[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [WEB SECURITY] FW: What's the Difference; PEN Testing and Black Box Testing?

<HTML>
<HEAD>
<META content="text/html; charset=utf-8" http-equiv=Content-Type>
<META content="OPENWEBMAIL" name=GENERATOR>
</HEAD>
<BODY bgColor=#ffffff>

<font size="2">Black box - used to be aka zero-knowledge, more like just runtime testing these days. Testing is the key word. Ala fuzzing, brute force, hacking, smashing, etc. True this can be used to validated false positives from white box like you mention.
<br />White box - code access, code review manual or automated.
<br />Gray box - A balanced combination of the above.
<br />Pen test - depending on the circumstance/agreement, use any of the above to find the big flaws - focused security testing. Sometimes this seems like a dated term.
<br />
<br />As far as providing feedback to developers that should be a normal part of any of the above. But there's no RFC standard here, you kind of have the freedom to define the details of these terms as best fit in your org. 
<br />
<br />/Chris
<br />
<br />
<br /><b>---------- Original Message 
-----------</b>
<br />
From: &quot;Susan Smoter&quot; &lt;spire20707@xxxxxxxxxxx&gt; 

<br />
To: &lt;websecurity@xxxxxxxxxxxxx&gt; 

<br />
Cc: &lt;spire@xxxxxxx&gt; 

<br />
Sent: Fri, 09 May 2008 20:13:07 -0400 

<br />
Subject: [WEB SECURITY] FW: What's the Difference; PEN Testing and Black Box 
Testing? 

<br />

<br />&gt; <font size="2" face="Arial" color="blue"><span style="font-size: 10pt; font-family: Arial; color: blue;">Iâve been on this list for some 
time
and I find it very helpful. Now Iâd like some help. I 
have
seen the terms PEN Testing and Black Box Testing used interchangably, but I 
think
they are or can be different types of tests. Seems that black box 
tools
be used by developers to eliminate coding issues and to validate 
false
positives from white box/static testing, while PEN testing would only 
attempt
to &quot;break and enter&quot; without necessiary providing coders with 
info
about fixing the identified vulnerabilities. If I've got this 
correct,
then I'd like to find a better set of terminologies to use to 
differentiate
between security testing while in the SDLC phases and those done in 
preparation
for application 
deployment.<o:p /></span></font>

<br />&gt; <font size="2" face="Arial" color="blue"><span style="font-size: 10pt; font-family: Arial; color: blue;"><o:p>Â
</o:p></span></font>

<br />&gt; <font size="2" face="Arial" color="blue"><span style="font-size: 10pt; font-family: Arial; color: blue;">Thanks for some clarification â 
Iâm
working on establishing Application Vulnerability Management and am 
having
difficulty getting everyone on the same page due to overlapping 
semantics.<o:p /></span></font>

<br />&gt; <font size="2" face="Arial" color="blue"><span style="font-size: 10pt; font-family: Arial; color: blue;"><o:p>Â
</o:p></span></font>

<br />&gt; <font size="2" face="Arial" color="blue"><span style="font-size: 10pt; font-family: Arial; color: blue;">Susan<o:p /></span></font>

<br /><b>------- End of Original Message 
-------</b>
<br />

</font>
</BODY>
</HTML>



----------------------------------------------------------------------------
Join us on IRC: irc.freenode.net #webappsec

Have a question? Search The Web Security Mailing List Archives:
http://www.webappsec.org/lists/websecurity/

Subscribe via RSS:
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]

Join WASC on LinkedIn
http://www.linkedin.com/e/gis/83336/4B20E4374DBA
Brought to you by http://www.webappsec.org
Search this site