Setting-up penetration testing campaigns

• US 10,122,750 B2
• Filed: 08/21/2017
• Issued: 11/06/2018
• Est. Priority Date: 01/30/2017
• Status: Active Grant

• Current Assignee: XM Cyber Ltd. (Schwarz Unternehmenskommunikation GmbH & Co. KG)
• Original Assignee: XM Cyber Ltd. (Schwarz Unternehmenskommunikation GmbH & Co. KG)
• Inventors: Gorodissky, Boaz, Ashkenazy, Adi, Segal, Ronen
• Primary Examiner(s): Lemma, Samson B
• Application Number:
  US15/681,692
• Publication Number:
  US 20180219900A1
• Time in Patent Office: 442 Days
• Field of Search: 726 25
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Methods and systems for penetration testing of a networked system by a penetration testing system (e.g. that is controlled by a user interface of a computing device) are disclosed herein. In one example, a penetration testing campaign is executed according to a manual and explicit selecting of one or more network nodes of the networked system. Alternatively or additionally, a penetration testing campaign is executed according to a manually and explicitly selected node-selection condition. Alternatively or additionally, a penetration testing campaign is executed according to an automatic selecting of one or more network nodes of the networked system.

Claims

1. A method of penetration testing of a networked system by a penetration testing system that is controlled by a user interface of a computing device so that a penetration testing campaign is executed according to a manual and explicit selecting of one or more network nodes of the networked system, the method comprising:

receiving, by the penetration testing system and via the user interface of the computing device, one or more manually-entered inputs, the one or more manually-entered inputs explicitly selecting the one or more network nodes of the networked system, wherein at least one of the manually and explicitly selected nodes is other than the computing device;

in accordance with the manual and explicit selecting of the network nodes, executing the penetration testing campaign by the penetration testing system so as to test the networked system, the penetration testing campaign being executed under the assumption that the manually and explicitly selected one or more network nodes of the networked system are already compromised at the time of beginning the penetration testing campaign; and

reporting, by the penetration testing system, at least one security vulnerability determined to exist in the networked system by the executing of the penetration testing campaign, wherein the reporting comprises at least one of (i) causing a display device to display a report describing the at least one security vulnerability, and (ii) electronically transmitting a report describing the at least one security vulnerability;

wherein before receiving the one or more manually-entered inputs that explicitly select the one or more network nodes of the networked system, the penetration testing system automatically computes and displays an explicit recommendation for selecting the one or more network nodes that are already compromised at the time of beginning the penetration testing campaign.

2. The method of claim 1 wherein the received one or more manually-entered inputs comprises an explicit user approval of the explicit recommendation.

3. The method of claim 1, further comprising:

subsequent to the receiving by the penetration testing system of the one or more manually-entered inputs that explicitly select the one or more network nodes of the networked system, receiving, by the penetration testing system and via the user interface of the computing device, one or more additional manually-entered inputs, the one or more additional manually-entered inputs explicitly selecting a value for a second information item of the penetration testing campaign, wherein the second information item is not a set of one or more network nodes that are assumed to be already compromised at the time of beginning the penetration testing campaign.

4. The method of claim 3 wherein the executing of the penetration testing campaign is performed using both (i) the manually and explicitly selected value for the second information item, and (ii) an assumption that the manually and explicitly selected one or more network nodes of the networked system are already compromised at the time of beginning the penetration testing campaign.

5. A method of penetration testing of a networked system by a penetration testing system that is controlled by a user interface of a computing device so that a penetration testing campaign is executed according to a manually and explicitly provided node-selection condition, the method comprising:

receiving, by the penetration testing system and via the user interface of the computing device, one or more manually-entered inputs, the one or more manually-entered inputs explicitly selecting a Boolean node-selection condition, the manually and explicitly selected node-selection condition defining a proper subset of network nodes of the networked system such that any network node of the networked system is a member of the subset of network nodes if and only if it satisfies the condition;

in accordance with the manual and explicit selecting of the node-selection condition, executing the penetration testing campaign by the penetration testing system so as to test the networked system, the penetration testing campaign being executed under the assumption that every node of the subset of network nodes is already compromised at the time of beginning the penetration testing campaign; and

reporting, by the penetration testing system, at least one security vulnerability determined to exist in the networked system by the executing of the penetration testing campaign, wherein the reporting comprises at least one of (i) causing a display device to display a report describing the at least one security vulnerability, and (ii) electronically transmitting a report describing the at least one security vulnerability,

wherein the Boolean node-selection condition is one of;

(i) a Boolean condition that is satisfied for a given network node if and only if the given network node has a direct connection to a computing device that is outside the networked system,

(ii) a Boolean condition that is satisfied for a network node if and on if the given network node has an operating system that is a member of a pre-defined set of operating systems, and

(iii) a Boolean condition that is satisfied for a given network node if and only if the given network node has a cellular communication channel.

6. The method of claim 5, further comprising:

subsequent to the receiving by the penetration testing system of the one or more manually-entered inputs that explicitly select the Boolean node-selection condition, receiving, by the penetration testing system and via the user interface of the computing device, one or more additional manually-entered inputs, the one or more additional manually-entered inputs explicitly selecting a value for a second information item of the penetration testing campaign, wherein the second information item is not a node-selection condition defining a subset of network nodes that are assumed to be already compromised at the time of beginning the penetration testing campaign.

