Assuring Software Security Through Testing

(ISC)2®’s whitepaper, Code (In)Security, highlights various considerations that need to be taken into account to develop code that is secure. But merely developing secure code without attesting to its assurance capabilities is akin to operating an automobile without checking to ensure that the brakes work as expected. With such an outlook, a crash becomes not just possible but inevitable. This paper will discuss the need for attesting software assurance, the different types of testing as it pertains to functionality and assurance, a security tester’s profile, and some proven strategies to incorporate security testing into the software development lifecycle (SDLC).