Cooking with Security

In case you hadn't realized it quite yet, I'm big on analogies. It makes understanding things so much easier. I'm also big on drawing weird connections between things but that's a topic for another blog entry. This time I'm discussing black box testing versus white box testing.

I was making myself tacos for dinner the other night when I realized the comparison. I had pulled out the cheese, immediately saw the mold all over it and realized it wasn't good. I was essentially white box testing the ingredients for my tacos. My "source code scanner" (me) found the one bad "function" (the cheese) in what would be the "entire program" (the taco). And as would be expected with a white box test, it saved me time and effort by replacing the cheese before it ended up on the final product.

From this little bit, it sounds like a white box tester is all that would be needed, something to validate the ingredients / parts. But as everyone can tell you with food, it's the final product that matters. You need that final black box test to look at the product as it is deployed to take all the factors into account. You need to crunch into that taco and discover if too much hot sauce was deployed or if the meat was cold or if the cheese was bad. Or maybe there is an extra ingredient (like honey) that your white box testing said was not spoiled but your black box testing would reveal as not a good fit for the final product. Comparably you need to see how the web application functions in the final environment to know if it is secure. Is there a problem with how two functions are interacting? Does one page not call the right sub-procedure? Is it deployed on a faulty or insecure web server?

There are advantages to testing from both perspectives: white box testing will help save efforts of implementing a faulty component, black box testing will validate the deployed product. But if I had to choose only one method of testing, I know I would pick black box testing. Only after that crunch into the taco can you know the final result is good.

- Mike Kazmierczak, Cenzic, Inc.

Comments

[lee jeans homme]

ok.trop cool et je reviendrai la prochaine fois.