Using information about exportable data in penetration testing
AssigneeXM Cyber Ltd.
InventorsRonen Segal, Menahem Lasser
Life of this patent
Estimating the term…
Abstract
Penetration testing campaigns generate remediation recommendations based at least in part on information about files stored in network nodes of the tested networked system. Information is obtained about files stored in a plurality of network nodes of the networked system, and based on the obtained information, a corresponding data-value score for each network node of the plurality of network nodes is determined according to a common data-value metric. The penetration testing campaign is executed, following which one or more remediation recommendations are selected based on the data-value scores corresponding to at least some of the plurality of network nodes.
Claims20
A method for delivering, by a penetration testing system, a recommendation for improving security of a networked system against attackers, the method comprising:
- a. obtaining information about files stored in a plurality of network nodes of the networked system;
- b. based on the obtained information, determining a plurality of data-value scores, each data-value score of the plurality of data-value scores corresponding to a respective network node of the plurality of network nodes, each data-value score of the plurality of data-value scores being determined according to a common data-value metric;
- c. executing a penetration testing campaign for testing the networked system;
- d. determining the recommendation for improving the security of the networked system against attackers, wherein the determining of the recommendation includes selecting one or more network nodes of the networked system that should be protected against being compromised by the attackers, wherein the selecting of the one or more network nodes is based on one or more of the plurality of data-value scores;
- and
- e. performing at least one operation selected from a group consisting of:
- (i) causing a display device to display information about the recommendation for improving the security of the networked system against attackers, (ii) recording the information about the recommendation for improving the security of the networked system against attackers in a file, and (iii) electronically transmitting the information about the recommendation for improving the security of the networked system against attackers.
A penetration testing system configured to carry out a penetration testing campaign for testing a networked system and to deliver a recommendation for improving security of the networked system against attackers based at least in part on information about files stored in network nodes of the networked system, the networked system comprising a plurality of network nodes interconnected by one or more networks, each network node of the plurality of network nodes including one or more processors, the penetration testing system comprising:
- a. a first non-transitory computer-readable storage medium having stored therein first program instructions, wherein execution of the first program instructions by the one or more processors of a given network node of the plurality of network nodes causes the one or more processors of the given network node to collect information about files stored in the given network node;
- b. a computing device comprising one or more processors, the computing device in networked communication with multiple network nodes of the networked system;
- and
- c. a second non-transitory computer-readable storage medium having stored therein second program instructions, wherein execution of the second program instructions by the one or more processors of the computing device causes the one or more processors of the computing device to carry out the following steps:
- i. for each given network node of the plurality of network nodes, performing one operation selected from a group consisting of (A) determining a corresponding data-value score according to a common data-value metric and (B) obtaining the corresponding data-value score according to the common data-value metric, the corresponding data-value score being based on collected information about files stored in the networked system;
- ii. executing the penetration testing campaign;
- iii. determining the recommendation for improving the security of the networked system against attackers, wherein the determining of the recommendation includes selecting one or more network nodes of the networked system that should be protected against being compromised by the attackers, wherein the selecting of the one or more network nodes is based on the corresponding data-value scores for at least some of the plurality of network nodes;
- and
- iv. performing at least one action selected from a group consisting of:
- (A) causing a display device to display information about the recommendation for improving the security of the networked system against attackers, (B) recording the information about the recommendation for improving the security of the networked system against attackers in a file, and (C) electronically transmitting the information about the recommendation for improving the security of the networked system against attackers.
Dependencies are inferred from the claim text.