Using Data Integration for Security Testing

Abstract

Part 3: Safety and Security TestingInternational audienceThe explosion of digitisation makes a plethora of security data publicly available for developers. These numerous (often complex) documents expose them to the difficulty of choosing the most appropriate solution for securing their applications. We propose in this paper a method based upon data acquisition and integration, which assists developers in the Threat modelling stage and in the security test case execution. The method firstly helps devise Attack Defense Trees by means of a data-store. These trees show attacks, steps and defenses given under the form of security patterns, which are re-usable solutions to design more secure applications. These trees are then used for the test case generation. The data-store integrates test case stubs, which make this generation easier and developers more efficient. We evaluate our approach on 24 participants and show encouraging results on the use of data integration in software engineering

An approach for guiding developers in the choice of security solutions and in the generation of concrete test cases

“…For this paper, we extend the data-store meta-model to support the generation of concrete security test cases. We proposed a preliminary version of this work in (Salva and Regainia, 2017a). The present paper is an extended version, which provides an overview of the approach from the developer's viewpoint, details the ADTree generation, adds the inconclusive test verdict , and includes additional evaluation results and examples.…”