Testing for security during development: Why we should scrap penetrate-and-patch

doi:10.1109/62.666831

Testing for security during development: Why we should scrap penetrate-and-patch

1998-04-01

16

PRE

AI

G

Gary McGraw *

DOI：10.1109/62.666831

原文链接

原文求助

摘要

En 中文

In the commercial sector, security analysis has traditionally been applied at the network system level, after release, using tiger team approaches. After a successful tiger team penetration, specific system vulnerabilities are patched. I make a case for applying software engineering analysis techniques that have proven successful in the software safety arena to security-critical software code. This work is based on the generally held belief that a large proportion of security violations result from errors introduced during software development.

Testing for security during development: Why we should scrap penetrate-and-patch

摘要

AI总结

期刊

机构

引用论文