A security evaluation and testing methodology for open source software embedded information security system

Abstract

Many of Information Security Systems (ISS) have been developed by using and embedding Open Source Software(OSS) such as OpenSSL. The "OSS-embedded ISS" should be tested and evaluated when it will be used as a security product or system for an organization. In this paper, we present a test and evaluation procedure for an OSS-embedded ISS, and ROSEM(real-time OpenSSL execution monitoring system) that is a testing tool in according to presented methodology. The main function of ROSEM such as an execution path generator for OpenSSL is useful for test case generation in the CC evaluation scheme. © Springer-Verlag Berlin Heidelberg 2005.