Emulacija napadača na usluge u oblaku za potrebe penetracijskog testiranja

master's thesis

• Title (english): Emulating attackers on cloud services for penetration testing
• Author: Luka Raspudić
• Mentor: Stjepan Groš (mentor)
• Committee member: Stjepan Groš (predsjednik povjerenstva)
• Committee member: Vladimir Čeperić (član povjerenstva)
• Committee member: Dejan Škvorc (član povjerenstva)
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; Zagreb
• Defense date and country: 2024-09-20, Croatia

Abstract

Ovaj rad se bavio sigurnosti Cloud usluga, na temelju incidenata zabilježenih na internetu te njihovih zapisa o propustima, shvatiti koliki opseg ranjivosti je s pružateljeve
strane, a koliki opseg s krivoga korisničkoga korištenja. Na temelju pronađenih incidenata napravljene su simulacije pomoću platforme Cyber Conflict Simulator (CCS). Apstraktniji način rada CCS-a omogućava da se incidenti prokuhaju na dva slučaja. Prvi scenarij je napad na server bez autentifikacije i autorizacije, a drugi scenarij je napad na server sa slabom autentifikacijom. Rezultati su pokazali da je Cloud usluga sigurna, a najslabija točka je razvojni tim s prečacima koji se suprostavljaju sigurnosnim preporukama. Mogući razlog je neznanje tehnologije (važnost pristupnog ključa, javno dostupna postavka) što je veliki propust za bilo koju tehnologiju.

Abstract (english)

This paper’s purpose was to address security of Cloud services by analyzing incidents found on the internet, to understand the magnitude of flaws from provider’s side to client’s wrongful use. Based on the incidents found, simulations were made with the help of Cyber Conflict Simulator (CCS) platform. By functioning on the more abstract level, CCS allows the incidents to boil down into two scenarios. The first scenario is an attack on a server without authentication and authorization, and a second scenario is an attack on a server with weak authentication. The results showed that Cloud services are secure, the weakest link is the development team with cutting corners that are against safety recommendations. A possible reason is a lack of understanding how Cloud technology operates (importance of access keys, publicly available setting) which is a significant flaw for any technology.

• Keywords: emulacija; napadanje; penetracijsko testiranje; CCS; Cyber Conflict Simulator; računarstvo u oblaku
• Keywords (english): emulation; attack; penetration testing; CCS; Cyber Conflict Simulator; Cloud computing
• Language: croatian
• URN:NBN: urn:nbn:hr:168:757465
• Study programme: Title: Computing; Study programme type: university; Study level: graduate; Academic / professional title: magistar/magistra inženjer/inženjerka računarstva (magistar/magistra inženjer/inženjerka računarstva)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Closed access
• Created on: 2024-11-07 05:42:15