general has not been explored. Objective: This study aims to conduct a systematic literature review to capture the current state-of-the-art in software testing related to security. Methods: The search strategy obtains relevant papers from IEEE Xplore and ScienceDirect. The results of the search are filtered by applying inclusion and exclusion criteria. Results: The search results identified 50 papers. After applying the inclusion/exclusion criteria, we identified 15 primary studies that discuss software security and software testing. We found approaches, aspects, references, and domains that are used in software security and software testing. Conclusion: We found certain approach, aspect, references, and domain are used more often in software security testing Keywords: Software security, Software testing, Security testing approach, Security threats, Systematic literature review

Security affects every software component in different types of computing systems. Many vulnerabilities and attacks on software systems are due to security weaknesses in the software itself. During the process of software specification, development, or testing, security issues are either taken into consideration insufficiently or not at all. Such software, due to internal weaknesses is prone to new attacks. By teaching secure software engineering techniques for designing and developing software modules, students would learn systematic secure software development techniques, such as defect detecting and security testing. This paper presents a series of modules that are designed to be integrated into undergraduate software engineering courses from a security perspective. The goal of the modules is to teach the building of robust software security requirements, secure software design and development, and secure software verification through a secure software development lifecycle.

“Essential Security Practices for Fortifying Mobile Apps” is a definitive guide designed to empower developers, security professionals, and organizations with the knowledge and tools needed to secure mobile applications in an increasingly complex digital landscape. This comprehensive book covers every aspect of mobile app security, providing actionable insights and practical strategies to protect apps from the ever-evolving threat landscape. The book begins with an Introduction to Mobile App Security (Chapter 1), where readers are introduced to the critical importance of securing mobile apps. It discusses common security threats, the principles of security by design, and the unique challenges faced in mobile app development. The chapter also includes case studies of major security breaches, offering real-world context to the concepts discussed. In Secure Development Lifecycle (Chapter 2), the book emphasizes the importance of integrating security into the Software Development Lifecycle (SDLC). Topics such as threat modeling, secure coding practices, and penetration testing are explored in depth. This chapter also covers the role of continuous integration in maintaining security and the necessity of incident response planning and security training. Authentication and Authorization (Chapter 3) dives into the mechanisms that ensure only authorized users have access to mobile apps. It covers secure authentication methods, including multi-factor authentication and token-based authentication, as well as best practices for session management and password storage. The chapter provides guidelines to avoid common authentication flaws that could compromise app security. Data Protection and Privacy (Chapter 4) addresses the crucial aspects of encrypting data both at rest and in transit. It discusses secure data storage, privacy by design principles, and the handling of personally identifiable information (PII). Readers will learn about secure data deletion and compliance with data protection regulations, as well as the use of secure cryptographic libraries. Network Security (Chapter 5) explores the protocols and techniques needed to secure communication between mobile apps and their backend systems. The chapter covers the correct use of TLS/SSL, protecting against man-in-the-middle attacks, and securing backend APIs. It also discusses the importance of monitoring and logging network activity to detect and respond to potential threats. The book then moves on to Secure Coding Practices (Chapter 6), providing guidance on avoiding common coding vulnerabilities through input validation, error handling, and defensive programming techniques. It also covers secure code reviews and the best practices for using mobile platform APIs securely. Mobile Device Security (Chapter 7) shifts focus to the security of the devices on which mobile apps run. The chapter discusses mobile device threats, secure device configuration, and the use of mobile device management (MDM) solutions. It also addresses the security features of mobile devices, such as secure boot and remote wiping, which are essential for protecting against device theft or loss. In Secure Deployment and Distribution (Chapter 8), readers will learn about secure strategies for deploying and distributing mobile apps. Topics include code signing, protecting against repackaging and tampering, and securely distributing sensitive data. The chapter also covers handling updates and patches, ensuring that apps remain secure after deployment. Security Testing and Validation (Chapter 9) provides an in-depth look at the various types of security testing, including automated and manual testing techniques. It discusses penetration testing best practices, vulnerability assessment, and the integration of security testing into CI/CD pipelines. Regular security audits and addressing found vulnerabilities are also emphasized. Incident Response and Management (Chapter 10) guides readers in building an effective incident response team and creating a robust incident response plan. The chapter covers the steps for detecting, analyzing, containing, eradicating, and recovering from security incidents. Post-incident analysis and communication with stakeholders are also discussed, alongside legal and regulatory considerations. Finally, Future Trends in Mobile App Security (Chapter 11) explores the emerging threats and advancements in mobile security technologies. The chapter discusses the role of artificial intelligence in security, the integration of IoT with mobile devices, and the potential of blockchain in enhancing mobile security. It also highlights the importance of user education and awareness in safeguarding mobile applications in the future. “Essential Security Practices for Fortifying Mobile Apps” is an invaluable resource for anyone involved in the development, deployment, and management of mobile applications, offering a thorough understanding of the security challenges and the strategies needed to overcome them.

