Security Testing as a Service: Industrialisierte Security Services für die direkte Nutzung!

Transcription

1 Security ing as a Service: Industrialisierte Security Services für die direkte Nutzung! Dr. Frank Simon Head of SQS Research v1.0 SQS Software Quality Systems AG Agenda SQS Quality ing Security.who we are.what we can.how it can be assured.what it is As a service.how business will evolve Fuzzing.what will become more important Preconditions.without everything is risky Summary..what s the lessons learned SQS Software Quality Systems Security ing as a Service 2 1

2 SQS: Who we are At a glance: SQS is the world s leading specialist for software quality.» The global leader in independent software testing and quality management services majority of its business in Europe Financial Times, 21 August 2007 «Almost 30 years of prosperous operations Over 5,000 completed projects The customer base includes 36 FTSE-100 companies, half of the DAX 30 companies and nearly a third of the STOXX-50 companies The SQS philosophy is to help our customers improve the quality of their business solutions. SQS is listed on the AIM London SQS Software Quality Systems Security ing as a Service 3 SQS: Who we are Figures tell their own tale: SQS is on a solid growth track. Revenues in m ) Employees ) According to analyst estimations 2) October 2011, ca. 600 of them offshore SQS Software Quality Systems Security ing as a Service 4 2

3 SQS: Who we are Wherever our clients are located. Follow the customers is our motto for Offshore we are working on Multilanguage Customer-related Sourcing (MLCS) strategy USA Locations Austria Germany Egypt Finland France India Ireland Netherlands Norway Portugal South Africa Sweden Switzerland United Kingdom USA Partnership Spain Egypt India South Africa SQS Software Quality Systems Security ing as a Service 5 Quality: What we can Sometimes, quality is considered as collateral SQS Software Quality Systems Security ing as a Service 6 3

4 Quality: What we can Main Challenges of an IT-project today: Holistic Requirements, products and their controlling American Society for Quality: Quality: the characteristics of a product or service that bear on its ability to satisfy stated or implied needs Product/Service... Ch 5 Ch 4 Ch 3 Ch 2 Ch 1 Challenge 2: Consider all products/services you create in a successful project Quality ing in ISTQB focus on this understanding of quality: [ ] of software products and related work products[ ] [ ] that they satisfy specified requirements [ ] Needs need 1 need 2... need n Challenge 1: Consider ALL aspects of a successful project SQS Software Quality Systems Security ing as a Service 7 ing: How it can be assured Myth: ing is done at the end of a project ing is last activitity before installation Usually shifting release date not possible the devil takes the hindmost Solution Reality Quality Plan Analyse Design Implement Time to market SQS Software Quality Systems Security ing as a Service 8 4

5 ing: How it can be assured The typical tester image improved by standards like ISTQB er: A skilled professional who is involved in the testing of a component or system. (ISTQB-Glossary) ing: The process consisting of all life cycle activities, both static and dynamic, concerned with planning, preparation and evaluation of software products and related work products to determine that they satisfy specified requirements, to demonstrate that they are fit for purpose and to detect defects. Only an old-fashioned tester ( gate before roll-out. ) believes that testing is only the last quality Business Demand Acceptance&Roll-out ing Coding Design Specification Requirements What can be tested? SQS Software Quality Systems Security ing as a Service 9 Security: What it is? Quality is a multi-dimensional concept! Security is part of it! SQS Software Quality Systems Security ing as a Service 10 5

6 Security: What it is? ISO suggests a broader concept of quality: Quality in use! SQS Software Quality Systems Security ing as a Service 12 Security: What it is? Product Quality vs. Quality in use Many Security aspects are related to Product Quality Requirements Develop testware Develop system system Quality in use Roll-Out into a specific context Product Quality SQS Software Quality Systems Security ing as a Service 13 6