7. The method of claim 6 wherein the executing of the penetration testing campaign is performed using both (i) the manually and explicitly selected value for the second information item, and (ii) an assumption that every node of the subset of network nodes is already compromised at the time of beginning the penetration testing campaign.

8. A method of penetration testing of a networked system by a penetration testing system that is controlled b a user interface of a computing device so that a penetration testing campaign is executed according to a manually and explicitly provided node-selection condition, the method comprising:

receiving, by the penetration testing system and via the user interface of the computing device, one or more manually-entered inputs, the one or more manually-entered inputs explicitly selecting a Boolean node-selection condition, the manually and explicitly selected node-selection condition defining a proper subset of network nodes of the networked system such that any network node of the networked system is a member of the subset of network nodes if and only if it satisfies the condition;

in accordance with the manual and explicit selecting of the node-selection condition, executing the penetration testing campaign by the penetration testing system so as to test the networked system, the penetration testing campaign being executed under the assumption that every node of the subset of network nodes is already compromised at the time of beginning the penetration testing campaign; and

reporting, by the penetration testing system, at least one security vulnerability determined to exist in the networked system by the executing of the penetration testing campaign, wherein the reporting comprises at least one of (i) causing a display device to display a report describing the at least one security vulnerability, and (ii) electronically transmitting a report describing the at least one security vulnerability, wherein before receiving the one or more manually-entered inputs that explicitly select the Boolean node-selection condition, the penetration testing system automatically computes and displays an explicit recommendation for selecting the Boolean node-selection condition.

9. The method of claim 8 wherein the received one or more manually-entered inputs for selecting the Boolean node-selection condition comprise an explicit user approval of the explicit recommendation.

10. A method of penetration testing of a networked system by a penetration testing system that is controlled by a user interface of a computing device so that a penetration testing campaign is executed according to an automatic selecting of one or more network nodes of the networked system, the method comprising:

determining, by the penetration testing system, a type of an attacker of the penetration testing campaign;

based on a result of the determining, automatically selecting, by the penetration testing system, the one or more network nodes of the networked system, wherein at least one of the automatically selected network nodes is other than the computing device;

in accordance with the automatically selecting of the network nodes, executing the penetration testing campaign by the penetration testing system so as to test the networked system, the penetration testing campaign being executed under the assumption that the automatically selected one or more network nodes of the networked system are already compromised at the time of beginning the penetration testing campaign; and

reporting, by the penetration testing system, at least one security vulnerability determined to exist in the networked system by the executing of the penetration testing campaign, wherein the reporting comprises at least one of (i) causing a display device to display a report describing the at least one security vulnerability, and (ii) electronically transmitting a report describing the at least one security vulnerability, wherein the determining of the type of the attacker comprises one of;

(i) automatically determining the type of the attacker by the penetration testing system, and (ii) receiving, via the user interface of the computing device, one or more manually-entered inputs that explicitly select the type of the attacker.

11. A method of penetration testing of a networked system by a penetration testing system that is controlled by a user interface of a computing device so that a penetration testing campaign is executed according to an automatic selecting of one or more network nodes of the networked system, the method comprising:

determining, by the penetration testing system, whether one or more network nodes of the networked system satisfy a pre-defined Boolean condition;

based on a result of the determining, automatically selecting, by the penetration testing system, the one or more network nodes of the networked system, wherein at least one of the automatically selected network nodes is other than the computing device;

in accordance with the automatically selecting ofio the network nodes, executing the penetration testing campaign by the penetration testing system so as to test the networked system, the penetration testing campaign being executed under the assumption that the automatically selected one or more network nodes of the networked system are already compromised at the time beginning the penetration testing campaign; and

reporting, by the penetration testing system, at least one security vulnerability determined to exist in the networked system by the executing of the penetration testing campaign, wherein the reporting comprises at least one of (i) causing a display device to display a report describing the at least one security vulnerability, and (ii) electronically transmitting a report describing the at least one security vulnerability, wherein the determining comprises automatically determining whether the one or more network nodes of the networked system satisfy the pre-defined Boolean condition, and wherein the pre-defined Boolean condition is one of;

(i) a pre-defined Boolean condition that is satisfied for a given network node if and only if the given network node has a direct connection to a computing device that is outside the networked system,

(ii) a pre-defined Boolean condition that is satisfied for a given network node if and only if the given network node has an operating system that is a member of a pre-defined set of operating systems, and

(iii) a pre-defined Boolean condition that is satisfied for a given network node if and only if the given network node has a cellular communication channel.

12. The method of claim 11, wherein the pre-defined Boolean condition is satisfied for a given network node if and only if the given network node has a direct connection to a computing device that is outside the networked system.

13. The method of claim 11, wherein the pre-defined Boolean condition is satisfied for a given network node if and only if the given network node has an operating system that is a member of a pre-defined set of operating systems.

14. The method of claim 11, wherein the pre-defined Boolean condition is satisfied for a given network node if and only if the given network node has a cellular communication channel.