The security software team has cloned the source code repository of the new software product so they can perform vulnerability testing by modifying…

The technique described is Source-Code Fault Injection (SCFI). This white-box testing method involves deliberately inserting errors (faults) directly into the software's source code. By cloning the repository and modifying code snippets, the security team is simulating software bugs or unexpected states to observe the system's response. The primary goal is to assess the software's robustness, error handling capabilities, and overall resilience. This method provides a high degree of control over the location and type of faults introduced, allowing for targeted vulnerability testing before the code is compiled and deployed.

B. Dynamic Code Analysis: This method tests a running application by providing external inputs to identify vulnerabilities, without modifying the source code itself.

C. Fuzz Testing: This is a specific type of dynamic analysis that involves sending large amounts of malformed or random data as input, not altering the program's code.

D. Binary Fault Injection: This technique injects faults into the compiled machine code (binary/executable), not the human-readable source code as described in the scenario.

---

1. Natella, R., Cotroneo, D., & Arlat, J. (2023). Software Fault Injection. In ACM Computing Surveys, 55(8), 1-37. In Section 3.1, "Compile-time injection," the authors describe this technique: "Faults are injected into the source code of the software, before the compilation... This approach is also known as source code instrumentation or source code modification." (p. 8). https://doi.org/10.1145/3564923

2. Voas, J. M., & McGraw, G. (1998). Software Fault Injection: Inoculating Programs Against Errors. John Wiley & Sons. Chapter 3, "Code-Based Fault Injection," details the process of altering source code to create faults. It distinguishes this from operational or data-based fault injection methods.

3. Meixner, A., & Goseva-Popstojanova, K. (2009). A Framework for Comparison of Software Fault Injection Tools. In 2009 20th International Symposium on Software Reliability Engineering (pp. 247-256). IEEE. The paper categorizes fault injection techniques, defining source code injection (compile-time injection) as the modification of high-level language source code to inject faults, contrasting it with binary-level injection and runtime injection. (Section II.A, p. 248). https://doi.org/10.1109/ISSRE.2009.33

4. Koopman, P. (2021). ECE 18-649, Lecture 11: Dependability & Fault Injection. Carnegie Mellon University. The course lecture notes differentiate between various fault injection methods, specifying that source-level injection involves "modifying source code to inject faults (e.g., mutation testing)." This aligns directly with the scenario. (Slide 21).