Testing for security during development: why we should scrap penetrate-and-patch

Abstract

In the commercial sector, security analysis has tradi- tionally been applied at the network system level, after release, using tiger team approaches. After a successful tiger team penetration, specific system vulnerabilities are patched. I make a case for applying software engineering analysis techniques that have proven successful in the soft- ware safety arena to security-critical software code. This work is based on the generally held belief that a large pro- portion of security violations result from errors introduced during software development.