Page 1106 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

FIGURE 15.11 The input file from Figure 15.10 after being run
through the zzuf mutation fuzzing tool

Fuzz testing is an important tool, but it does have limitations. Fuzz
testing typically doesn’t result in full coverage of the code and is
commonly limited to detecting simple vulnerabilities that do not
require complex manipulation of business logic. For this reason, fuzz
testing should be considered only one tool in a suite of tests
performed, and it is useful to conduct test coverage analysis (discussed

later in this chapter) to determine the full scope of the test.

Interface Testing

Interface testing is an important part of the development of complex
software systems. In many cases, multiple teams of developers work
on different parts of a complex application that must function together

to meet business objectives. The handoffs between these separately
developed modules use well-defined interfaces so that the teams may
work independently. Interface testing assesses the performance of
modules against the interface specifications to ensure that they will