A look at the MS-SQL worm
Posted Feb 1, 2003 7:40 UTC (Sat) by goonie
In reply to: A look at the MS-SQL worm
Parent article: A look at the MS-SQL worm
The point is that, for security testing, debuggers are no good, as you can only run a debugger with an input that you have thought of. An attacker will construct an input you never thought of to try to break your code.
Two possible approaches:
- get other peoplpe to think up inputs - seperate the programmers and the testers, in other words. This is a very basic software engineering practice.
- Develop systematic methods for generating test cases to break your software (in the specific case of security testing, break into your software). The state of the art in this area is somewhat primitive.
to post comments)