A software security testing method based on typical defects

According to CERT/CC, ten defects known are responsible for 75% of security breaches in today software applications. Those defects are named as typical security defects. Based on that, a security testing method is given. In the method, a modeling technique with threat tree is described. Finally, a threat tree traversal algorithm (Tri-T algorithm) based on depth-first-search is designed and is used in an example to generate the test sequence.