Re: Security Test Cases for Testing

[ljknews <ljknews () mac com>]

At 1:11 PM +0530 12/17/03, Giri, Sandeep wrote:
> Hi Group,
>
> To avoid security flaws in various applications, I started teaching people
> about how to write secure code.
> But I soon lost hope when I saw the same flaws again and again during code
> audits.
> So, now with a hope to get some of Security Flaws (like SQL injection,
> buffer overflows and XSS problems etc.) foiled while testing,
> I am planning to write Test Cases for QA team.

In my experience it is best to have the QA team well enough trained that
they can write the test cases.  The QA team should start at the same time
the development team starts.

> Has anyone already written test cases for same?

Well yes, but that is just a passing anecdote.  Tests for your software
must be written with your software in mind, preferably with "white box"
testing where your QA team inspects your source and looks for flaws to
exploit.

Note this means your QA team must be _more_ skilled than your developers.