Application security testing in black and white

Computerworld - In today's business environment, companies large and small are looking for ways to secure the applications they create.
Most start by reviewing their internally developed software, but many don't realize that underlying operating systems and other third-party components must also be validated to ensure application security.
This article will discuss two approaches for securing critical software infrastructures -- white-box testing and black-box testing -- and describe the expertise needed and challenges involved with doing each effectively.
White-box testing: Looking under the covers
White-box testing, sometimes called "crystal box" testing, involves looking at a system's code to find bugs. Most organizations use a team that reviews code in internal applications. Sometimes this team falls under the category of quality assurance and isn't necessarily focused exclusively on security. Sometimes the team is in the IT group and is more security-focused. The team is usually composed of highly skilled engineers who review code manually and with automated tools.
Two common issues with white-box testing are the following:

1. Manual reviews: Everyone has days where they are less effective, and manual reviews require the reviewer's skills to be at their peak at all times. When reviewing code all day, it can quickly become tedious, leading to burnout and reduced effectiveness.


2. Source code: Source code generally isn't available for all of the components that make up an enterprise application.

• The ability to integrate code analysis into standard automated build processes and procedures.


• The improved ability to cover all produced code within an organization by reducing the dependency on a scarce human resource -- the security analysis team.


• Increased assurance that the analyzed code is the actual code deployed into production -- eliminating the risk of analyzed source-code modifications (and the potential for introduced security exposures) after the security review is completed.