Security testing device and security testing method

Abstract

To reduce the time required to conduct a test.SOLUTION: When a prior attack on an information system 2 being tested according to a test scenario is followed by a subsequent attack according to a different test scenario, an influence determination unit 10 determines whether results of the subsequent attack will be affected by the prior attack. This determination is made before the commencement of the prior attack. When the influence determination unit 10 determines that the results of the subsequent attack will be affected as described above, a backup unit 20 backs up a memory area of the information system 2 before the commencement of the prior attack. After the completion of the prior attack and before the commencement of the subsequent attack, a restoration unit 50 restores the memory area of the information system 2 using the backup obtained by the backup unit 20.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a security test execution device and a security test execution method. [Background technology]

[0002] BACKGROUND ART Several techniques are known for implementing tests to detect vulnerabilities in information systems and for managing those vulnerabilities (see, for example, Patent Documents 1 to 5). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2023-101201 [Patent Document 2] Japanese Patent Application Publication No. 2023-87212 [Patent Document 3] Japanese Patent Application Publication No. 2020-160611 [Patent Document 4] Japanese Patent Application Publication No. 2020-129166 [Patent Document 5] Japanese Patent Publication No. 2020-21309 Summary of the Invention [Problem to be solved by the invention]

[0004] Some attack scenarios implemented as part of security testing to discover vulnerabilities in information systems may involve the destruction of memory areas or changes to software configurations in the system under test. To ensure the reproducibility of such security tests, it is necessary to perform a restoration process after each test to undo the changes made to the test target, which is time-consuming. [Means for solving the problem]

[0005] A security test execution device according to one embodiment includes an impact assessment unit, a backup unit, and a restoration unit. When a subsequent attack according to a test scenario different from a previous attack is performed on an information system to be tested, the impact assessment unit determines whether the results of the subsequent attack will be affected by the previous attack. This determination is made before the start of the previous attack. When the impact assessment unit determines that the results of the subsequent attack will be affected as described above, the backup unit backs up the memory area of ​​the information system before the start of the previous attack. After the previous attack has ended and before the start of the subsequent attack, the restoration unit restores the memory area of ​​the information system using the backup acquired by the backup unit. [Effects of the Invention]

[0006] According to the above aspect, the time required to perform the test can be reduced. [Brief explanation of the drawings]

[0007] [Figure 1] FIG. 1 illustrates a configuration of a security test execution device as an example of an embodiment. [Figure 2] FIG. 10 is a diagram illustrating an example of data in a test scenario DB. [Figure 3] FIG. 10 is a diagram illustrating an example of data in a test tool information DB. [Figure 4] FIG. 10 is a diagram illustrating an example of data in a test target information DB. [Figure 5] FIG. 2 is a diagram illustrating an example of a hardware configuration of an information processing device. [Figure 6] 10 is a flowchart illustrating an example of a security test execution process. [Figure 7] 10 is a flowchart illustrating an example of a reproducibility influence determination process; DETAILED DESCRIPTION OF THE INVENTION

[0008] The V-model is known as one model that represents the flow of information system development. Security testing is carried out during acceptance testing, which is the verification phase of requirements analysis in this V-model. One type of security testing is penetration testing. Penetration testing is a method of verifying the presence or absence of vulnerabilities by simulating the actions of an attacker and actually attempting to infiltrate an information system using known technologies.

[0009] Penetration testing makes it possible to check the vulnerabilities present in the information system being tested and the attack resistance of the information system being tested. It also makes it possible to provide the information system development department with the information to decide what countermeasures are necessary to address vulnerabilities. However, in order to do this, it is important to ensure that the same results are obtained when tests are conducted on the same test target using the same test scenario (the attack method used to penetrate the test target), in other words, that the reproducibility of the test is guaranteed.

[0010] To ensure test reproducibility, it is necessary to conduct tests under the same preconditions for each independent test scenario, such as ensuring that the data in the memory area of ​​the information system being tested has the same content.

[0011] For example, if the version of software used by an information system that is the target of a penetration test to operate its services changes due to the implementation of an attack according to Scenario A, the service may not operate normally after the attack. In this case, the results of the attack according to Scenario B may change depending on whether the attack according to Scenario B is implemented before or after the attack according to Scenario A. In this way, if a subsequent attack according to a different test scenario is implemented after a previous attack according to a test scenario, and the results of the subsequent attack are affected by the previous attack, the reproducibility of the test cannot be guaranteed.

