Virtual penetration testing with phase based vulnerability analysis

Download
index.pdf
2015
Çalışkan, Emre
Show full item record
186
views
117
downloads
Vulnerability scanning, penetration testing, and manual auditing are ways of finding vulnerabilities in organizations. However, they have some limitations like time, accuracy, testers’ ability, etc. Virtual penetration testing aims to alleviate these limitations. By virtual penetration testing, it is intended to assess security controls corresponding to the vulnerabilities found by vulnerability scanning, and correlating assessment result with vulnerabilities. Consequently, correlation will enable to find exploitable vulnerabilities and to make a reliable prioritization between the vulnerabilities. Since security control assessments are done in compliance with the cyber-attack phases, obtained results provide opportunity to create possible attack paths. In order to realize virtual penetration testing, a generic cyber-attack model is proposed and an experiment lab is established. In the experiment, security controls, corresponding to the attack phases, are tested. As a result of experiment, it is observed that, limitations of vulnerability scanning and penetration testing can reduced by using virtual penetration testing.
Cyberterrorism., Computer crimes., Data protection., Computer security., Computer networks
http://etd.lib.metu.edu.tr/upload/12619306/index.pdf
https://hdl.handle.net/11511/25036
Graduate School of Informatics, Thesis

Suggestions

Creating application security layer based on resource access decision service
Metin, Mehmet Özer; Şener, Cevat; Department of Computer Engineering (2007)
Different solutions have been used for each security aspects (access control, application security) to secure enterprise web applications. However combining "enterprise-level" and "application-level" security aspects in one layer could give great benefits such as reusability, manageability, and scalability. In this thesis, adding a new layer to n-tier web application architectures to provide a common evaluation and enforcement environment for both enterprise-level and application level policies to bring tog...
Security of certificate-based protocols: focus on server authentication
Baran, Selim; Özbudak, Ferruh; Selçuk, Ali Aydın; Department of Cryptography (2015)
Today, secure communication channels are mostly set up via certificate-based protocols, such as Secure Sockets Layer (SSL) and Transport Layer Security (TLS). Although they have been used for years and in so many areas, from e-commerce and internet banking to secure channel needs in military, there have been several attacks on their security model, which forced researchers to make studies on them. In this thesis, we will explain their security model, the vulnerabilities discovered so far, the precautions fo...
A faster intrusion detection method for high-speed computer networks
Tarım, Mehmet Cem; Schmidt, Şenan Ece; Department of Electrical and Electronics Engineering (2011)
The malicious intrusions to computer systems result in the loss of money, time and hidden information which require deployment of intrusion detection systems. Existing intrusion detection methods analyze packet payload to search for certain strings and to match them with a rule database which takes a long time in large size packets. Because of buffer limits, packets may be dropped or the system may stop working due to high CPU load. In this thesis, we investigate signature based intrusion detection with sig...
Specification and verification of confidentiality in software architectures
Ulu, Cemil; Oğuztüzün, Mehmet Halit S.; Department of Computer Engineering (2004)
This dissertation addresses the confidentiality aspect of the information security problem from the viewpoint of the software architecture. It presents a new approach to secure system design in which the desired security properties, in particular, confidentiality, of the system are proven to hold at the architectural level. The architecture description language Wright is extended so that confidentiality authorizations can be specified. An architectural description in Wright/c, the extended language, assigns...
A Survey about the integration of social engineering attacks with cyber security exploiting Turkish vulnerabilities in Turkey
Tosun, Adem; Baykal, Nazife; Department of Information Systems (2015)
Many organizations have been seeking for comprehensive and applicable security policies to regulate their security aspects. As it is a well-known issue, the weakest link of chain in Cyber security is human being and it cannot be measured easily as its being intangible. Organizations may invest millions of dollars to build technically secure systems by installing high level trusted software programs or devices. History has shown that these kind of measures neither has been that much successful or effective i...
Citation Formats
E. Çalışkan, “Virtual penetration testing with phase based vulnerability analysis,” M.S. - Master of Science, Middle East Technical University, 2015.
METU IIS - Integrated Information Service open@metu.edu.tr