download issue 27 here - Help Net Security

the liability for their security risk via contract to
the provider. This does not make the security
issues go away, merely transfers the ownership
of the problem.
Although, it is conceivable that the use of the
cloud will take some organizationsʼ security
posture to a higher level than the one they are
currently unable to achieve. Media pressure
will also make consumers demand that security
is addressed when adopting the cloud.
Prospective adopters of cloud services should
also take great care when investigating security
guarantees and claims made by service
providers.
However, even with the emergence of the
cloud, it should be noted that the types of security
threats facing ICT remain similar and
that the control measures needed to address
such threats have not changed significantly. A
common requirement - regardless of the technology
delivery mechanism - is security
testing.
SECURITY TESTING IS A POPULAR,
BUT OFTEN MISUNDERSTOOD CONCEPT
Security testing, trial and error?
Security testing is a popular, but often
misunderstood concept.
At its most basic level, security testing is
aimed at identifying security vulnerabilities and
weaknesses in software and systems, in order
to fix them before they can get exploited. Wellpublicized
examples include SQL injection and
buffer overflow flaws. Itʼs important to recognize
that security vulnerabilities are not necessarily
the product of poorly designed or
coded systems. Many security vulnerabilities
are the result of configuration errors in hardware
and software, caused by human error
during implementation or upgrade.
A good security testing strategy is an essential
element of any security risk management
plan, especially for mitigating minor human
errors that can snowball into serious breaches
if not identified early on. A strategy for testing
and verifying all aspects of hardware and
software integration is a ʻmust haveʼ for any
system implementation or software development
project. It is also essential that such
strategies broadly approach the matter of security,
rather than focusing on specific 'high
risk' areas such as authentication and access
management. This ensures the identification
of unexpected problems, as well as of those
anticipated.
A common, cost efficient approach has been
to develop and implement business systems
first, and then follow up with a short black box
penetration test to see if the system can be
penetrated. However, this leaves systems
wide open to attack because other areas are
neglected.
This problem can be solved by raising awareness
of the fact that there are other security
tests out there, and that a more consolidated,
comprehensive approach to security testing
across all the components of todayʼs business
systems is needed.
It simply makes sense to start testing as early
as possible in order to avoid potentially critical
vulnerabilities sneaking into mission critical
systems. Advances in technology make it so
much easier for security testing to be integrated
alongside traditional testing programs -
automated tools for source code analysis and
simulation of web-based application-level attacks
enable the discovery of security issues
before the production phase. However, automated
tools have their downsides (e.g. false
positives) and should always be complemented
with manual testing.
HPʼs and IBMʼs drive to acquire security testing
technology should be seen as a proof of
the increased importance and awareness of
the need for broader security testing efforts.
www.insecuremag.com 35