Review chapter 10 in the course text.
In your own words, Discuss at least one of the ways to test a threat mitigation.
Testing Threat Mitigations
You’ll need both process and skills to check the mitigations you’re developing. This part explains both, and additionally discusses penetration testing, which is often incorrect for a entire strategy to checking out security.
Test Process Integration
Anything you do to tackle a hazard is challenge to being tested. However you manipulate test cases, you encompass checking out the threats you’ve determined and chosen to address. If you’re an agile crew that makes use of test-driven development, boost at least two tests per threat: one that exploits the convenient (no mitigation) case, and at least one that tries to pass by the mitigation. It can be easy, fun, and even useful for your testers to go nuts with this. It might also be well worth the effort to ensure they start with the highest-risk threats, or the ones that developers don’t prefer to fi x. If you use bugs to tune check development, you would possibly want to file two test-creation bugs per threat. One will music the threat, and the different the test code for the threat. Then again, you would possibly locate this overkill. Giving hazard model bugs special tags can assist you when you search for threat model take a look at bugs. If you have some form of check planning, then you have to make sure that the listing of threats feeds into the test planning. A right list of threats delivered to a tester can produce an avalanche of new tests (Shostack, 2014).
Some companies pick out to use penetration testing to validate their danger models and/or add a level of self-assurance in their software. Penetration checking out can complement hazard modeling. But there’s a pronouncing that “you can’t take a look at first-rate in.” That capability all the trying out you might perhaps do will never make a product great. It will simply assist you fi x the defects you occur to find. To make a great product, you need to begin with top design, desirable uncooked substances and properly production processes, and then check that your output suits your expectation. In the same way, you can’t take a look at your product to secure. So, pen testing can’t exchange risk modeling.
Pen checking out can be either black box or glass box. Black box pen trying out provides solely the software to the testers, who will then explicitly check assumptions you have about how lots effort it takes to obtain an grasp of the software. This is an high priced undertaking, particularly in contrast to glass container pen testing, whereby testers are given get entry to to code, designs, and chance models, and they are capable to use those to higher recognize the desires of the software program and the intentions of the developers. If you select to use pen testing as an adjunct to danger modeling, the most important element is to make sure that you’re aligned with the penetration testers involving what’s in scope (Ucedavélez Tony, 2015).