Search

The number of potential vulnerabilities and threats are increasing for software. Security testing is an essential process to confirm software security requirements and to identify security related vulnerabilities. In this paper we use analytical hierarchy process (AHP) to analyze and compare different available security testing techniques based on a pre defined criteria. Five testing techniques were selected which includes Source code analysis, Fault code injection, Robustness, Stress and Penetration testing techniques. They have been evaluated against five criteria which include cost, thoroughness, ease of use, effectiveness and efficiency. The outcome of the study is helpful for researchers, testers and developers to understand effectiveness of each technique in its respective domain. Also the study helps to compare the inner working of testing techniques against a selected criterion to achieve optimum testing results.

Command control, communication, computer and intelligence (C4I) systems are the back bone complex information and communication systems for modern information warfare (IW). Managing security in C4I systems is a challenge due to complexity and criticality of these systems. This paper elaborates design methodology to incorporate security in the C4I systems in systematic and consistent way instead of patching and random approach. The approach in this work exploits the opportunity provided by architecture frameworks (AF) to capture threats and devise security measures. Assurance cases have been used to model security of the C4I system in order to enhance the process of security design and overcome challenges. Key words: C4I systems, information security, Department of Defense Architecture Framework, assurance cases, interoperability.

C4I (command, control, communications, computer and intelligence) system is a complex system of systems that enables the military commander to achieve decision superiority by affecting adversary’s information and information based processes while protecting one‘s own information systems. Owing to the sensitivity of military information the security threats to C4I systems are real and growing therefore security is a major challenge in order to maintain integrity, confidentiality, availability and accountability. Different Models and architectures frameworks e.g. DODAF, CDSA have been proposed which decompose the detail structure of C4I systems however these models and frameworks do not provide mechanism to capture associated security risks and issues. Threat modeling is the process to understand different ways system can be attacked which helps towards secure system design and implement countermeasures. This paper suggests that using threat modeling could help to eradicate or reduce the effect of advancing threats to C4I systems. In this paper we also identify how security can be modeled in top down manner e.g. from architecture level to lower level of modeling so that countermeasures can be incorporated on system level rather than on bit by bit basis.