As geopolitical tensions rise, attackers are increasingly targeting state and federal governments. In 2024, 60% of state and local governments experienced a cyberattack. Governments are seeing an increase in all types of attacks, including a 148% surge in malware attacks and a 300%+ uptick in endpoint security incidents.
However, governments face unique challenges in securing themselves against these threats. They often juggle competing priorities: securing a large attack surface, modernizing legacy infrastructure, and meeting extensive compliance requirements. They also operate with far fewer resources than their private-sector counterparts.
Fuzz testing can help governments stay ahead of these threats by catching vulnerabilities that traditional tools miss, all while meeting key compliance requirements. Here’s how.
Fuzz testing, or fuzzing for short, is a technique for discovering vulnerabilities by injecting invalid, unexpected, or random data into a program to trigger bad behaviors (like crashes, infinite loops, or memory leaks). The results can indicate underlying vulnerabilities. Fuzzing tools can take many shapes and forms. Some randomly generate inputs, while others use templates (grammar-based fuzzing) or analyze their target application’s behavior to generate inputs (behavioral or guided fuzzing). Guided fuzzing tools often use advanced techniques such as dynamic analysis and symbolic execution to systematically explore program paths and generate inputs that reveal deep vulnerabilities.
In other words, fuzz testing is effective for uncovering novel vulnerabilities often missed by traditional security tools (e.g., static analyzers or scanners that address only known vulnerabilities). In fact, Dynamic Application Security Testing (DAST) tools that use fuzzing have been proven to maximize defect detection with the least time and resources. For instance, teams at Google report that 80% of all bugs were found via fuzzing and that fuzzing prevented 40% of regressions in existing code.
Fuzz testing can help address compliance obligations for the public sector, including ED-203A, NIST SP 800-53 SA-11, and NIST SSDF. Let’s take a closer look at each.
ED-203A requires any entity involved in aviation to ensure that aircraft systems are safe from cyber threats. This standard applies to any entities involved in aviation regulation, defense aviation, drone programs, or aerospace procurement.
ED-203A requires organizations to meet a new standard—refutation—which entails that they show the presence or absence of a vulnerability in a test scenario. This means organizations must meet three Security Refutation Objectives:
Fuzz testing can help public sector organizations meet ED-203A. In fact, the regulation specifically calls out fuzzing as a refutation activity. Here’s how fuzz testing can satisfy all three Security Refutation Objectives under ED-203A:
Originally mandated by the Federal Information Security Management Act (FISMA), NIST SP 800-53 outlines a framework for federal agencies to implement information and cybersecurity programs. It also applies to federal contracts, especially if they build, operate, or maintain federal information systems. NIST SP 800-53 requires organizations to categorize their systems by risk, implement appropriate controls based on that risk, and establish systems to assess the effectiveness of those controls.
Fuzz testing can help meet NIST SP 800-53 by giving public sector teams a repeatable way to test systems at runtime, uncover vulnerabilities, verify remediation, and produce evidence that all these steps happened. For instance, SA-11(8) requires organizations to use dynamic code analysis tools to identify common software flaws, like memory corruption and privilege issues. This is exactly what fuzz testing does. In fact, SA-11’s supplemental guidance identifies fuzz testing as a form of dynamic analysis that can help meet this requirement.
The NIST SSDF is a set of guidelines that public security teams must implement to integrate security into each stage of the software development life cycle. It also applies to vendors selling software to the federal government (as laid out in EO 14028).
Instead of mandating specific tools or guidelines, the NIST SSDF lays out four operational pillars that organizations must meet. These include implementing security practices into code (i.e., “producing well-secured software”) and processes to identify and patch vulnerabilities (i.e., “responding to vulnerabilities”). Fuzz testing tools can be used to meet several of these criteria:
Bugcrowd helps teams operationalize fuzz testing to improve security outcomes and demonstrate compliance. With Bugcrowd’s recent acquisition of Mayhem Security, the public sector can benefit from extended security testing during the development cycle. Code Security automatically generates and runs test cases against your codebase, while the API Security product does the same for API endpoints. By leveraging both, public sector organizations can ensure that their attack surface is protected. Below are more reasons why public sector organizations choose Bugcrowd:
Ready to get started? Get a demo to see how Bugcrowd can help you uncover more exploits.