Advancing ESSecA: a step forward in Automated Penetration Testing

What is it about?

Penetration testing is a security assessment technique that aims to identify all possible weaknesses present in a computer system, emulating the behavior of a real attacker. This is a complex process, so this work aims to provide support to the security experts who have to conduct it. In particular, this work proposes the automation of the test (attack) planning phase that the penetration tester must perform on the target system. The work is based on the use of a framework, called ESSecA, which is an expert system for security assessment. In addition to providing penetration test plans, ESSecA is able to provide a threat model of the system under test. For the production of penetration test plans, the framework has been expanded with the addition of new knowledge bases, in particular the integration of CAPEC and the introduction of a catalog of tools. Finally, to make attack plans structured, we have introduced a new taxonomy of penetration test phases, integrating ATT&CK tactics.

Featured Image

Photo by KeepCoding on Unsplash

Photo by KeepCoding on Unsplash

Why is it important?

Since penetration testing processes must be conducted by security experts on a periodic basis, they involve high costs and execution times. Sometimes, these processes can also be incomplete, precisely because they are based on the expertise of penetration testers. Furthermore, at the moment, there are no single standards for penetration testing. Therefore, our idea was to propose as structured a version of the penetration testing processes as possible and making test planning automatic.

Perspectives