[0012] To ensure the reproducibility of tests that follow such test scenarios, it is sufficient to perform a restoration process after each test to return the changes made to the test target to the state before the test began. However, this restoration process is cumbersome, and as a result, it takes a lot of time to perform the tests.

[0013] Therefore, in this embodiment, when a subsequent attack according to a different test scenario is performed following a previous attack on an information system under test, it is determined before the start of the previous attack whether the results of the subsequent attack will be affected by the previous attack. If it is determined that the results of the subsequent attack will be affected by the previous attack, a backup of the memory area of ​​the information system is taken before the start of the previous attack. Then, after the previous attack is completed and before the start of the subsequent attack, the memory area is restored using the backup. By automatically restoring the memory area of ​​the information system in this manner, even if a subsequent attack is performed following a previous attack, the results of the subsequent attack will not be affected by the previous attack. Therefore, test reproducibility is ensured and the time required to perform the test is reduced.

[0014] Hereinafter, the present embodiment will be described in detail with reference to the drawings.

[0015] FIG. 1 shows the configuration of a security test execution device 1 as an example of an embodiment.

[0016] In this embodiment, the security test execution device 1 executes a penetration test, which is one type of security test, on a test target information system 2. Note that a service program that provides services running on the information system 2 is executed in the information system 2.

[0017] The security test execution device 1 includes an impact determination unit 10, a backup unit 20, a backup storage 30, a test execution unit 40, a restoration unit 50, a test scenario DB 60, a test tool information DB 70, and a test target information DB 80. Note that "DB" is an abbreviation for database.

[0018] When a subsequent attack according to a test scenario different from a previous attack on an information system 2 is carried out following a previous attack according to the test scenario, the influence determination unit 10 determines whether the result of the subsequent attack will be affected by the previous attack before the start of the previous attack.

[0019] In this embodiment, the influence determination unit 10 includes a conflict determination unit 11 and an influence possibility determination unit 12 .

[0020] The conflict determination unit 11 determines whether the software on which the service program that provides the service running on the information system 2 and the test tool program used in the preceding attack each depend conflicts. If the conflict determination unit 11 determines that the software conflicts, the influence determination unit 10 determines that the result of the subsequent attack will be affected by the above-mentioned influence. In other words, if the conflict determination unit 11 determines that the software conflicts, the influence determination unit 10 determines that the test scenario followed by the preceding attack will affect the reproducibility of a test using another test scenario.

[0021] The influence possibility determination unit 12 determines whether a preceding attack has the possibility of affecting the results of a subsequent attack that follows the preceding attack. In other words, the influence possibility determination unit 12 determines whether a preceding attack according to a test scenario has the possibility of affecting the reproducibility of a test according to another test scenario.

[0022] If the influence possibility determination unit 12 determines that the preceding attack has the possibility of affecting the results of the subsequent attack, the conflict determination unit 11 determines whether or not there is a conflict between the software on which the service program and the test tool program each depend. If the conflict determination unit 11 determines that there is a software conflict, the influence determination unit 10 concludes that the results of the subsequent attack will be affected by the preceding attack. On the other hand, if the influence possibility determination unit 12 determines that there is no possibility that the preceding attack has the possibility of affecting the results of the subsequent attack, the influence determination unit 10 immediately determines that the results of the subsequent attack will not be affected by the aforementioned influence, without performing a determination by the conflict determination unit 11.

[0023] When the impact determination unit 10 determines that the result of a subsequent attack will be affected as described above, the backup unit 20 backs up the memory area of ​​the information system 2 and stores it in the backup storage 30 before the start of the preceding attack.

[0024] In this embodiment, the backup unit 20 backs up the memory area of ​​the information system 2 using a backup method selected depending on the content of the preceding attack. For example, if the test scenario is a scenario in which an attack such as a buffer overflow attack is carried out that will cause the information system 2 being tested to completely stop functioning after the test, the backup unit 20 selects full backup as the backup method. In this case, the backup unit 20 backs up the stored data in the entire memory area of ​​the information system 2. Furthermore, if the impact of the attack by the test scenario, as will be described later, is limited to a minor effect, such as changing only part of the stored data in the memory area of ​​the information system 2, the backup unit 20 selects partial backup as the backup method. In this case, the backup unit 20 creates a snapshot of the area of ​​the memory area of ​​the information system 2 where the stored data will be changed (backs up the stored data).

