As you may know, modern software architecture works far better than ever. It is no doubt more adaptable, data-intensive, and fast than its predecessors. However, it is a real challenge — especially in modern times — to safeguard the same software from online threats (also known as cyberattacks). Since software systems power everything nowadays — from mobile devices to safety cameras, from smart cars to smart homes, and from manufacturing plants to nuclear power stations, modern software is too crucial to get breached or hacked.
For example, a nuclear power plant in Kudankulam, India was hacked in October 2019. The attack used a malware programmed for data extraction, but the plant’s internal network was uncompromised, fortunately. If the malware could have breached the internal network, it could have stolen crucial data about the power plant, thus intruding into the country’s critical infrastructure. Moreover, if the attack had the goal of taking control of the power plant and had been successful in its plan, it could have done immense damage by overpowering the plant.
Fortunately, there was no critical damage done. However, India — or any country in that case — may not be so lucky in the future. That is the reason modern software must be built from the ground up keeping its security in mind. Also, it must be regularly tested for security bugs and vulnerabilities. However, application security testing is a costly process, and thus, automated testing is the need of the hour. Among the automated testing strategies, one of the most common and effective solutions is known as automated penetration testing.
Automated Penetration Testing
Refers to the process of launching simulated attacks on a network or system automatically for finding security bugs and vulnerabilities. The goal is to find the vulnerabilities and fix them before cybercriminals come to know about and exploit them. It is usually a part of a complete cybersecurity audit, which may be required for compliance and legal reasons. For instance, PCI DSS (Payment Card Industry Data Security Standard) asks organizations to perform pentesting on a regular schedule.
Automated pentesting is performed using software, unlike manual penetration testing which is performed by cybersecurity experts. Since it is performed by software, it is limited by the scope of the given software, which is limited by the knowledge and skills of the security professionals designing the software. Moreover, it proves less effective for new threats since it only identifies or tests for the known vulnerabilities, which makes it ineffective against unknowns.
“This is where artificial intelligence comes in – the automation that you can achieve through artificial intelligence could well help make pentesting much easier to do consistently and at scale. In turn, this would help organizations tackle both issues of skills and culture, and get serious about their cybersecurity strategies,” wrote Packt Hub. Artificial intelligence helps scale the automated pentesting process while enhancing its scanning features for unknown vulnerabilities.
Artificial Intelligence and its Impact
With the progress of artificial intelligence in recent decades, automation experts and computer scientists are trying to automate everything with cyber-defense technologies being no exception. For instance, there are many automated tools that complement penetration testing tools for providing intelligent reports. These automated solutions have some basic artificial intelligence capabilities, but it is gradually growing, thanks to ongoing research and open competitions.
For example, Cyber Grand Challenge 2016 — a DARPA-sponsored competition — challenged people to build and compete with hacking bots. These artificially intelligent bots perform penetration testing to search for and patch security vulnerabilities before the competing teams could exploit them. Its winner — known as Mayhem — could find, fix, and look for intrusions on its host system while finding and exploiting security vulnerabilities on competitive systems.
That said, artificial intelligence helps improve the efficiency of cyber-defense solutions — especially penetration testing solutions. The reason being it helps improve various stages of automated penetration testing as described below.
Stage 1: Planning
The first stage — planning and reconnaissance — is gathering information about the target. And it takes a lot of resources since the more information you gather, the more chance you have at getting successful. At this stage, using AI helps provide better results with less amount of resources. AI along with Computer Vision and Natural Language Processing can help build a complete profile about the target organization and its employees, network, security posture, etc.
Stage 2: Scanning
The second stage asks for comprehensive coverage of the target systems. That is, you must scan for hundreds if not thousands of computers and other devices and analyze the results. Using AI, the tools can be tweaked to intelligently scan the devices and gather the required results, simplifying the analysis process.
Stage 3: Gaining Access
The third stage is gaining access to one of the target networks or systems. This compromised system can then be used to extract data or launch attacks on the other systems in the network. Using AI, the tools can try out a variety of attacks and numerous password combinations for gaining access. Then, they can also use algorithms to find weak patterns or trends that may get compromised.
Stage 4: Maintaining Access
The fourth stage is maintaining access to the compromised system. Using AI, the tools can look for known or unknown backdoors, encrypted channels, and keep an eye on accounts and logs to detect and report suspicious or unauthorized activities. For example, a new administrator account or network access channel may direct toward a compromised system and/or unauthorized access.
Stage 5: Analysis And Reporting
The last stage is testing if an unauthorized entity can cover tracks, i.e., delete history and logs from your systems, making it impossible to detect attacks. Using AI, the tools can detect hidden backdoors, unauthorized access endpoints, etc. Also, these tools can better analyze error messages and system logs to find errors, missing entries, or other suspicious activities. Finally, this analysis is put on an easy-to-read report detailing the complete test results of the target.