Software security testing is an important technique for discovering software vulnerabilities that violate security requirements. Existing security testing methods, however, seldom generate security tests directly from security requirements specifications. To address this issue, this paper presents an approach for constructing security test models from the artifacts of misuse case modeling (i.e., use/misuse cases and mitigation use cases), which is a popular method for security requirements specification in the software development process. The security test models can then be used to automatically generate security tests, which consist of test inputs (normal behaviors from use cases and attack actions from misuse cases) and test oracles from mitigation use cases. We have applied the approach to two case studies. One case study demonstrates that the proposed approach can build security test models in a structured fashion such that the generated security tests are as effective as reported in the literature. The second case study applies the proposed approach to an ongoing software development project. The security tests have revealed at least 24 vulnerabilities, and are very helpful for the development team to improve the security of the software implementation. This demonstrates that the proposed approach is effective in the software development process.

Information security is a critical issue in the context of complex and interconnected nowadays IT Systems. Innovative testing approaches are demanded to verify whether the main security characteristics are provided in the systems. The conceptual formalization level required by security test processes can be supplied by semantic technologies. STEP-ONE is the Security TEst Process supported by ONtology Environment; its foundations come from largely accepted testing processes and security testing standards. The STPO (Security Testing Process Ontology) formalizes and makes explicit the main concepts of the domain. We present a conceptual characterization of STEP-ONE and describe a usage scenario to illustrate how the proposal can be applied. The main contributions are the conceptual process and the ontology. Our proposal is meant to be applied for the evaluation of IT systems with respect to security characteristics as well as to make systematic the security testing activities.

This paper presents the software security (application security) solutions. It is an idea of engineering software so that it continues to function correctly under malicious attack. Although as a discipline software security is relatively young, much progress has been made on ways to integrate security best practices into the software development life cycle. Microsoft, for example, has helped spearhead soft ware security through its Trustworthy Computing Initiative and the resulting Security Development Lifecycle (SDL). Cigital has also been instrumental in bringing software security to the wider market through its professional services.

Today's ongoing trend towards intense usage of web service based applications in daily business and everybody's daily life poses new challenges for security testing. Additionally, such applications mostly not execute in their own runtime environment but instead are deployed in some data center, run alongside multiple other applications, and serve different purposes for sundry user domains with diverging security requirements. As a consequence, security testing also has to adapt to be able to meet the necessary requirements for each application in its domain and its specific security requirements. In addition, security testing needs to be feasible for both service providers and consumers. In our paper we identify drawbacks of existing security testing approaches and provide directions for meeting emerging challenges in future security testing approaches. We also introduce and describe the idea of language-oriented security testing, a novel testing approach building upon domain-specific languages and domain knowledge to meet future requirements in security testing.

This study aims to analyze and improve the security of the SawitGoDigi Palm Oil Harvest Recording Information System using grey-box and white-box testing approaches. The system is used by farmers, agents, drivers, and administrators to manage land data, harvest results, distribution, and transaction records, which makes it highly exposed to security risks if vulnerabilities are present. The security testing process was conducted based on the OWASP Web Security Testing Guide (WSTG) v4.2 and the OWASP Risk Rating Methodology. The testing stages included reconnaissance, automated scanning using OWASP ZAP, manual exploitation, risk evaluation, implementation of security improvements, and retesting. The results revealed several significant vulnerabilities, including SQL Injection in the search feature, weak session management through the trusted_device cookie, and the absence of a rate-limiting mechanism that enabled brute-force attacks during the login process. The risk assessment indicated that SQL Injection and session hijacking were classified as High risk, while brute-force attacks were categorized as Medium risk. Security improvements were implemented through the use of prepared statements, strengthening cookie attributes, adding security headers, and implementing rate limiting. Retesting results confirmed that all identified vulnerabilities were successfully mitigated and reduced to a Low-risk level. This study demonstrates that a comprehensive security testing approach, which includes exploitation, remediation, and verification through retesting, can significantly enhance the security of agribusiness web applications. Furthermore, the findings show that before remediation, the system contained four vulnerabilities with High and Medium risk levels, namely SQL Injection, Session Hijacking, Brute-Force Login, and Security Misconfiguration. After the remediation and retesting process, all High- and Medium-risk vulnerabilities were successfully reduced to Low risk or marked as Closed, indicating that the system is secure for operational use.

