1. Design and development of a prototypical software for semi-automatic generation of test methodologies and security checklists for IT vulnerability assessment in small- and medium-sized enterprises
Thomas Möller 1, Knut Bellin 2, Reiner Creutzburg 2
1 Assecor GmbH
Storkower Straße 207
D Berlin, Germany
2Brandenburg University of Applied Sciences
IT- and Media Forensics Lab, P.O.Box 2132
D Brandenburg, Germany
Task
The Task is the prototypical development of a program (code name Copra Breeder) that supports a penetration tester by generating checklists with procedures to be performed. These lists are based on predetermined by criteria that are generated and updated during the execution of the penetration test.
Implementation
Copra Breeder was implemented in Python and depicts the procedure according to the OSSTMM. It generates checklists against which security checks can be performed. To perform invasive tests with the program, scripts can be implemented that are loaded dynamically. Copra Breeder can import new information and thus can be extended.
Structure of program
Copra Breeder is modular. The individual modules are dependent only on the value of objects. These modules are: The GUI scripting engine, report generator, central control flow and data storage platforms.
Process
When performing penetration testing, the tester is based on so-called process models that describe the procedure in these tests. The best-known models are those of the BSI, NIST, PTEs and the OSSTMM. The "Open Source Security Testing Methodology Manual" (OSSTMM) is a scientific methodology for determining the operational safety. The tasks are organized hierarchically. There are the following stages: channel module, task (task). The channel is the region which is to be tested. There are five channels: "People", "Physical", “Wireless", “Telecommunications" and "Computer Networks". Modules are categories of tasks that must be performed to check a channel. There are 17 modules. Each channel has the same modules. The tasks are different for each channel. The modules are divided into four phases: induction phase, interaction phase, phase investigation, intervention phase tests.
Applicability
The functionality of the program was tested using scenarios that could be observed in companies. The selected scenarios cover various complexities, so one can test what types can be automated attacks carried out by the program. These scenarios are for example spoofing, hash collision attacks, checks for opens SMB drives, attacks on SMTP and ICQ and the attacks on a mobile devices.
Conclusion
The developed software Copra Breeder in particular, by its automatic and semi-automatic tests is a valuable support for the protection of a corporate networks. As described Copra Breeder for now is only suitable for securing mobile devices, but can be developed further. In particular the tools allows to support a company to implement good BYOD strategies.
SPIE, Mobile Devices and Multimedia: Enabling Technologies, Algorithms, and Applications, San Francisco, February 2015, Vol. 9411