[0025] Generally, there is a problem that not only does it take a long time to take a full backup, but the subsequent restoration from the full backup also takes a long time. Taking a full backup also increases the amount of backup data, which can cause a problem of straining the backup storage 30. Therefore, as in the backup unit 20 of this embodiment, when it is possible to restore the original state without taking a full backup, partial backup is selected as the backup method, thereby reducing the occurrence of such problems.

[0026] The test execution unit 40 executes an attack according to the test scenario against the information system 2. In this embodiment, the test execution unit 40 executes the above-mentioned subsequent attack following the above-mentioned preceding attack.

[0027] After the preceding attack by the test execution unit 40 is completed and before the subsequent attack is initiated, the restoration unit 50 restores the memory area of ​​the information system 2 to the state before the preceding attack was initiated, using the backup stored in the backup storage 30 by the backup unit 20.

[0028] Here, an example of a security test performed by the security test execution device 1 will be described.

[0029] In this embodiment, it is assumed that the information system 2 to be tested includes two server devices: a first server device and a second server device. Furthermore, it is assumed that the security test execution device 1 can access only the first server device, and that the second server device can be accessed only from the first server device. Furthermore, it is assumed that the first server device is running a service program for providing a service, and that this service program is written in Python 2, a version of Python (registered trademark), a well-known programming language. In other words, this service program can be executed in a Python 2 execution environment, and Python 2 in this case is software on which the service program depends.

[0030] Under the above assumptions, in this embodiment, the security test execution device 1 performs an attack (preceding attack) on the information system 2 according to a test scenario in which the security test execution device 1 remotely controls a first server device to perform a network scan for intrusion into a second server device. Note that a test tool program is installed in the first server device to perform this network scan, and this test tool program is written in Python3, which is another version of Python mentioned above. In other words, this test tool program can be executed in a Python3 execution environment, and Python3 in this case is software on which the test tool program depends.

[0031] When the security test execution device 1 performs this attack on the information system 2, the test execution unit 40 first obtains access rights to the first server device. Next, the test execution unit 40 installs a test tool program on the first server device. After that, the test execution unit 40 causes the first server device to execute the installed test tool program, thereby performing a network scan of the second server device.

[0032] However, when the test execution unit 40 installs the test tool program, it also installs Python3 as a runtime library for the test tool program. This is because Python3, on which the test tool program depends, is required to run the test tool program on the first server device. However, once Python3 is installed on the first server device, service programs that depend on Python2 cannot be executed on the first server device. The same applies to attacks based on other test scenarios (subsequent attacks). In other words, the above-mentioned test scenarios affect the reproducibility of tests based on other test scenarios that are performed following an attack based on the current test scenario.

[0033] Therefore, in the security test execution device 1, the impact possibility determination unit 12 first determines whether an attack (network scan) according to a test scenario has software dependency. In the test scenario of this embodiment, the test tool program used in this attack depends on Python3, so the impact possibility determination unit 12 determines that an attack according to the test scenario may affect the reproducibility of a test in another test scenario.

[0034] When the impact possibility determination unit 12 determines that there is a possibility that the reproducibility of another test scenario will be affected, the conflict determination unit 11 then determines whether the software on which the service program and the test tool program each depend conflicts. In this embodiment, the service program depends on Python 2, and the test tool program depends on Python 3. In other words, the service program and the test tool program depend on different versions of the same software. In this case, the conflict determination unit 11 determines that the software on which the service program and the test tool program each depend conflicts.

[0035] In this embodiment, when the conflict determination unit 11 determines that there is a software conflict, the influence determination unit 10 determines that the reproducibility of a test in another test scenario performed following an attack (network scan) according to the test scenario will be affected. Then, before the test execution unit 40 starts the attack according to the test scenario of this embodiment, the backup unit 20 backs up the memory area of ​​the first server device of the information system 2 and stores it in the backup storage 30. The attack according to the test scenario of this embodiment is a network scan, and its impact is limited to changing only part of the data stored in the memory area due to the installation of the test tool program and Python3. Therefore, in this embodiment, the backup unit 20 selects a partial backup as the backup method and backs up the memory area of ​​the first server device.

[0036] Next, the test scenario DB 60, the test tool information DB 70, and the test target information DB 80 provided in the security test execution device 1 of this embodiment will be described.

