Comments on: White Box Better Than Black Box

By: Juan Gama

Juan Gama — Mon, 16 Nov 2009 19:12:16 +0000

You are right about the coverage, WhiteBox has a better results over BlackBox, but the problem that I’ve been seeing is the cost, maybe is better to have a WhiteBox test but it is also more expensive, maybe this is the main retractor when companies do not want a internal security team and instead of it they go to external companies to perform a security test.

Besides BlackBox tests are way cooler than WhiteBox tests :P

By: M-unition » Blog Archive » WASC Web Application Security Statistics Published

Mon, 02 Nov 2009 14:31:04 +0000

[...] to Veracode’s Blog for pointing me to the Web Application Security Consortium (WASC) Web Application Security [...]

By: 気になった記事(20091023) [ほほほのほ]

気になった記事(20091023) [ほほほのほ] — Fri, 23 Oct 2009 03:58:24 +0000

[...] White box better than black box [...]

By: Dave Hull

Dave Hull — Wed, 21 Oct 2009 17:28:25 +0000

I read through the WASS data yesterday and found it matched nicely with my experience. I’ve been working in app sec for a few years now, using the full gamut of threat modeling, static code analysis and manual testing. I see white box testing progressing along Stu Feldman’s maturity model:

1. You have a good idea.
2. You can make it work.
3. You convince a gullible friend to try it.
4. People stop asking why you’re doing it.
5. People start asking others why they aren’t doing it.

In the not too distant future, the companies that aren’t doing white box testing will be the outliers.

Black box testing has too many unknowns and they are mostly unknown unknowns (thank you Rumsfeld).