Usability Analysis of Software Security Tools

Svaka programska podrška trebala bi biti sigurna za korištenje i čuvati osjetljive korisničke podatke. Zbog velikog broja upada u sustav i krađe podataka, potrebno je razmotriti oblike ranjivosti sustava i obratiti pažnju na moguće rizike napada i preporuke za razvoj sigurne programske podrške. Nakon razvoja, potrebno je provesti detaljna testiranja kako bi se osigurala što veća kvaliteta i pouzdanost programske podrške. Osim ručnih testiranja, postoji veliki broj automatiziranih alata koji skeniraju aplikaciju te daju izvještaj potencijalnih ranjivosti u raznim formatima. Neki od alata otvorenog koda koji se koriste za skeniranje aplikacija su Arachni, Vega, OWASP ZAP, w3af i Nikto. Dostupni su za MS Windows, Linux i Mac OS. Pokrivaju širok spektar ranjivosti i sigurnosnih propusta u internetskim aplikacijama. Otkrivanje im je nekih ranjivosti zajedničko, a za neke je ranjivosti potrebno proučiti specifikacije i odabrati alat koji je specijaliziran za tu vrstu ranjivosti. Alati otvorenog koda omogućuju korisnicima dodavanje vlastitih testova preko modula i drugih dodataka. Zbog stalnog pojavljivanja novih ranjivosti, treba biti u toku kako s ranjivostima, tako i s novim značajkama i modulima alata. Oni koji žele dati svoj doprinos u poboljšanju sigurnosti, umjesto postavljanja temelja novog alata, mogu se uključiti u razvoj i poboljšanje nekog već postojećeg alata.All software should be safe for using and protecting sensitive user data. Due to a large number of system intrusions and data theft, it is essential to consider different types of system vulnerabilities and pay attention to potential attack risks, as well as recommendations of the secure software development. After a development phase, it is necessary to conduct detailed testing to ensure high quality and reliability software. In addition to manual testing, many automated security tools, which scan the application and provide a report of potential vulnerabilities in various formats, are available for the usage. Some open source tools which are used for scanning applications are Arachni, Vega, OWASP ZAP, w3af and Nikto. They are available for MS Windows, Linux and Mac OS. Furthermore, they cover many vulnerabilities and security flaws in web applications. On the one hand, their communal feature is detection of some vulnerability types, while on the other hand, in the case of some specific vulnerability, it is important to study specifications and choose the most appropriate tool that is specialized for the target type of vulnerability. Open source tools allow users to add their own tests through modules and other plug-ins. Due to the continuous emergence of new vulnerabilities, it is important to stay up to date with both vulnerabilities as well as new features and modules of scanning tools. Those who want to contribute to the community and security improvements, instead of developing a new tool, can involve themselves in the development and improvement of some existing tools