[0037] FIG. 2 shows an example of data in the test scenario DB 60.

[0038] The test scenario DB 60 is a database in which information about each test scenario is stored for each record. More specifically, the test scenario DB 60 stores, for each record, information about the "test scenario" and information about the "attack method," "attack details," "possibility of affecting reproducibility," "remarks," and "backup method," in association with each other.

[0039] "Test scenario" is identification information of a test scenario, and the record in which this identification information is stored stores various pieces of information related to the test scenario identified by this identification information.

[0040] "Attack method" is information that specifies the method of attack on the information system 2, for example, information on the name of the attack.

[0041] The "attack details" is information that indicates the specific technique of the attack method specified in the "attack method." This information includes, for example, information that indicates the test tool program used to carry out the attack specified in the "attack method."

[0042] "Possibility of impact on reproducibility" is information (impact possibility information) that indicates whether an attack carried out against information system 2 using the method indicated in "Attack details" has the potential to affect the reproducibility of tests in subsequent test scenarios.

[0043] "Notes" is information indicating the actions required to implement the technique indicated in "Attack Details," which are the basis for the "possibility of affecting reproducibility." This information includes, for example, information about the software on which the test tool program indicated in the "Attack Details" information depends.

[0044] "Backup method" is information (method information) that indicates the backup method that the backup unit 20 will use when an attack on the information system 2 using the method indicated in "Attack content" affects the reproducibility of tests in subsequent test scenarios.

[0045] In this embodiment, the information related to these test scenarios stored in the test scenario DB 60 is created by the creator of the test scenario. The test execution unit 40 reads the information of each record in the test scenario DB 60 one by one and executes an attack on the information system 2 using the test scenario indicated by the information indicated in each record. Furthermore, the impact possibility determination unit 12 determines whether there is a possibility of impacting the reproducibility of tests in subsequent test scenarios based on the information on "possibility of impacting reproducibility" associated with the identification information of the "test scenario" in the test scenario DB 60. Furthermore, the backup unit 20 selects the method indicated by the information on "backup method" associated with the identification information of the "test scenario" in the test scenario DB 60 and backs up the memory area of ​​the information system 2.

[0046] Next, a description will be given of Fig. 3. Fig. 3 shows an example of data in the test tool information DB 70.

[0047] The test tool information DB 70 is a database that stores information related to the test scenario DB 60 and information about the test tool programs used to execute attacks in the test scenarios. More specifically, the test tool information DB 70 associates information about a "tool name" and a "dependent library" for each record.

[0048] "Tool name" is identification information for a test tool program, and more specifically, information on the name of the test tool program.

[0049] "Dependent library" is information about the name and version of a program library, which is software on which the test tool program specified by "tool name" depends.

[0050] In this embodiment, the information stored in the test tool information DB 70 is created by the creator of the test scenario who stored each piece of information about the test scenario in the test scenario DB 60.

[0051] Next, a description will be given of Fig. 4. Fig. 4 shows an example of data in the test target information DB 80.

[0052] The test target information DB 80 is a database that stores information about the information system 2 that is the test target for which the security test is performed by the security test execution device 1. More specifically, the test target information DB 80 stores information about the "OS," "CPU," "memory," "storage," "interface," "IP address," and "operating service."

[0053] "OS" is information that identifies the operating system used by the information system 2, and more specifically, is information about the name and version of the operating system.

[0054] "CPU" is information about the number of CPUs provided in the information system 2. "CPU" is an abbreviation for Central Processing Unit.

[0055] "Memory" is the capacity of the memory device provided in the information system 2.

[0056] “Storage” is the capacity of the storage device that the information system 2 has.

[0057] “Interface” is information about the communication interface used by the information system 2.

[0058] "IP address" is the IP address assigned to the information system 2. "IP" is an abbreviation for Internet Protocol.

[0059] "Operating services" is information about services running in information system 2, and includes information about "service names" and "dependent libraries." "Service names" are identification information for the service programs that provide the services, and more specifically, information about the names of the service programs. "Dependent libraries" are information about the names and versions of program libraries, which are software on which the service programs identified by "service names" depend.

