Systems, Methods, And Storage Media For Conducting Security Penetration Testing
AssigneeCerner Innovation, Inc.
InventorsRajiv Chhetri, Karthickprakash Selvaraj
Life of this patent
Estimating the term…
Abstract
Methods, systems, and computer-readable media are disclosed herein that conduct security penetration testing. In accordance with embodiments, a security extension is run in a web browser in order to record a user interface workflow and to generate a test script of the user interface workflow. The test script is executed in an application in order to perform penetration testing of the user interface workflow, in some embodiments. Based on the outcomes of the penetration testing, a security report may be generated in order to identify one or more security vulnerabilities in the user interface workflow.
Claims20
A system having one or more hardware processors configured to perform a plurality of operations, the operations comprising:
- receiving, at a communication device associated with the one or more hardware processors and communicatively coupled to a network, a plurality of instruction modules transferred from one or more computing platforms over the network to the communication device, the plurality of instruction modules comprising (i) a security extension loading module, (ii) a security extension enabling module, and (iii) modules selected from a group comprising a workflow recordation module, a test script generation module, a test script execution module, a cyber-attack simulation module, a security vulnerability identification module, a report generation module, a schedule module, and a database population module;
- assimilating, by the communication device, module content associated with the plurality of instruction modules, wherein assimilating the module content comprises:
- analyzing the plurality of instruction modules and integrating the plurality of instruction modules to create a security penetration testing application (SPTA) configured to perform penetration testing operations;
- determining, by the communication device using the one or more hardware processors, a test-event execution schedule for the SPTA;
- and
- executing, by the communication device in accordance with the test-event execution schedule, a plurality of test events using the SPTA, wherein executing the plurality of test events comprises:
- configuring a plurality of application programming interfaces (APIs) for the plurality of test events;
- and
- initiating, using the plurality of APIs, a plurality of API calls corresponding to the plurality of test events to a corresponding plurality of target devices.
One or more non-transitory media having computer-readable instructions that, when executed by one or more hardware processors, cause the one or more hardware processors to perform a plurality of operations, the operations comprising:
- receiving, at a communication device associated with the one or more hardware processors and communicatively coupled to a network, a plurality of instruction modules transferred from one or more computing platforms over the network to the communication device, the plurality of instruction modules comprising (i) a security extension loading module, (ii) a security extension enabling module, and (iii) modules selected from a group comprising a workflow recordation module, a test script generation module, a test script execution module, a cyber-attack simulation module, a security vulnerability identification module, a report generation module, a schedule module, and a database population module;
- assimilating, by the communication device, module content associated with the plurality of instruction modules, wherein assimilating the module content comprises:
- analyzing the plurality of instruction modules and integrating the plurality of instruction modules to create a security penetration testing application (SPTA) configured to perform penetration testing operations;
- determining, by the communication device using the one or more hardware processors, a test-event execution schedule for the SPTA;
- and
- executing, by the communication device in accordance with the test-event execution schedule, a plurality of test events using the SPTA, wherein executing the plurality of test events comprises:
- configuring a plurality of application programming interfaces (APIs) for the plurality of test events;
- and
- initiating, using the plurality of APIs, a plurality of API calls corresponding to the plurality of test events to a corresponding plurality of target devices.
A computer-implemented method performed by one or more hardware processors, the computer-implemented method comprising:
- receiving, at a communication device associated with the one or more hardware processors and communicatively coupled to a network, a plurality of instruction modules transferred from one or more computing platforms over the network to the communication device, the plurality of instruction modules comprising (i) a security extension loading module, (ii) a security extension enabling module, and (iii) modules selected from a group comprising a workflow recordation module, a test script generation module, a test script execution module, a cyber-attack simulation module, a security vulnerability identification module, a report generation module, a schedule module, and a database population module;
- assimilating, by the communication device, module content associated with the plurality of instruction modules, wherein assimilating the module content comprises:
- analyzing the plurality of instruction modules and integrating the plurality of instruction modules to create a security penetration testing application (SPTA) configured to perform penetration testing operations;
- determining, by the communication device using the one or more hardware processors, a test-event execution schedule for the SPTA;
- and
- executing, by the communication device in accordance with the test-event execution schedule, a plurality of test events using the SPTA, wherein executing the plurality of test events comprises:
- configuring a plurality of application programming interfaces (APIs) for the plurality of test events;
- and
- initiating, using the plurality of APIs, a plurality of API calls corresponding to the plurality of test events to a corresponding plurality of target devices.
Dependencies are inferred from the claim text.