Time-tagged pre-defined scenarios for penetration testing

• US 10,412,112 B2
• Filed: 03/05/2018
• Issued: 09/10/2019
• Est. Priority Date: 08/31/2017
• Status: Active Grant

• Current Assignee: XM Cyber Ltd. (Schwarz Unternehmenskommunikation GmbH & Co. KG)
• Original Assignee: XM Cyber Ltd. (Schwarz Unternehmenskommunikation GmbH & Co. KG)
• Inventors: Ashkenazy, Adi, Segal, Ronen, Lasser, Menahem
• Primary Examiner(s): Bechtel, Kevin
• Application Number:
  US15/911,170
• Publication Number:
  US 20190068631A1
• Time in Patent Office: 554 Days
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/50 Testing arrangements
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

Methods and systems for carrying out campaigns of penetration testing for discovering and reporting security vulnerabilities of a networked system. Penetration testing campaigns are carried out based on pre-defined penetration testing scenarios associated with respective time tags. A penetration testing scenario is selected by a user from a set of pre-defined test scenarios, the set containing only pre-defined test scenarios with time tags matching a scheduled starting time of a penetration testing campaign.

Claims

1. A system for executing a penetration testing campaign of a networked system, wherein the penetration testing campaign is scheduled to start at a specific start time, the system comprising:

a. a first non-transitory computer-readable storage medium comprising a library of test scenarios, each test scenario associated with a respective time tag;

b. a computing device, comprising;

i. one or more computer processors, and

ii. a user interface module comprising a display device for (A) displaying multiple test scenarios from the library and (B) enabling user selection of one of the multiple test scenarios, such that test scenarios from the library whose respective time tags match the scheduled specific start time are displayed and are selectable by the user, and test scenarios from the library whose respective time tags do not match the scheduled specific start time are either not displayed or are displayed but are not selectable by the user; and

c. a second non-transitory computer-readable storage medium comprising program instructions that, when executed by the one or more computer processors of the computing device, cause the one or more computer processors to (i) execute the penetration testing campaign on the basis of the user-selected test scenario so as to test the networked system, (ii) detect a continuance of the executing of the penetration testing campaign until a Boolean condition represented by the time tag associated with the user-selected test scenario becomes not satisfied;

(iii) in response to the detecting, automatically terminating the executing of the penetration testing campaign, and (iv) report at least one security vulnerability determined by the testing of the networked system, wherein the time tag associated with the user-selected test scenario includes at least one of a time interval and a time point, and said time interval determines both a starting time and an ending time.

2. A method for executing a penetration testing campaign in a networked system, using an automated penetration testing system, wherein (i) the automated penetration testing system includes a library of multiple pre-defined test scenarios with respective time tags, and (ii) the penetration testing campaign is scheduled to start at a specific start time, the method comprising:

a. displaying, by a first display device, pre-defined test scenarios from the library whose respective time tags match the specific start time, wherein;

(i) the displaying enables a selection of a pre-defined test scenario by a user of the automated penetration testing system, and

(ii) pre-defined test scenarios from the library whose respective time tags do not match the specific start time are either not displayed by the first display device or are displayed by the first display device but are not selectable by the user;

b. in response to a selection by the user of a pre-defined test scenario using a user interface of the automated penetration testing system, executing the penetration testing campaign based on the user-selected pre-defined test scenario, so as to test the networked system; and

c. reporting at least one security vulnerability determined to exist in the networked system by the penetration testing campaign, the reporting comprising at least one of;

(i) causing a second display device to display information about the at least one security vulnerability, (ii) recording information about the at least one security vulnerability in a file, and (iii) electronically transmitting information about the at least one security vulnerability,

wherein;

(i) the method further comprises;

d. detecting a continuance of the executing of the penetration testing campaign until a Boolean condition represented by the time tag associated with the user-selected pre-defined test scenario becomes not satisfied; and

e. in response to the detecting, automatically terminating the executing of the penetration testing campaign; and

(ii) the time tag associated with the user-selected pre-defined test scenario includes at least one of a time interval and a time point, and said time interval determines both a starting time and an ending time.

3. The method of claim 2, wherein the specific start time at which the penetration testing campaign is scheduled to start execution is the current time.

4. The method of claim 2, wherein the specific start time at which the penetration testing campaign is scheduled to start execution is received by the automated penetration testing system via the user interface of the automated penetration testing system.

5. The method of claim 2, wherein (i) the respective time tag of the selected pre-defined test scenario has the form of a time interval, and (ii) the time tag includes one of (A) a starting time and an ending time, (B) a starting time and a time duration, and (C) a time value and plus and minus tolerances.

6. The method of claim 2, wherein the respective time tag of the selected pre-defined test scenario has the form of a time point.

7. The method of claim 2, wherein the respective time tag of the selected pre-defined test scenario is a repeating time tag.