[0060] As described above, the conflict determination unit 11 determines whether the software on which a service program that provides a service running on the information system 2 and a test tool program used in a preceding attack depend conflicts. The conflict determination unit 11 makes this determination based on the information stored in the test target information DB 80 and the information stored in the test tool information DB 70. That is, the conflict determination unit 11 acquires information on the name and version of the software on which the service program depends from the “Dependent Library” item for the service program stored in the test target information DB 80. The conflict determination unit 11 also acquires information on the name and version of the software on which the test tool program depends from the “Dependent Library” item for the test tool program stored in the test tool information DB 70. Then, based on the acquired information, the conflict determination unit 11 determines whether the service program and the test tool program depend on the same software (software with the same name) but different versions. If it is determined that the two programs depend on the same software but different versions, the conflict determination unit 11 determines that there is a conflict between the software on which the service program and the test tool program depend.

[0061] Next, the hardware configuration of the security test execution device 1 will be described.

[0062] 5 shows an example of the hardware configuration of the information processing device 90. The security test execution device 1 may be configured using this information processing device 90.

[0063] The information processing device 90 is a computer of standard configuration, equipped with the following components: a CPU 91, a memory 92, an input device 93, an output device 94, an auxiliary storage device 95, and a communication I / F 96. All of these components are connected to an internal bus 97, and are configured to enable data exchange between the components. Note that "I / F" is an abbreviation for Interface.

[0064] The CPU 91 controls each component of the information processing device 90 by, for example, using the memory 92 to execute a predetermined program.

[0065] The input device 93 is, for example, a keyboard or pointing device for inputting instructions, or various sensors.

[0066] The output device 94 is used, for example, to display and output various types of information.

[0067] The auxiliary storage device 95 is a non-volatile storage device, such as a flash memory or a hard disk drive. When the security test execution device 1 is configured using the information processing device 90, the auxiliary storage device 95 functions as the backup storage 30 and also functions as the test scenario DB 60, the test tool information DB 70, and the test target information DB 80.

[0068] The communication I / F 96 transmits and receives various data to and from the information system 2 in accordance with instructions sent from the CPU 91 .

[0069] When configuring a security test execution device 1 using an information processing device 90, the information processing device 90 does not need to include all of the components shown in Figure 5, and some components may be omitted depending on the application or conditions.

[0070] Next, a description will be given of a security test execution process performed by the security test execution device 1. Fig. 6 is a flowchart showing the processing contents of an example of the security test execution process.

[0071] When the security test execution device 1 is configured using the information processing device 90, a security test execution program for causing the CPU 91 to perform this security test execution process may be created and the program may be executed by the CPU 91.

[0072] When the processing of Figure 6 starts, first, in S101, the influence determination unit 10 performs a process of reading out each piece of information related to one test scenario stored for each record in the test scenario DB 60, and then in S102, the influence determination unit 10 performs a reproducibility influence determination process.

[0073] The reproducibility impact determination process is a process for determining whether a preceding attack according to a test scenario for which information was acquired by the process of S101 will affect the reproducibility of a test according to another test scenario that is performed following the preceding attack. If this determination determines that the reproducibility of the test according to the other test scenario will be affected, the reproducibility impact determination process determines that a backup of the memory area of ​​the information system 2 will be made. On the other hand, if this determination determines that the reproducibility of the test according to the other test scenario will not be affected, the reproducibility impact determination process determines that a backup will not be made. Details of the reproducibility impact determination process will be described later.

[0074] In S103, the influence determiner 10 determines whether or not a decision to take the above-mentioned backup was made in the reproducibility influence determination process of S102. If it is determined in this determination process that a decision to take a backup was made (if the determination result is YES), the process proceeds to S104. On the other hand, if it is determined in this determination process that a decision not to take a backup was made (if the determination result is NO), the process proceeds to S106.

[0075] In S104, the backup unit 20 performs a process of acquiring information on the "backup method" in Fig. 2 from each piece of information related to the test scenario acquired in the process of S101. Then, in the following S105, the backup unit 20 performs a process of backing up data in the memory area of ​​the information system 2 using the method indicated in the information acquired in the process of S104, and storing the acquired backup in the backup storage 30.

[0076] In S106, the test execution unit 40 performs a process to execute an attack indicated by the "attack method" information in Figure 2 on the information system 2 to be tested, using the method indicated by the "attack content" information in Figure 2, in accordance with the various pieces of information regarding the test scenario obtained by the processing of S101.

[0077] Thereafter, when the attack by the process of S106 is completed, the restoration unit 50 performs a process of determining in S107 whether or not a backup has been acquired by executing the process of S105 described above.