With the dramatic increase in the number of software security problems, a growing body of research in how to integrate security within software development is notable. Many security approaches have appeared to solve security problems by applying a set of activities through Software Development Life Cycle (SDLC). Among the top approaches are McGraw's Touchpoints, Comprehensive Lightweight Application Security Process (CLASP) from Open Web Application Security Project (OWASP) organization, and Microsoft Security Development Lifecycle (SDL). In this paper, we evaluate these three security approaches by discussing their common process, strength, and limitations. Moreover, we discuss why these approaches do not effectively increase software security. Finally, we set the stage for a future framework to enhance and simplify the application of various security activities within the SDLC.

Edge computing is a distributed computing paradigm aiming at ensuring low latency in modern data intensive applications (e.g., video streaming and IoT). It consists of deploying computation and storage nodes close to the end-users. Unfortunately, being distributed and close to end-users, Edge systems have a wider attack surface (e.g., they may be physically reachable) and are more complex to update than other types of systems (e.g., Cloud systems) thus requiring thorough security testing activities, possibly tailored to be cost-effective. To support the development of effective and automated Edge security testing solutions, we conducted an empirical study of vulnerabilities affecting Edge frameworks. The study is driven by eight research questions that aim to determine what test triggers, test harnesses, test oracles, and input types should be considered when defining new security testing approaches dedicated to Edge systems. preconditions and inputs leading to a successful exploit, the security properties being violated, the most frequent vulnerability types, the software behaviours and developer mistakes associated to these vulnerabilities, and the severity of Edge vulnerabilities. We have inspected 147 vulnerabilities of four popular Edge frameworks. Our findings indicate that vulnerabilities slip through the testing process because of the complexity of the Edge features. Indeed, they can’t be exhaustively tested in-house because of the large number of combinations of inputs, outputs, and interfaces to be tested. Since we observed that most of the vulnerabilities do not affect the system integrity and, further, only one action (e.g., requesting a URL) is sufficient to exploit a vulnerability

Implementing a secure development lifecycle (SDL) presents increasing challenges to software developers as they must ensure software correctly integrates both underlying operating system security features while also managing dependencies on third-party libraries or executables. There are a growing number of security functions that require a close integration between the OS security features and software builds to ensure strong protection. Furthermore, as software platforms grow in complexity, they present many opportunities for misconfigurations and inadequate defenses. This challenge is especially prevalent for industrial control systems (ICS), which oten depend on both legacy sotware platforms, or out of date operating systems. This paper presents the AttackSurface Host Analyzer (AHA) tool, which is used to assess the security of a software platform through its integration with a host operating system. The tool collects data from the various platforms running on an OS, evaluates an array of security properties, and then introduces metrics and visualizations to provide feedback on the system's attack surface based on the external interconnections and the completeness of the available security protections. The paper then explores the attack surface of a variety of industry-standard ICS platforms to provide insight into the current degree of protection enabled by them.

The security demands on development teams are growing in direct proportion to the security incidents discovered and leveraged in computer crime and cyber warfare every day. There is ongoing research to increase the effectiveness of security defect detection and penetration testing of products, but where the literature is thin, is in actual case studies that apply security assurance processes in a large-scale hardware-centric environment. This paper adds to the literature by providing an actual case study of hardware security assurance practices using a sample size of 151 projects. Furthermore, it documents and analyzes the efficacy of deploying selective automation using quantitative weighted risk ratings of the Security Development Lifecycle (SDL) to hardware projects, including strategic reuse of existing SDL collaterals for derivative projects. The evaluated methodology provided acceptable accuracy and labor savings, but the results indicate that automation focusing on assignment of a quantitative risk scoring introduces a dilution of real security concerns; instead, an approach using qualitative analysis and assignment of security assurance tasks is more beneficial.

