Enhancing Security Testing via Automated Replication of IT-Asset Topologies

Abstract

Security testing of IT-infrastructure in a production environment can have a negative impact on business processes supported by IT-assets. A testbed can be used to provide an alternate testing environment in order to mitigate this impact. Unfortunately, for small and medium enterprises, maintaining a physical testbed and its consistency with the production environment is a cost-intensive task. In this paper, we present the Infrastructure Replication Process (IRP) and a corresponding Topology Editor, to provide a cost-efficient method that makes security testing in small and medium enterprises more feasible. We utilize a virtual environment as a testbed and provide a structured approach that takes into account the differences between a physical and a virtual environment. Open standards, such as SCAP, OVAL or XCCDF, and the utilization the Interconnectedasset Ontology-IO-support the integration of the IRP into existing (automated) processes. We use the implementation of a prototype to present a proof-of-concept that shows how typical challenges regarding security testing can be successfully mitigated via the IRP.

Improving root cause failure analysis in virtual networks via the interconnected-asset ontology

“…This method is used as a substitute for introducing real misconfiguration and for using real active probes with ICMP in the existing infrastructure. The work presented in [5] and [6] shows that this approach is feasible and the proof-ofconcept presented in this paper produces results identical to actual emitting ICMP probes in the production network that is represented.…”

“…Parallelizing active probes according to available processing resources can mitigate this effect. Reachability could be inferred completely without any active probing using the IO-framework exclusively, but the representation provided by the IO-framework, which is acquired as a snapshot [6], could already be outdated. In this case, the misconfiguration leading to the degradation of availability cannot be inferred.…”

“…In contrast, the Interconnected-asset Ontology (IO) focuses on the acquisition of context information about the network topology [3,5,6]. This includes metadata, such as administrative domain and location, and endpoint attributes, such as specific policies and rules.…”