• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.22 no.5
• /
• pp.1191-1204
• /
• 2012

As attackers try to paralyze information security systems, many researchers have investigated security testing to analyze vulnerabilities of information security products. Penetration testing, a critical step in the development of any secure product, is the practice of testing a computer systems to find vulnerabilities that an attacker could exploit. Security testing like penetration testing includes gathering information about the target before the test, identifying possible entry points, attempting to break in and reporting back the findings. Therefore, to obtain maximum generality, re-usability and efficiency is very useful for efficient security testing and vulnerability hunting activities. In this paper, we propose a threat analysis based software security testing technique for evaluating that the security functionality of target products provides the properties of self-protection and non-bypassability in order to respond to attacks to incapacitate or bypass the security features of the target products. We conduct a security threat analysis to identify vulnerabilities and establish a testing strategy according to software modules and security features/functions of the target products after threat analysis to improve re-usability and efficiency of software security testing. The proposed technique consists of threat analysis and classification, selection of right strategy for security testing, and security testing. We demonstrate our technique can systematically evaluate the strength of security systems by analyzing case studies and performing security tests.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.19 no.2
• /
• pp.75-82
• /
• 2009

In this paper, we test for security targeting on APIs of Windows as that is used by many people worldwide. In order to test APIs in DLL fils of Windows OS, we propose Automated Windows API Fuzz Testing(AWAFT) that can execute fuzz testing automatically and implemented the practical tool for AWAFT. AWAFT focuses on buffer overflows and parsing errors of function parameters. Using the tool, we found 177 errors in the system folder of Windows XP SP2. Therefore, AWAFT is useful for security testing of Windows APIs. AWAFT can be applied to libraries of third party software in Windows OS for the security.

• International Journal of Computer Science & Network Security
• /
• v.21 no.5
• /
• pp.217-221
• /
• 2021

Recent studies have indicated that mobile markets harbor applications (apps) that are either malicious or vulnerable, compromising millions of devices. Some studies indicate that 96% of companies' employees have used at least one malicious app. Some app stores do not employ security quality attributes regarding authorization, which is the function of specifying access rights to access control resources. However, well-defined access control policies can prevent mobile apps from being malicious. The problem is that those who oversee app market sites lack the mechanisms necessary to assess mobile app security. Because thousands of apps are constantly being added to or updated on mobile app market sites, these security testing mechanisms must be automated. This paper, therefore, introduces a new mechanism for testing mobile app security, using white-box testing in a way that is compatible with Bring Your Own Device (BYOD) working environments. This framework will benefit end-users, organizations that oversee app markets, and employers who implement the BYOD trend.

• Journal of Korean Society for Quality Management
• /
• v.49 no.2
• /
• pp.113-125
• /
• 2021

Purpose: This study focused on reality and quality improvement of aviation security equipment performance certification system. Methods: For this propose, we analyzed aviation security equipment performance certification system related legislations. Using analyzed data, we suggested advancement plan of aviation security equipment performance certification system. Results: In results, South Korea has been implementing aviation security performance certification system since October 2018. Parts for improvement of system are mutual certification with major countries that operate aviation security equipment performance certification systems, the spread of the defense industry's system, development of similar substances for handling explosives, and introduction of preliminary inspections. Conclusion: The research result could be used as a basic data for upgrading Korea's aviation security performance certification system.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.17 no.2
• /
• pp.51-59
• /
• 2007

Software testing is the process of analyzing a software item to detect the differences between existing and required conditions and to evaluate the features of the software item. A traditional testing focuses on proper functionality, not security testing. Fuzzing is a one of many software testing techniques and security testing. Fuzzing methodology has advantage that low-cost, efficiency and so on. But fuzzing has defects such as intervening experts. Also, if there is no specification, fuzzing is impossible. ROAD Tool is automated testing tool for RPC(Remote Procedure Call) based protocol and software without specification. Existing tools are semi-automated. Therefore we must modify these tools. In this paper, we design and implement ROAD tool. Also we verify utility in testing results.

• Journal of Korean Society for Quality Management
• /
• v.48 no.3
• /
• pp.395-408
• /
• 2020

Purpose: This study was performed for advancement of aviation security equipments certification system. Methods: We investigated aviation security equipments certification-related registrations and the latest research trends of explosive detection technologies. Based on the literature studies, we draw the critical issues of the aviation security equipment certification system and suggested improvement direction. Results: We found some inaccuracies of the definition of explosive trace detection equipments, accreditation review committee, and performance evaluation test method. These problems should be modified to suit being practical. Conclusion: The present results would be useful for basic data for modifying aviation security equipments certification systems.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.17 no.4
• /
• pp.3-10
• /
• 2007

In this paper, we proposed the methodology for security testing using block-based file fault injection. When fault is inserted into software, we consider the format of file in order to efficiently reduce the error that is caused by mismatch of format of file. The Vulnerability the methodology focuses on is related to memory processing, such as buffer overflow, null pointer reference and so on. We implemented the automatic tool to apply the methodology to image file format and named the tool ImageDigger. We executed fault-injection focused on WMF and EMF file format using ImageDigger, and found 10 DOS(Denial of Service) in Windows Platform. This methodology can apply to block-based file format such as MS Office file.

• Convergence Security Journal
• /
• v.15 no.4
• /
• pp.3-9
• /
• 2015

A web application that allows a web service created by a internal developer who has security awareness show certain level of security. However, in the case of development by outsourcing, it is inevitable to implement the development centered on requested function rather than the issue of security. Thus in this paper, we improve the software testing process focusing on security for exclusion the leakage of important information and using an unauthorized service that results from the use of the vulnerable web application. The proposed model is able to consider security in the initial stage of development even when outsourced web application, especially, It can prevent the development schedule delay caused by the occurrence of modification for program created by programer who has low security awareness. This result shows that this model can be applied to the national defense area for increasing demand web application centered resource management system to be able to prevent service of web application with security vulnerability based on high test.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.11 no.6
• /
• pp.67-76
• /
• 2001

In this paper, we investigate criteria for evaluating cryptographic strength based on randomness testing of the advanced encryption standard candidates, which have conducted by NIST(National Institute of Standards & Technology). It is difficult to prove that a given cryptographic algorithm meets sufficient conditions or requirements for provable security. The statistical testing of random number generators is one of methods to evaluate cryptographic strength and is based on statistical properties of random number generators. We apply randomness testing on several cryptographic algorithms that have not been tested by NIST and find criteria for evaluating cryptographic strength from the results of randomness testing. We investigate two criteria, one is the number of rejected samples and the other is the p-value from p-values of the samples.

• Journal of Korean Society for Quality Management
• /
• v.48 no.1
• /
• pp.187-199
• /
• 2020

Purpose: This study suggests how to upgrade performance certification technology. Current performance certification of aviation security equipment and the requirements thereof were analyzed. Methods: The performance certification of aviation security equipment worldwide and identified issues with the domestic certification system were compared. The government must upgrade certification in terms of technical standards, the assessment methodology used, and the operating system. Results: Three principal conclusions were drawn. First, certification requirements must be based on a review of the technical literature and real-world experience. Second, development priorities must be set by reference to assessment techniques. Third, both research on the certification system and improvements thereof are essential. Conclusion: Certification of aviation security equipment performance requires gradual upgrading.