LOGIN | REGISTER NOW | SUBSCRIBE
 
print Printable version 
Most Read Latest News Blog Resources
Three non-programming books for your booklist
Aside from programming skills, developers should know how management works and how to oper...
Microsoft pushes Windows Phone 7 development tools
Ahead of the smartphone's release, Microsoft is letting developers download its tools in a...
Windows & .NET Watch: LightSwitch turns up
Microsoft's newest development environment will need to go a long way to fulfill its poten...
JavaOne returns with an Oracle twist
Oracle OpenWorld will be bigger than ever this year as the event adds JavaOne to the sched...
Digg!  Digg
Reddit  Reddit
Slashdot  Slashdot
Share on facebook  Facebook
Share on Twitter  Twitter


            iphoneapp GET THE APP!

Think like a hacker


By Jeff Feinman
February 15, 2009 —  (Page 1 of 6)
In the eyes of Mike Weider, the correct way of doing software security testing requires getting into the mind of the hacker.

The director of security products for IBM Rational said it takes a special breed of software professional to step into the driver’s seat of a hacker’s mentality and take the wheel. While quality assurance professionals can do security testing and smoke out some vulnerabilities, they usually have the customers’ thoughts in mind rather than those of the hacker.

“There is a need for this specialized security testing professional to anticipate how hackers think and use this slightly different way to test applications,” Weider said.

From a technology standpoint, there are two main approaches for testing software for security, and they are well known to developers and testers. One is exercising the software from what many call the outside-in approach: testing to see how the application responds to a simulated attack. The second is more of an inside-out approach, which looks for coding patterns that would highlight vulnerabilities in the code.

But security testing can be fundamentally a different ballgame than traditional testing because the emphasis is put on what an application should not do rather than what it should do. First, users don’t usually try to search out software bugs, while malicious attackers intentionally seek out vulnerabilities. When vulnerabilities are found by hackers, problems arise for other users instead of just a developer or group of developers.

Additionally, developers usually learn to avoid poor programming practices for their own projects, but it is difficult for security testers to keep up with the latest exploits because they grow every year. This makes it more difficult to ensure that secure programming practices are followed.

So what is the best way to carry out proper security testing? Vic DeMarines, vice president of products at security tool maker Vi Labs, shared Weider’s notion that testers need to think like the attackers themselves and to look for the easiest way to initiate a threat. Applications will have different levels of threats, depending on the nature of the application.

Related Search Term(s): professional development, security, testing, IBM, Fortify, Klocwork, Vi Labs

Pages 1 2 3 4 5 6 


Share this link: http://www.sdtimes.com/link/33274
 

Comments

06/23/2009 10:30:01 AM EST

On a related note and for similar content, see our book "The Art of Software Security Testing" published in 2006 http://www.amazon.com/Art-Software-Security-Testing-Identifying/dp/0321304861/ref=ntt_at_ep_dpt_2, for example chapters 1, pg 11 "Think like an Attacker" and chapter 3 "The Secure Software Development Lifecycle"

United StatesElfriede Dustin


Add comment


Name*
Email*  
Country     


  • Comment
  • Preview
Loading



 
 
 
 
News on Monday
more>>
SharePoint Tech Report
more>>


   

 
 
Download Current Issue
ISSUE 9/1/2010 PDF

Need Back Issues?
DOWNLOAD HERE

Receive the print Edition?


 
blogs tab
VMworld hops to it
Data center operating systems play a big part at VMworld, but it's still too soon.
09/02/2010 01:42 PM EST

Certificate program for secure cloud computing
The Cloud Security Alliance introduces user certification.
09/01/2010 04:20 PM EST

What does the Army's Crusher tank and RIM's tablet computer have in common?
RIM plans to use Crusher tank technology on its yet-to-be-announced tablet.
08/25/2010 04:16 PM EST

 

Events calendar tab
Intel Developer Forum
9/13/2010 to 9/15/2010
San Francisco
Intel

JavaOne & Oracle Develop
9/19/2010 to 9/23/2010
San Francisco
Oracle

Oracle OpenWorld
9/19/2010 to 9/23/2010
San Francisco
Oracle

ESC Boston
9/20/2010 to 9/23/2010
Boston
TechInsights

High Performance Computing Financial Markets
9/20/2010
New York City
Flagg Management