Applying Security Testing Techniques to Automotive Engineering

TL;DR

This paper systematically classifies security regression testing approaches in automotive engineering, highlighting current understanding, gaps, and future research directions to enhance security in evolving IT systems.

Contribution

It provides a comprehensive classification of security regression testing methods specific to automotive engineering, based on a rigorous literature review and analysis.

Findings

Identification of well-understood research areas

Highlighting gaps in tool support and evaluation methods

Proposing future research directions

Abstract

The openness of modern IT systems and their permanent change make it challenging to keep these systems secure. A combination of regression and security testing called security regression testing, which ensures that changes made to a system do not harm its security, are therefore of high significance and the interest in such approaches has steadily increased. In this article we present a systematic classification of available security regression testing approaches based on a solid study of background and related work to sketch which parts of the research area seem to be well understood and evaluated, and which ones require further research. For this purpose we extract approaches relevant to security regression testing from computer science digital libraries based on a rigorous search and selection strategy. Then, we provide a classification of these according to security regression approach criteria: abstraction level, security issue, regression testing techniques, and tool support, as well as evaluation criteria, for instance evaluated system, maturity of the system, and evaluation measures. From the resulting classification we derive observations with regard to the abstraction level, regression testing techniques, tool support as well as evaluation, and finally identify several potential directions of future research.