Software Quality Assurance & Testing Stack Exchange is a question and answer site for software quality control experts, automation engineers, and software testers. It only takes a minute to sign up.
Sign up to join this community
It is good to define an attack surface before security testing.
Different places to attack:
Different kind of attacks:
Different risks...
So I was wondering what methods do you use? Attack surface analyzing is a part of for example Microsoft's The Security Development Lifecycle (SDL).
There is Microsoft's own Attack Surface Analyzer Tool which was first released in 2011, runs on Vista/Win7/Win Server 2008 and generates reports in HTML format.
Attack Surface Analyzer is all in one tool for analysis of changes made to the various parts of the attack surface of Windows 6 series Operating System (includes Windows Vista and Windows 7). Using this one tool, you can analyze the changes made to the Registry, File permissions, Windows IIS Server, GAC assemblies and a lot more can be done[7]. According to Microsoft, it is the same tool in use by the engineers of the security team at Microsoft to analyze the effects of software installation on the Windows Operating System.
Personally I think that the important first step of any security test is to build a good threat model. The threat modelling process if done correctly should surface a lot of the potential areas for attack.