[0078] In the determination process of S107, when it is determined that a backup has been acquired (when the determination result is YES), the process proceeds to S108. Then, in S108, the restoration unit 50 performs a process of restoring the data stored in the memory area of ​​the information system 2 to the state before the attack in the process of S106, using the backup stored in the backup storage 30. Thereafter, the process proceeds to S109.

[0079] On the other hand, if it is determined in the determination process of S107 that a backup has not been acquired (the determination result is NO), the process of S108 is skipped and the process proceeds to S109.

[0080] In S109, the test execution unit 40 performs a process to determine whether attacks have been performed in accordance with all test scenarios whose associated information is stored in the test scenario DB 60 through the process of S106. If it is determined in this determination process that there are test scenarios remaining for which attacks have not been performed (the determination result is NO), the process returns to S101, and the process from S101 is performed again for the test scenarios for which attacks have not been performed. On the other hand, if it is determined in this determination process that attacks have been performed in accordance with all test scenarios (the determination result is YES), the security test execution process ends.

[0081] The above processing is the security test execution processing.

[0082] Next, a description will be given of the details of the reproducibility impact determination process, which is the process of S102 in the security test execution process shown in Fig. 6. Fig. 7 is a flowchart showing the process contents of an example of the reproducibility impact determination process.

[0083] 7 starts, first, in S111, the influence possibility determination unit 12 performs a process of acquiring influence possibility information, i.e., information on the "possibility of affecting reproducibility," from each piece of information related to the test scenario acquired in the process of S101 in Fig. 6. Then, in the following S112, the influence possibility determination unit 12 performs a process of determining, in accordance with the information acquired in the process of S111, whether or not a preceding attack according to the test scenario has the possibility of affecting the reproducibility of a test according to a subsequent test scenario.

[0084] In the determination process of S112, if it is determined that there is a possibility that the reproducibility of the test by the subsequent test scenario will be affected (the determination result is YES), the process proceeds to S113. On the other hand, in the determination process of S112, if it is determined that there is no possibility that the reproducibility of the test by the subsequent test scenario will be affected (the determination result is NO), the process proceeds to S117.

[0085] In S113, the impact possibility determination unit 12 performs a process of determining whether or not the execution of an attack according to the test scenario, for which each piece of information has been acquired by the process of S101 in Fig. 6, has the potential to completely disable the information system 2 being tested. In this embodiment, the impact possibility determination unit 12 makes this determination based on whether or not the information on "backup method" among the pieces of information acquired by the process of S101 in Fig. 6 indicates a full backup.

[0086] In the determination process of S113, if the information on "backup method" indicates a full backup and it is determined that there is a possibility that the test target will be completely disabled (the determination result is YES), the process proceeds to S117. On the other hand, in the determination process of S113, if the information on "backup method" does not indicate a full backup and it is determined that there is no possibility that the test target will be completely disabled (the determination result is NO), the process proceeds to S114.

[0087] In S114, the conflict determination unit 11 performs a process of obtaining, from the test tool information DB 70, information about the test tool program used to perform an attack according to the test scenario for which the information was obtained in the process of S101 in Fig. 6. In this process, information about the test tool program indicated by the information about "attack content" in the process of S101 in Fig. 6 is obtained.

[0088] In S115, the conflict determination unit 11 performs a process of acquiring information about the information system 2 to be tested from the test target information DB 80.

[0089] In S116, the conflict determination unit 11 performs a process to determine whether the test tool program and the service program depend on the same program but different versions, based on the information obtained by the processes of S114 and S115. This determination is performed by comparing the information on "dependent libraries" about the test tool program obtained from the test tool information DB 70 with the information on "dependent libraries" about the information system 2 obtained from the test target information DB 80.

[0090] In the determination process of S116, if it is determined that the test tool program and the service program depend on the same program but different versions (if the determination result is YES), it is determined that there is a conflict between the two, and the process proceeds to S117. On the other hand, in the determination process of S116, if it is determined that the test tool program and the service program do not depend on the same program but different versions (if the determination result is NO), it is determined that there is no conflict between the two, and the process proceeds to S118.

[0091] In S117, the influence determiner 10 performs a process of determining whether to back up the memory area of ​​the information system 2 to be tested, and then ends this reproducibility influence determination process and returns to the security test execution process of FIG.

