What is it about?
Penetration testing is a security assessment technique that aims to identify all possible weaknesses present in a computer system, emulating the behavior of a real attacker. This is a complex process, so this work aims to provide support to the security experts who have to conduct it. In particular, this work proposes the automation of the test (attack) planning phase that the penetration tester must perform on the target system. The work is based on the use of a framework, called ESSecA, which is an expert system for security assessment. In addition to providing penetration test plans, ESSecA is able to provide a threat model of the system under test. For the production of penetration test plans, the framework has been expanded with the addition of new knowledge bases, in particular the integration of CAPEC and the introduction of a catalog of tools. Finally, to make attack plans structured, we have introduced a new taxonomy of penetration test phases, integrating ATT&CK tactics.
Featured Image
Photo by KeepCoding on Unsplash
Why is it important?
Since penetration testing processes must be conducted by security experts on a periodic basis, they involve high costs and execution times. Sometimes, these processes can also be incomplete, precisely because they are based on the expertise of penetration testers. Furthermore, at the moment, there are no single standards for penetration testing. Therefore, our idea was to propose as structured a version of the penetration testing processes as possible and making test planning automatic.
Perspectives
I am satisfied with the results obtained, although I believe that much more work needs to be done to make the framework totally automatic. But this can only encourage us to continue on this path.
Felice Moretta
Seconda Universita degli Studi di Napoli
Read the Original
This page is a summary of: Advancing ESSecA: a step forward in Automated Penetration Testing, July 2024, ACM (Association for Computing Machinery),
DOI: 10.1145/3664476.3670459.
You can read the full text:
Resources
Contributors
The following have contributed to this page