Professional Documents
Culture Documents
Software Penetration Testing
Software Penetration Testing
Software Penetration Testing
• Pen-testing can be used effectively. The best approach bases on security findings discovered from the
beginning of the software lifecycle:
- during requirements analysis, architectural risk analysis, and so on.
• Pen-testing is about testing a system in its final production environment.
• So, pen-testing is best suited to probing configuration problems and other environmental factors that deeply
impact software security.
• Driving tests focusing on these factors with some knowledge of risk analysis results is the most effective
approach.
• Make Use of Tools
• Tools (including the static analysis tools) should definitely be used in penetration testing.
• These tools can submit malformed, malicious, and random data to a system's entry points in an attempt to
uncover faults;
• A tool-driven approach can't be used as a replacement for review by a skilled security analyst;
• but a tool-based approach does help reducing the cost.
Tools for Penetration Testing
• Human review is necessary to reveal flaws in the design or more complicated implementation-level
vulnerabilities (of the sort that attackers can and will exploit).
• However, review by an expert is costly, can be ineffective if the "expert" is not. More structured and cost-
effective solutions are needed.
• Penetration testing can benefit greatly from knowledge of the security risks built into a system.
• No design or implementation is perfect, and carrying risk is usually acceptable. Penetration testing can help
finding what this means to your fielded system.
• Penetration testing should focus at the system level and should be directed at properties of the integrated SW
system.
• The most common failure of the SW pen-testing is failure to identify lessons learned and propagate them back
into the organization.
• Iterative pen-tests are coming to reveal fewer and less severe defects in the system.
• Don't forget that the real value of pen-testing comes from its central role in inspecting configuration and other
essential environmental factors.
• Use pen-testing as a "last check" before code goes live instead of as a "first check" of security posture.