Analiza i izvedba penetracijskog testiranja za povećanje sigurnosti informacijsko-komunikacijskog sustava

master's thesis

• Title (english): Analysis and Performance of Penetration Testing for Increasing the Security of the Information and Communication System
• Author: Nikola Knögel
• Mentor: Dragan Peraković (mentor)
• Committee member: Marko Periša (predsjednik povjerenstva)
• Committee member: Ivan Cvitić (član povjerenstva)
• Committee member: Ivan Grgurević (član povjerenstva)
• Granter: University of Zagreb; Faculty of Transport and Traffic Sciences; (Division of Transport); (Department of Information and Communications Traffic); Zagreb
• Defense date and country: 2023-09-21, Croatia
• Scientific / art field, discipline and subdiscipline: TECHNICAL SCIENCES; Traffic and Transport Technology; Postal and Telecommunications Traffic

Abstract

Ovaj diplomski rad temelji se na istraživanju penetracijskog testiranja kao ključne komponente za osiguravanje kibernetičke sigurnosti u različitim okruženjima. Analizirane su različite vrste penetracijskih testova, uključujući crne, bijele i sive kutije, te su uspoređene njihove prednosti i nedostaci. Istražene su različite tehnike napada i metode zaštite od njih, analizirajući ranjivosti i propuste te pružajući strategije za otklanjanje tih rizika. Rad se također bavi primjenom metodologije penetracijskog testiranja u organizaciji, naglašavajući važnost identifikacije ciljeva testiranja, uloge tima i izradu plana testiranja. Proučavanjem primjene penetracijskog testiranja u oblaku, identificirane su ranjivosti i sigurnosni mehanizmi specifični za tu domenu. Analiziran je utjecaj različitih modela u oblaku i razmatrane su metode zaštite u oblaku. Također, istražena je automatizacija penetracijskog testiranja te je napravljena usporedba između automatiziranog i ručnog testiranja i analizirani su različiti alati.

Abstract (english)

This thesis is based on the research of penetration testing as a key component for ensuring cyber security in different environments. Different types of penetration tests, including black, white and gray boxes, are analyzed and their advantages and disadvantages are compared. Various attack techniques and methods of protection against them are explored, analyzing vulnerabilities and flaws and providing strategies to eliminate these risks. The paper also deals with the application of penetration testing methodology in the organization, emphasizing the importance of identifying testing objectives, the role of the team and creating a test plan. By studying the application of penetration testing in the cloud, vulnerabilities and security mechanisms specific to that domain were identified. The impact of different cloud models is analyzed and cloud protection methods are discussed. Also, the automation of penetration testing was investigated and a comparison was made between automated and manual testing and different tools were analyzed.

• Keywords: penetracijsko testiranje; sigurnost; oblak; tehnike napada; zaštita; metodologija; automatizacija
• Keywords (english): penetration testing; security; cloud; attack techniques; protection; methodology; automation
• Language: croatian
• URN:NBN: urn:nbn:hr:119:670899
• Study programme: Title: Traffic and Transport; specializations in: Road Traffic and Transport, Railway Traffic and Transport, Water Traffic and Transport, Air Traffic and Transport, Postal Traffic, Information and Communication Traffic, Urban Traffic and Transport; Course: Road Traffic and Transport; Study programme type: university; Study level: graduate; Academic / professional title: magistar/magistra inženjer/inženjerka prometa (magistar/magistra inženjer/inženjerka prometa)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Open access
• Created on: 2023-10-03 13:41:32