Inroads in Testing Access Control

Abstract

In the last few years, a plethora of research has addressed security testing issues. Several commercial tools have emerged to provide security testing services. Software security testing goes beyond functional testing to reveal flaws and vulnerabilities in software design and behavior. Access control is a major pillar in computer security. This chapter pursues the goal of describing the landscape in the research area of access control testing. We provide an outline of the different existing research over the literature according to the taxonomy reflecting the different phases of common software testing processes (generation, selection, prioritization, quality assessment, regression). We also provide an outline of some existing initiatives that support usage control besides access control by testing obligation policies. Finally, we point out future research directions that emerge from the current research study. Through this work, we aim at providing useful guidelines for software testers to improve the current trends in access control testing.

Introduction

Software security is one major concern that is required to build trustworthy software systems. In the last decades, we have witnessed an increasing interest in the security testing research area. Several researchers have explored this topic by providing new solutions in terms of security modeling, security features development, and the specification and implementation of the security mechanisms that have to be embedded in software systems. In parallel to the emergence of security concerns, security testing has also gained a considerable interest as it has to be developed conjointly to software security hardening. As a matter of fact, it is crucial to guarantee that the security mechanisms that are in place are correctly implemented. Testing these security mechanisms is very important in order to avoid ending up with security flaws inside the system or the application.

Access control is one of the major and the most critical security mechanisms. It ensures that only eligible users are able to access protected resources in a given system. This book chapter explores the landscape of access control testing and shows advances in access control testing approaches.

We start by providing recent advances in access control testing by surveying recent contributions in this research domain. We present the research contributions according to how they fit in a given research process. In a nutshell, the process of testing access control implemented in a given system or application follows the different steps highlighted in Fig. 1. The first and the most important step aims at generating a set of test cases that have to be exercised on the system under test.

Based on real-world applications, a large number of test cases are generated. Due to budget, time, and resources constraints, testers have to choose the tests that have to be run among all the generated tests. The subset of test cases to be run is defined based on business-related criteria according to available budget, computing resources, and the time allocated to testing. Commonly, there are two options, either selecting a fixed number of tests or ordering (prioritizing) tests. When prioritizing tests, the tests that have highest priority are executed first until the resources that are available for testing such as time or budget are consumed. Finally, once tests are executed and their verdict is checked, we need to assess the quality of these tests to provide guarantee that the test suite is of high quality. Tests assessment enables also to evaluate the fault-detection capability of tests cases. This book chapter goes first through the overall testing process by providing a detailed description of existing research contributions that aim at generating, selecting, prioritizing, and assessing test cases. Second, we provide an overall view of international projects which tackled security testing and the emerging commercial products for security testing.

Third, we describe ongoing research that extends the work on access control testing to encompass usage control testing.

We conclude this chapter by discussing the main security testing challenges that are worth exploring in the near future. The remainder of this chapter is organized as follows. In Section 2, we give an overview about access control concepts and mechanisms by focusing on the XACML policy model. In Section 3, we go through the different approaches for access control testing according to a classification according to test targets. Section 4 outlines the research proposals in each step of common testing processes. Section 5 gives an overview about usage control testing. Section 6 discusses future research challenges and finally Section 7 concludes this work.