Definition for Security Assessment Techniques - Revision history

Johanna Curiel at 21:59, 30 July 2016

2016-07-30T21:59:11Z

Cbarlow at 19:06, 9 October 2006

2006-10-09T19:06:45Z

Show changes

Manionc: /* Techniques */

2006-10-05T21:22:47Z

‎Techniques

Manionc at 21:21, 5 October 2006

2006-10-05T21:21:10Z

Manionc: /* Manual Security-Focused Code Review */

2006-10-05T21:20:18Z

‎Manual Security-Focused Code Review

Manionc: /* Application Security Architecture Review */

2006-10-05T21:20:01Z

‎Application Security Architecture Review

Manionc: /* Manual Security-Focused Code Review */

2006-10-05T21:19:36Z

‎Manual Security-Focused Code Review

Manionc at 21:18, 5 October 2006

2006-10-05T21:18:58Z

Manionc: /* Automated Source Code Analysis */

2006-10-05T21:06:02Z

‎Automated Source Code Analysis

Manionc: /* Automated Security Code Scanning */

2006-10-05T20:26:33Z

‎Automated Security Code Scanning

← Older revision		Revision as of 21:59, 30 July 2016
Line 1:		Line 1:
		+	{{taggedDocument
		+	\| type=old
		+	\| lastRevision=2006
		+	\| comment=The page should be updated.
		+	}}
	==Overview==		==Overview==

@@ Line 9: / Line 9: @@
 * Application Security Threat Assessment
 * Application Security Architecture Review
-* Automated Security Code Scanning (Tool Based Static Analysis)
+* Manual Security-Focused Code Review (Software Security Specialist)
 * Automated External Application Scanning (Tool Based)
 * Manual Penetration Testing (Security Test Specialist)
 NOTE: these should probably link to full articles on each subject
 ==Application Security Threat Assessment==

@@ Line 97: / Line 97: @@
 Recommended use:
 * Security-focused code reviews should be conducted as part of the normal SDLC. Reviews may also be needed during or after security testing, prior to implementing system upgrades, prior to making system configuration changes, when new security bulletins are released, or immediately following any reported security incidents.
 ==Automated Source Code Analysis==
@@ Line 117: / Line 119: @@
 Recommended use:
 * Automated source code analysis tools can be used to enhance and improve an organization’s overall efforts to find and eliminate security vulnerabilities within software applications. However, they should not be viewed as a "silver bullet". Manual code reviews must still be conducted to identify false positives and security-related defects that tools can not identify.
 ==Automated External Application Scanning==
@@ Line 146: / Line 150: @@
 If a tool is used, it is important to define the technical limitations of the tool when the findings are presented.  An example of this may involve noting the potential for SQL injection attacks based upon verbose SQL error messages, but also the tool’s inability to produce the correct syntax needed to extract specific information from the vulnerable database.  A failure to convey the differences between automated and expert testing increases the risk that the application assessment results will be interpreted (particularly by management) as being more “secure” than they actually are.

@@ Line 75: / Line 75: @@
 * Best as a precursor to development activities allowing best use of security dollars (i.e.,  incorporate security in beginning begets higher return on investment vs. fixing applications post production).
 * Best utilized to determine the need and extent for further assessment (testing) activities (e.g., automated testing, expert testing, code review, etc.).
 ==Manual Security-Focused Code Review==

@@ Line 55: / Line 55: @@
 * Best as a precursor to development activities allowing best use of security resources (i.e.,  “bake in” security during application development begets higher return on investment vs. “bolting on” application security fixes post production).
 * Best utilized to determine the need and extent for further assessment (testing) activities (e.g., automated testing, expert testing, code review, etc.).
 ==Application Security Architecture Review==
@@ Line 73: / Line 75: @@
 * Best as a precursor to development activities allowing best use of security dollars (i.e.,  incorporate security in beginning begets higher return on investment vs. fixing applications post production).
 * Best utilized to determine the need and extent for further assessment (testing) activities (e.g., automated testing, expert testing, code review, etc.).
 ==Manual Security-Focused Code Review==

@@ Line 73: / Line 73: @@
 * Best as a precursor to development activities allowing best use of security dollars (i.e.,  incorporate security in beginning begets higher return on investment vs. fixing applications post production).
 * Best utilized to determine the need and extent for further assessment (testing) activities (e.g., automated testing, expert testing, code review, etc.).
@@ Line 124: / Line 144: @@
 If a tool is used, it is important to define the technical limitations of the tool when the findings are presented.  An example of this may involve noting the potential for SQL injection attacks based upon verbose SQL error messages, but also the tool’s inability to produce the correct syntax needed to extract specific information from the vulnerable database.  A failure to convey the differences between automated and expert testing increases the risk that the application assessment results will be interpreted (particularly by management) as being more “secure” than they actually are.
@@ Line 149: / Line 167: @@
 * Testing critical applications (i.e., applications that do contain/handle business sensitive data and/or are critical to business operation) where the perceived higher risk does not warrant performing automated testing.
 * Best suited for B2B, B2C and/or any transactional based and/or multi-level access application.

@@ Line 76: / Line 76: @@
-==Automated Security Code Scanning==
+==Automated Source Code Analysis==
-Involves the use of one or more software tools to conduct automated [Static_code_analysis]
+Automated source code analysis involves the use of special software "tools" to conduct [http://en.wikipedia.org/wiki/Static_code_analysis Static Code Analysis] on software source code to identify potential vulnerabilities within the code.
 ''Advantages:''
+* can be very effective method for identifying defects in code functionality and syntax errors
 ''Disadvantages:''
+* most automated source code analysis tools generate false positives
 Recommended use:
+* Automated source code analysis tools can be used to enhance and improve an organization’s overall efforts to find and eliminate security vulnerabilities within software applications. However, they should not be viewed as a "silver bullet". Manual code reviews must still be conducted to identify false positives and security-related defects that tools can not identify.
 ==Automated External Application Scanning==