Timeline for How can security audits be integrated into an agile project?
Current License: CC BY-SA 3.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 7, 2014 at 13:53 | comment | added | MCW | There is truth in what you say, and for a mature security program, I might defer to your advice. But for most of the security programs I have seen, the value in the approach I proposed is that it makes the security analysis explicit. If we fail to incorporate security risk analysis in development, then no amount of tools will prevent the ultimate security failure. If we succeed in defining security "No SQL injection", then we can write a suite of tests that ensure that input is quality checked. | |
| Oct 7, 2014 at 13:45 | comment | added | paj28 | It's easy enough to write a test case for one particular attack. But that only tests that specific attack - it doesn't consider what other attacks a sneaky attacker might try. You mention rigor depending on risk, but it would be incredibly hard to maintain any rigorous test suites, even just for one type of vuln (e.g. SQL injection). I think DAST/SAST tools are a more promising approach, as they automatically apply reasonably rigorous tests. | |
| Oct 7, 2014 at 13:13 | comment | added | MCW | Excellent question. Notionally, same as a use case - write a test case to ensure that whatever implementation strategy I've selected is effective. The rigor of my test cases will be proportional to the risk of the mis-use case. | |
| Oct 6, 2014 at 20:46 | comment | added | paj28 | How would you go about testing for the misuse cases? | |
| Oct 6, 2014 at 17:33 | history | answered | MCW | CC BY-SA 3.0 |