Security testing of modern information systems: selection of effective methods and scenarios for various testing objects

DOI: 10.31673/2409-7292.2023.030909

Abstract

Modern challenges in the field of cyber security require a deep understanding and effective application of various types of security testing. Security testing, as one of the main elements of the cyber security strategy, requires a systematic approach and the selection of optimal test scenarios according to the specific needs and features of the organization's IT infrastructure. With the increasing diversity of cyber threats and attack techniques, it is important to consider and compare different types of security testing to determine their effectiveness in different scenarios. The purpose of the article is to develop recommendations for cyber security specialists regarding the selection of effective methods for assessing the level of protection, by using various scenarios for testing the security of IT infrastructure. The article analyzes and classifies various types of security testing in order to select the most effective methods and scenarios for various systems. A selection matrix has been developed, which helps to systematize the process of selecting test methods and scenarios according to specific test objects. Each object has its own characteristics and forms the corresponding testing requirements, and the choice of methods must be adapted to these unique aspects to ensure the maximum effectiveness of security measures. Application of appropriate methods, such as vulnerability scanning, pentest, vulnerability analysis, Red teaming and social engineering testing, in combination with specific scenarios, allows you to effectively identify and eliminate flaws and vulnerabilities of the IT infrastructure and its components. On the basis of the performed analysis, practical recommendations are provided for choosing optimal strategies for specific testing scenarios. The article is designed for cybersecurity professionals, researchers, and organizations seeking to improve the effectiveness of their security testing programs and ensure a high level of protection in the face of countless cyber threats.

Keywords: security testing, cyber security, vulnerability analysis, application and web services testing, black box, red teaming.