7 As a service: How business will evolve X as a service means completing industrialisation Product quality services: good industrialisation candidates Engagement Style Compensation model Geographical location SQS Software Quality Systems Security ing as a Service 14 As a service: How business will evolve Security ing as a Service Parameters for as a service Geographical Location: Don t care, probably offshore Engagement Style: Infrastructure outsourcing Compensation Model: Fixed price, transaction price Security as a service Is a managed service for security testing related tasks across one or more projects delivering one or more applications and systems, spanning the lifecycle of software and system development and system operation. The resources for security testing (staff, testing infrastructure, system under test) are managed by and in the responsibility of the service provider to support the customer s business processes. Based on transaction or business value based prices the service provider ensures scalability of the security-services and takes care of the resource management according the utilisation scheme required to support the tasks. An example. SQS Software Quality Systems Security ing as a Service 15 7

8 As a service: How business will evolve Security Touchpoints will be more and more important for interfaces! Company B F A E C F D I H Industrialisation Requirements System Specification System Design Acceptance System Integration Maintenance Company B F A C D H F Supplier A E Supplier B I Unit Design Implementation Unit Unit and Integration are good candidates for utilising ing as a service because context plays a minor role there! SQS Software Quality Systems Security ing as a Service 16 Fuzzing: What will become more important Negative s by Fuzzing for Unit s and Integration s Negative tests: s aimed at showing that a component or system does not work. (ISTQB) Fuzzing: A highly automated testing technique that covers numerous boundary cases using invalid data [ ] as application input to better ensure the absence of exploitable vulnerabilities. Peter Oehlert, Violating Assumptions with Fuzzing, IEEE Security & Privacy, March/April 2005 Company A Supplier A E B F H C D F Supplier B I SQS Software Quality Systems Security ing as a Service 17 8

9 Fuzzing: What will become more important Commercial tools available for standard protocols and formats used by hackers SQS Software Quality Systems Security ing as a Service 18 Fuzzing: What will become more important Securi-Fit: Security by Fuzzing Integration into the test process Motivation: Both, test processes and fuzzing are well-known concepts but they are isolated and not yet combined as one SW Engineering Best Practice! Research: Securi-FIT Sponsor: Participants: Leading testing company Leading fuzzing company Deliverables Step 1: Generic test process with fuzzing integration points Step 2: Process for risk based process instantiation to assure security Step 3: Pilot SQS Software Quality Systems Security ing as a Service 19 9

10 Fuzzing: What will become more important Fuzzing is a low-hanging fruit if carefully integrated into the overall test process Fuzzing must be carefully integrated to engineering and test processes Fundamental test process (ISTQB) TMAP Many specific test processes need a meta process for a broad acceptance in industry SQS Software Quality Systems Security ing as a Service 20 Fuzzing: What will become more important Meta- process with Fuzzing Integration Points enables systematic security testing Plan Updates Completion Report Management Planning Monitoring &Control Completion Plan Plan Control Directives Measures Project Processes Dynamic ing Design & Implementation Execution Incident Reporting Specification Results Incident Report Environment Management Environment Requirements Environment Set Up SQS Software Quality Systems Security ing as a Service 21 10

11 Fuzzing: What will become more important Security ing as a service covers 3/7 test stages Security testing as a service can be offered for some typical techniques Code-Vulnerability Checks Interface/File Fuzzing Security Verification/Compliance Sec. Requirement Analysis Requirements System Specification Acceptance System Maintenance Penetration Sec. Verification / Compliance Security Design Analysis System Design Unit Design Integration Unit Interface/File Fuzzing Security Design Analysis Implementation Code-Vulnerability check Security Process Engineering SQS Software Quality Systems Security ing as a Service 22 Preconditions.without everything is risky ing as a service.is that the silver bullet? Maturity is not only important on provider side! Even on customer side some preconditions need to be fulfilled that correspond to specific industrialisation steps SQS Software Quality Systems Security ing as a Service 23 11

12 Summary Security ing as a service gets more important, but needs pre-requisites on both sides: Provider and Customer Quality is a holistic, multi-dimensional concept Security is a sub quality attribute Many security activities can be done without knowing specific context of use Security ing as a service covers well-known services that can be delivered out-of-the-box on a fix-price model Fuzzing ing is a specific example for a Security-ing as a service Utilising security testing providers need some pre-requisites on customer side as well SQS Software Quality Systems Security ing as a Service 24 SQS Software Quality Systems AG Stollwerckstraße Köln, Deutschland Tel.: Fax: frank.simon@sqs.de Internet: Internet: Thank you for your attention! 12