The rapid pace of software development and deployment in today's digital world demands an integrated approach to security, particularly in Continuous Integration/Continuous Deployment (CI/CD) pipelines. Traditional approaches to security, where it is added at the end of the development lifecycle, have proven inadequate in addressing the complexities and vulnerabilities introduced by fast-moving development cycles. DevSecOps (Development, Security, and Operations) represents an evolution of the DevOps culture that integrates security as an essential component throughout the development process, rather than as an afterthought. This paper explores the role of DevSecOps in ensuring continuous security integration within CI/CD pipelines, focusing on its principles, practices, and impact on both security and development efficiency. DevSecOps emphasizes the shift-left approach, where security is integrated early in the software development lifecycle (SDLC) to identify and mitigate vulnerabilities before they reach production. By embedding security practices into CI/CD workflows, organizations can achieve continuous security validation and testing in tandem with software development activities. Key components of a successful DevSecOps implementation include automated security testing, real-time vulnerability scanning, infrastructure as code (IaC) security, and threat intelligence integration. Through the use of tools like static application security testing (SAST), dynamic application security testing (DAST), and software composition analysis (SCA), DevSecOps facilitates the continuous monitoring of code, configurations, and infrastructure for security issues. This paper also examines the cultural shift required to adopt DevSecOps within development teams. It highlights the importance of fostering collaboration between development, security, and operations teams to ensure seamless integration of security practices into the CI/CD pipeline. By aligning security teams with development and operations, DevSecOps fosters a culture of shared responsibility for security, breaking down silos that traditionally hinder effective security integration.

Software is a complex thing. It is not an engineering artifact that springs forth from a design by simply following software coding rules; creativity and the human element are at the heart of the process. Software development is part science, part art, and part craft. Design, architecture, and coding are equally important activities and in each of these activities, errors may be introduced that lead to security vulnerabilities. Therefore, inevitably, errors enter into the code. Some of these errors are discovered during testing; however, some are not. The best way to find security errors, whether they are introduced as part of the architecture development effort or coding effort, is to automate the security testing process to the maximum extent possible and add this class of tools to the tools available, which aids in the compilation process, testing, test analysis, and software distribution. Recent technological advances, improvements in computer-generated forces (CGFs), and results in research in information assurance and software protection indicate that we can build a semi-intelligent software security testing tool. However, before we can undertake the security testing automation effort, we must understand the scope of the required testing, the security failures that need to be uncovered during testing, and the characteristics of the failures. Therefore, we undertook the research reported in the paper, which is the development of a taxonomy and a discussion of software attacks generated from the point of view of the security tester with the goal of using the taxonomy to guide the development of the knowledge base for the automated security testing tool. The representation for attacks and threat cases yielded by this research captures the strategies, tactics, and other considerations that come into play during the planning and execution of attacks upon application software. The paper is organized as follows. Section one contains an introduction to our research and a discussion of the motivation for our work. Section two contains a presents our taxonomy of software attacks and a discussion of the strategies employed and general weaknesses exploited for each attack. Section three contains a summary and suggestions for further research.

In the past decades, automated test case generation for detecting software vulnerabilities using the search-based algorithm has been a crucial research area for security researchers. Several proposed techniques partially achieve the automatic test case generation of detecting security issues that target specific programming languages or API types. This review paper performs a comparative analysis of research papers published during 2010–21 specific to the search-based techniques used for automatic test case generation. We have chosen five criteria for evaluating the proposed techniques. These are target vulnerability, search-based algorithms used, test case generation source, test case generation method, and target language. We focused primarily on the techniques detecting the four most dangerous vulnerabilities found in the modern distributed system, namely Denial of Service (e.g., program crash), SQL injection, Cross-Site Scripting, and XML injection. We also incorporated the fitness function comparison table for each method, including the merits and limitations. This work will assist security researchers in finding new directions in the field of search-based software security testing.KeywordsSecurity testingSearch-based software security testing (SBSST)SBSEProgram crashDoSXMLISQLIXSS