Evaluating the Effectiveness of Security Testing Tools in Automated Testing
Nandi, Sangeeta (2024)
2024
Master's Programme in Computing Sciences and Electrical Engineering
Informaatioteknologian ja viestinnän tiedekunta - Faculty of Information Technology and Communication Sciences
This publication is copyrighted. You may download, display and print it for Your own personal use. Commercial use is prohibited.
Hyväksymispäivämäärä
2024-12-17
Julkaisun pysyvä osoite on
https://urn.fi/URN:NBN:fi:tuni-2024120910890
https://urn.fi/URN:NBN:fi:tuni-2024120910890
Tiivistelmä
Cybersecurity has become one of the prominent issues in modern software engineering paradigm and automation software testing tool play a vital role in identifying and vindicating various software vulnerabilities. This study is a Systematic Literature Review (SLR) that focuses on 34 studies to search for the types of security testing tools that have been used, kind of scenarios that have been previously worked on and what kind of vulnerabilities have been identified over the years.
This SLR highlights on commonly used tools like OWASP ZAP, Nessus, Burp Suite etc. to find out in which scenarios these tools have been implemented the most. Common vulnerabilities that have been found here were SQL, XSS and buffer over-flow, along with so many options. This study also identifies DAST as a common trend in the recent research because DAST allows more real-time vulnerability detection option. DAST allows to detect vulnerabilities in various scenarios, like CI/CD pipelines, searching in the container-based options like Kubernetes and even in some machine learning approaches for finding vulnerabilities. Other notable mentions were Fuzz testing scenarios and tools, SCA tools for third party assessments and Web Application security vulnerabilities and tools.
Another important aspect that has been found is that the commercial tools although boasts bigger number of features, open-source tools are popularly used in most cases. The main challenge that can be found from the study is that continuous evolving and newer characteristics of various vulnerabilities. This study recommends the continuous evolution of the tools over the time and find out the natures of vulnerabilities to create secure software for both users and developers.
This SLR highlights on commonly used tools like OWASP ZAP, Nessus, Burp Suite etc. to find out in which scenarios these tools have been implemented the most. Common vulnerabilities that have been found here were SQL, XSS and buffer over-flow, along with so many options. This study also identifies DAST as a common trend in the recent research because DAST allows more real-time vulnerability detection option. DAST allows to detect vulnerabilities in various scenarios, like CI/CD pipelines, searching in the container-based options like Kubernetes and even in some machine learning approaches for finding vulnerabilities. Other notable mentions were Fuzz testing scenarios and tools, SCA tools for third party assessments and Web Application security vulnerabilities and tools.
Another important aspect that has been found is that the commercial tools although boasts bigger number of features, open-source tools are popularly used in most cases. The main challenge that can be found from the study is that continuous evolving and newer characteristics of various vulnerabilities. This study recommends the continuous evolution of the tools over the time and find out the natures of vulnerabilities to create secure software for both users and developers.