Fuzzing
What is Fuzzing?
An automated software testing technique that involves providing invalid, unexpected, or random data as inputs to a computer program. Fuzzing aims to discover coding errors and security vulnerabilities.
Frameworks that govern fuzzing
What the standards actually require on fuzzing
Requirements naming fuzzing across 6 standards, quoted from the control text.
Scorecard checks whether the project is fuzzed: listed in OSS-Fuzz, running ClusterFuzzLite, or defining language-level fuzz or property-based tests it recognises (Go native fuzzing and a limited set of property-based testing libraries for Haskell, JavaScript...
openssf-scorecard::Fuzzing · Fuzzing check →A process shall be employed to perform vulnerability testing, including abuse case testing of interfaces, attack surface analysis, black box known vulnerability scanning, software composition analysis and dynamic runtime testing (fuzzing), on the product as de...
iec-62443::SVV-3 · Vulnerability testing →Operate security test + certification + conformance per O-RAN WG11 Security Test Specifications and WG11 Test Specifications including Open Test and Integration Center (OTIC) testing.
ORANWG11-6 · Security Test Specifications, Certification, and Conformance →Passing criterion dynamic_analysis_enable_assertions (SUGGESTED; group Analysis, Dynamic code analysis). Criterion text: It is SUGGESTED that the project use a configuration for at least some dynamic analysis (such as testing or fuzzing) which enables many ass...
openssf-best-practices-badge-criteria::passing.dynamic_analysis_enable_assertions · dynamic_analysis_enable_assertions (Passing, SUGGESTED) →Prioritise memory safe languages wherever possible (C#, Rust, Ruby, Java, Go and Swift are given as examples). The October 2023 text accepts language improvements, hardware mitigations, ASLR, control-flow integrity and fuzzing as shorter-term measures for lega...
secure-by-design-a-guide-for-manufacturers-cisa::DT-1 · Memory safe programming languages (SSDF PW.6.1) →Monitor incoming and outgoing signalling; protect signalling records as sensitive data; analyse signalling traffic to find and address anomalous and malicious signalling; establish means to alert other providers of signalling-based compromise;
uk-telecommunications-security-act-2021::M12 · M12.01 to M12.05 Signalling monitoring: monitor and analyse signalling, protect signalling records, alert others and fuzz interfaces →Questions people ask about fuzzing
What is Fuzzing?
Why is Fuzzing important for compliance?
Which compliance frameworks address Fuzzing?
Where can I learn more about Fuzzing?
See how Fuzzing applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.