OWASP AppSec Research 2013

In this talk, we present how the SPaCIoS Tool supports security analysts and developers in the security assessment of a system under testing. In particular, we describe the main workflows and components that have been implemented as part of the SPaCIoS Tool and that rely on a combination of model-checking, model-based security testing, mutation testing, and penetration testing techniques to detect vulnerabilities and to evaluate the security implications of specific design and deployment decisions. We also report on a number of experiments we have been carrying out. In particular, we have been applying the tool as a proof of concept on a set of security testing problem cases drawn from industrial and open-source web-based application scenarios. We have also been executing collaboration projects with business units at industry as a stepping stone towards the industry migration of the SPaCIoS Tool.