Risk-Based Security Testing in Cloud Computing Environments

Abstract

Assuring the security of a software system in terms of testing nowadays still is a quite tricky task to conduct. Security requirements are taken as a foundation to derive tests to be executed against a system under test. Yet, these positive requirements by far do not cover all the relevant security aspects to be considered. Hence, especially in the event of security testing, negative requirements, derived from risk analysis, are vital to be incorporated. If considering today's emerging trend in the adoption of cloud computing, security testing even has a more important significance. Due to a cloud's openness, in theory there exists an infinite number of tests. Hence, a concise technique to incorporate the results of risk analysis in security testing is inevitable. We therefore propose a new model-driven methodology for the security testing of cloud environments, ingesting misuse cases, defined by negative requirements derived from risk analysis.

A Risk Assessment Framework for Software Testing

“…Each test case is prioritized on the basis of the product of risk exposure value manually determined by domain experts and the correlation between test cases and risks determined by mutation analysis. The effectiveness is shown by comparing the number and severity of faults detected to the approach of Chen et al 09 Zech [24] The approach is model-based and derives a risk model from a system model and a vulnerability knowledge base. On this basis a misuse case model is derived and test code generated from this model is executed.…”

A Survey of Software Testing in the Cloud

“…[29], [30], [35], [36], [37] Migration to Cloud X [38], [39], [40], [41], [6] [6] X [38], [41], [6], [39], [40] [ mobile devices or check the applications' conformance to certain standards [11]. Unit testing activities are another area where on-demand software testing service can be utilized.…”

Classification and Evaluation of Cloud-Based Testing Tools: The Case Study of Web Applications' Security Testing

“…In a cloud computing environment security testing should be applied on three layers: infrastructure, platform, and the service layer. Further, using PaaS or IaaS, the cloud provider itself cannot assure a customer's application security, as application specific code often introduces its own risks (Zech, 2011). This conflict in the security may be solved in the Service Level Agreement (SLA).…”