[0092] In S118, the influence determination unit 10 performs a process to determine not to back up the memory area of ​​the information system 2 being tested, and then ends this reproducibility influence determination process and returns to the security test implementation process of FIG.

[0093] The above-described processing is the reproducibility influence determination processing.

[0094] By performing the above-described processing steps in the security test execution device 1, it becomes possible to execute a security test in a short time.

[0095] Although the disclosed embodiments and their advantages have been described in detail above, it will be appreciated that those skilled in the art may make various modifications, additions, and omissions without departing from the scope of the invention as clearly set forth in the claims. [Explanation of symbols]

[0096] 1. Security test implementation device 2. Information Systems 10 Impact determination section 11 Conflict determination section 12 Impact possibility determination section 20 Backup Department 30 backup storage 40 Test Execution Department 50 Restoration Department 60 Test scenario DB 70 Test Tool Information DB 80 Test subject information DB 90 Information processing equipment 91 CPU 92 memory 93 Input Devices 94 Output Devices 95 Auxiliary storage device 96 Communication I / F 97 Internal Bus

Claims

1. an influence determination unit that, when a subsequent attack according to a test scenario different from a previous attack is performed following a previous attack on an information system to be tested, determines whether or not a result of the subsequent attack is affected by the previous attack before the start of the previous attack; a backup unit that backs up a memory area of ​​the information system before the start of the preceding attack when the influence determination unit determines that the result of the subsequent attack will be affected by the influence; a restoration unit that restores the memory area using the backup after the end of the preceding attack and before the start of the subsequent attack; A security test execution device comprising:

2. The influence determination unit a conflict determination unit that determines whether or not a conflict exists between software programs that depend on a service program that provides a service running on the information system and a test tool program that is used in the preceding attack; If the conflict determination unit determines that the software conflicts, it determines that the result of the subsequent attack will be affected.

2. The security test execution device according to claim 1.

3. a test target information database storing information on software on which the service program depends; a test tool information database in which information on software on which the test tool program depends is stored; Further provided with the conflict determination unit determines whether there is a conflict between software on which the service program and the test tool program depend, based on the information stored in the test target information database and the information stored in the test tool information database.

3. The security test execution device according to claim 2.

4. the test target information database includes identification information and version information about software on which the service program depends; the test tool information database includes identification information and version information about software on which the test tool program depends; the conflict determination unit determines that there is a conflict between the software on which the service program and the test tool program depend, when the service program and the test tool program depend on the same software but different versions of the software; 4. The security test execution device according to claim 3.

5. the influence determination unit further includes an influence possibility determination unit that determines whether the preceding attack has a possibility of affecting the result of the subsequent attack that is performed following the preceding attack, When the influence possibility determination unit determines that there is the possibility, the conflict determination unit determines whether or not there is a conflict between software on which the service program and the test tool program depend, When the influence possibility determination unit determines that there is no possibility, the influence determination unit determines that the result of the subsequent attack will not be affected by the influence.

5. The security test execution device according to claim 2, wherein the security test execution device is a device for executing a security test.

6. a test scenario database in which identification information about the test scenario and influence possibility information indicating the presence or absence of the possibility of an attack in accordance with the test scenario are stored in association with each test scenario, the influence possibility determination unit determines whether the possibility exists based on the influence possibility information stored in the test scenario database in association with identification information for the test scenario.

6. The security test execution device according to claim 5.

7. 5. A security test execution device according to claim 1, wherein the backup unit backs up the memory area using a backup method selected depending on the content of the preceding attack.

8. a test scenario database in which identification information for the test scenario and method information for specifying the backup method are stored in association with each test scenario, the backup unit backs up the memory area using the backup method identified by the method information stored in the test scenario database in association with identification information for the test scenario to which the preceding attack is subject; 8. The security test execution device according to claim 7.

9. When a subsequent attack according to a test scenario different from a previous attack is performed on an information system to be tested following a previous attack according to a test scenario, it is determined before the start of the previous attack whether or not a result of the subsequent attack is affected by the previous attack; When it is determined that the result of the subsequent attack will be affected, backing up a memory area of ​​the information system before the start of the preceding attack; restoring the memory region using the backup after the end of the previous attack and before the start of the subsequent attack; A security test execution method characterized in that the above is performed by a security test execution device.

10. 10. The security test implementation method according to claim 9, wherein the backup is performed using a backup method selected depending on the content of the preceding attack.

Images