SYSTEMS AND METHODS FOR SELECTING A LATERAL MOVEMENT STRATEGY FOR A PENETRATION TESTING CAMPAIGN

• US 20180219903A1
• Filed: 01/12/2018
• Published: 08/02/2018
• Est. Priority Date: 01/30/2017
• Status: Active Grant

• Current Assignee: XM Cyber Ltd. (Schwarz Unternehmenskommunikation GmbH & Co. KG)
• Original Assignee: XM Ltd.
• Inventors: SEGAL, Ronen
• Granted Patent: US 10,686,822 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 9/451 Execution arrangements for user interfaces
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Methods and systems for carrying out campaigns of penetration testing for discovering and reporting security vulnerabilities of a networked system, the networked system comprising a plurality of network nodes interconnected by one or more networks.

Claims

1. A method of penetration testing of a networked system by a penetration testing system that is controlled by a user interface of a computing device so that a penetration testing campaign is executed according to a lateral movement strategy of an attacker of the penetration testing campaign, the method comprising:

a. automatically selecting, by the penetration testing system, one lateral movement strategy from a group of multiple lateral movement strategies available for use in the penetration testing campaign;

wherein the automatic selecting is done by randomly selecting the one lateral movement strategy from the group of lateral movement strategies;

b. executing the penetration testing campaign, by the penetration testing system and according to the automatically selected lateral movement strategy of the attacker, so as to test the networked system; and

c. reporting, by the penetration testing system, at least one security vulnerability determined to exist in the networked system by the executing of the penetration testing campaign, wherein the reporting comprises at least one of (i) causing a display device to display a report describing the at least one security vulnerability, (ii) storing the report describing the at least one security vulnerability in a file, and (iii) electronically transmitting the report describing the at least one security vulnerability.

2. The method of claim 1, wherein the executing of the penetration testing campaign includes at least one event of selecting, according to the automatically selected one lateral movement strategy, a network node of the networked system to be the next network node to be attacked by the attacker of the penetration testing campaign.

3. The method of claim 1, further comprising:

prior to the automatically selecting, receiving, by the penetration testing system and via the user interface of the computing device, one or more manually-entered inputs explicitly instructing the penetration testing system to make the automatic selection randomly.

4. The method of claim 1, further comprising, prior to the automatically selecting, determining, by the penetration testing system, the group of multiple lateral movement strategies that are available for use in the penetration testing campaign.

5. The method of claim 4, wherein the determining of the group of multiple lateral movement strategies comprises retrieving the group of multiple lateral movement strategies from a non-volatile storage device functionally accessible to the penetration testing system.

6. The method of claim 4, wherein the determining of the group of multiple lateral movement strategies comprises:

a. displaying, by the penetration testing system, a second group of multiple lateral movement strategies, the second group of multiple lateral movement strategies including the lateral movement strategies in the group of multiple lateral movement strategies;

b. receiving, by the penetration testing system and via the user interface of the computing device, one or more manually-entered inputs explicitly selecting a sub-group of the second group of multiple lateral movement strategies;

c. defining the group of multiple lateral movement strategies from which the one lateral movement strategy is automatically selected to be the selected sub-group.

7. A system for penetration testing of a networked system by performing a penetration testing campaign against the networked system, the system comprising:

a. a set-up module including;

i. one or more set-up processors; and

ii. a set-up non-transitory computer readable storage medium for instructions execution by the one or more set-up processors, the set-up non-transitory computer readable storage medium having stored instructions to automatically select one lateral movement strategy of an attacker of the penetration testing campaign from a group of multiple lateral movement strategies available for use in the penetration testing campaign, the instructions to automatically select including instructions to randomly select the one lateral movement strategy from the group of lateral movement strategies;

b. a penetration-testing-campaign module including;

i. one or more penetration-testing-campaign processors; and

ii. a penetration-testing-campaign non-transitory computer readable storage medium for instructions execution by the one or more penetration-testing-campaign processors, the penetration-testing-campaign non-transitory computer readable storage medium having stored instructions to perform the penetration testing campaign according to the automatically selected lateral movement strategy of the attacker so as to test the networked system; and

c. a reporting module including;

i. one or more reporting processors; and

ii. a reporting non-transitory computer readable storage medium for instructions execution by the one or more reporting processors, the reporting non-transitory computer readable storage medium having stored instructions to report at least one security vulnerability determined to exist in the networked system according to results of the penetration testing campaign performed by the penetration-testing-campaign module, the instructions to report including at least one of (i) instructions to cause a display device to display a report describing the at least one security vulnerability, (ii) instructions to store the report describing the at least one security vulnerability in a file and (iii) instructions to electronically transmit the report describing the at least one security vulnerability.

8. The system of claim 7, wherein the instructions to perform the penetration testing campaign include instructions to select, according to the automatically selected one lateral movement strategy, a network node of the networked system to be the next network node to be attacked by the attacker of the penetration testing campaign.

9. The system of claim 7, wherein the set-up non-transitory computer readable storage medium further includes stored instructions, to be carried out prior to carrying out of said instructions to automatically select, to receive, via a user interface associated with the set-up module, one or more manually-entered inputs explicitly instructing the penetration testing system to make the automatic selection randomly.

10. The system of claim 7, wherein the set-up non-transitory computer readable storage medium further includes stored instructions, to be carried out prior to carrying out of said instructions to automatically select, to determine the group of multiple lateral movement strategies that are available for use in the penetration testing campaign.

11. The system of claim 10, wherein the instructions to determine the group of multiple lateral movement strategies comprise instructions to retrieve the group of multiple lateral movement strategies from a non-volatile storage device functionally accessible to the set-up module.

12. The system of claim 10, wherein:

(i) the set-up module is functionally associated with a user interface, and (ii) the instructions to determine the group of multiple lateral movement strategies comprise;

a. instructions to display, by the set-up module and via the user interface, a second group of multiple lateral movement strategies, the second group of multiple lateral movement strategies including the lateral movement strategies in the group of multiple lateral movement strategies;

b. instructions to receive, by the set-up module and via the user interface, one or more manually-entered inputs explicitly selecting a sub-group of the second group of multiple lateral movement strategies; and

c. instructions to define the group of multiple lateral movement strategies from which the one lateral movement strategy is automatically selected to be the selected sub-group.