IT Security Evaluation Improvement by Application of Testing

Abstract

In recent years there has been increasing demand for security evaluation of information technology (IT) products and systems. In contrast to conformance testing, however, where testing can take place against a formal specification, security evaluation is still in a very subjective stage. As much objectivity as possible though remains a primary goal of security evaluation. As well, a security evaluation of an IT product or system considers both security correctness and effectiveness aspects, a distinction conformance testing does not recognize. So security evaluation and conformance testing approaches differ substantially.