8. A method for penetration testing of a networked system by executing a penetration testing campaign by an automated penetration testing system that is controlled by a user interface of a computing device, the method comprising:

a. determining, by the penetration testing system, a time at which the penetration testing campaign is scheduled to start execution;

b. retrieving, by the penetration testing system, a first set of pre-defined penetration testing scenarios from a storage device, wherein each of the pre-defined penetration testing scenarios in the first set is associated with a corresponding time tag;

c. causing, by the penetration testing system, a first display device to display a second set of pre-defined penetration testing scenarios, the second set being a subset of the first set;

d. receiving, by the penetration testing system and via the user interface of the computing device, one or more manually-entered inputs, the one or more manually-entered inputs selecting one pre-defined penetration testing scenario included in the first set, wherein the selecting of the one pre-defined penetration testing scenario is limited to selecting only a pre-defined penetration testing scenario associated with a time tag which matches the time at which the penetration testing campaign is scheduled to start execution;

e. setting the penetration testing campaign to be based on the selected one pre-defined penetration testing scenario;

f. executing the penetration testing campaign by the penetration testing system so as to test the networked system; and

g. reporting, by the penetration testing system, at least one security vulnerability determined to exist in the networked system by the executing of the penetration testing campaign, wherein the reporting comprises at least one of (i) causing a second display device to display information about the at least one security vulnerability, (ii) recording information about the at least one security vulnerability in a file, and (iii) electronically transmitting information about the at least one security vulnerability

wherein;

(i) the method further comprises;

h. detecting a continuance of the executing of the penetration testing campaign until a Boolean condition represented by the time tag associated with the selected one pre-defined penetration testing scenario becomes not satisfied; and

i. in response to the detecting, automatically terminating the executing of the penetration testing campaign; and

(ii) the time tag associated with the selected one pre-defined penetration testing scenario includes at least one of a time interval and a time point, and said time interval determines both a starting time and an ending time.

9. The method of claim 8, wherein for each given pre-defined penetration testing scenario in the first set, the given pre-defined penetration testing scenario is included in the second set if and only if the given pre-defined penetration testing scenario is associated with a time tag which matches the time at which the penetration testing campaign is scheduled to start execution.

10. The method of claim 8, wherein (i) the second set is equal to the first set, and (ii) each pre-defined penetration testing scenario in the first set which is associated with a time tag that does not match the time at which the penetration testing campaign is scheduled to start execution is marked on the first display device as not being selectable.

11. The method of claim 8, wherein the determined time at which the penetration testing campaign is scheduled to start execution is the current time.

12. The method of claim 8, wherein the determining of the time at which the penetration testing campaign is scheduled to start execution includes receiving via the user interface of the computing device one or more additional manually-entered inputs selecting the time at which the penetration testing campaign is scheduled to start execution.

13. The method of claim 8, wherein the setting the penetration testing campaign to be based on the selected one pre-defined penetration testing scenario includes assigning every information item of the penetration testing campaign a value taken from the corresponding information item of the selected one pre-defined penetration testing scenario.

14. The method of claim 8, wherein the setting of the penetration testing campaign to be based on the selected one pre-defined penetration testing scenario includes, for at least one information item of the penetration testing campaign, receiving a value for the one information item, wherein the receiving of the value is from a user of the penetration testing system and via the user interface of the computing device, and the receiving is subsequent to the selecting of the pre-defined penetration testing scenario.

15. The method of claim 8, wherein (i) the time tag with which the selected one pre-defined penetration testing scenario is associated has the form of a time interval, and (ii) the time tag includes one of (A) a starting time and an ending time, (B) a starting time and a time duration, and (C) a time value and plus and minus tolerances.

16. The method of claim 8, wherein the time tag with which the selected one pre-defined penetration testing scenario is associated has the form of a time point.

17. The method of claim 8, wherein the time tag with which the selected one pre-defined penetration testing scenario is associated is a repeating time tag.

18. A penetration testing system for testing a networked system by executing a penetration testing campaign, comprising:

a. a computing device including one or more computer processors;

b. a non-transitory computer-readable storage medium storing program instructions for executing a penetration testing campaign, wherein the program instructions are for execution by the one or more computer processors and wherein the stored program instructions comprise;

i. first program instructions for determining a time at which the penetration testing campaign is scheduled to start execution,

ii. second program instructions for retrieving a first set of pre-defined penetration testing scenarios from a storage device, wherein each of the pre-defined penetration testing scenarios in the first set is associated with a corresponding time tag,

iii. third program instructions for causing a first display device to display a second set of pre-defined penetration testing scenarios, the second set being a subset of the first set,

iv. fourth program instructions for receiving, via a user interface of the computing device, one or more manually-entered inputs, the one or more manually-entered inputs selecting one pre-defined penetration testing scenario included in the first set, wherein the selecting of the one pre-defined penetration testing scenario is limited to selecting only a pre-defined penetration testing scenario associated with a time tag which matches the time at which the penetration testing campaign is scheduled to start execution,

v. fifth program instructions for setting the penetration testing campaign to be based on the selected one pre-defined penetration testing scenario,

vi. sixth program instructions for executing the penetration testing campaign so as to test the networked system,

vii. seventh program instructions for reporting at least one security vulnerability determined to exist in the networked system by the executing of the penetration testing campaign, wherein the reporting comprises at least one of (i) causing a second display device to display information about the at least one security vulnerability, (ii) recording information about the at least one security vulnerability in a file, and (iii) electronically transmitting information about the at least one security vulnerability,

viii. eighth program instructions for detecting a continuance of the executing of the penetration testing campaign until a Boolean condition represented by the time tag associated with the selected one pre-defined penetration testing scenario becomes not satisfied, and

ix. ninth program instructions for, in response to the detecting, automatically terminating the executing of the penetration testing campaign,

wherein the time tag associated with the selected one pre-defined penetration testing scenario includes at least one of a time interval and a time point, and said time interval determines both a starting time and an ending time.