International Business Machines Corporation

Michael Page Kasper

Bryan Childs

Andrew C M Hicks

Thomas William Conti

Diane Marie Stamboni

Joshua David Steen

John C Dayka

Gregg M Arquero

Eysha S Powers

Gary Stuart Puchkoff

Karl David Schmitz

Kin Choi

Eric Rosenfeld

Kathryn Voss

Harris M Morgenstern

Peter Jeremy Relson

James M Hertzig

Peter D Van Dyke

Susan Z Demkowicz

Scott Woolley

Bertold Reddemann

Roan Dawkins

Ulrich Kurz

Cyber security testing with automated system message processing for input and result determination is disclosed, including issuing, by a test tool, a call to an authorized service; identifying, by the test tool, one or more system-level error messages generated after issuing the call; determining, by the test tool based on at least one first system-level error message, a missing input for the call to the authorized service; and reissuing, by the test tool, the call to the authorized service with the missing input.

Cyber security testing with automated system message processing for input and result determination

A system and method for identifying authorized job step programs. The process identifies a plurality of job step programs. It then identifies authorized program facility (APF) authorized programs from the plurality of job step programs. An output table of APF authorized program is generated. This table is used to submit at least one batch job using the output table. A list identifying which parameters in a parameter string contain an address for each APF program in the output table is generated. This list is then provided for program testing.

Cyber security testing for incorrectly authorized programs

Aspects of the invention include receiving, by a processor, source code for a software program written in a first programming language. The received source code is converted into abstracted source code that is in a generic format that is different than a format of the first programming language. The abstracted source code is compared to known source code patterns. Based on determining that at least a subset of the abstracted source code matches a pattern in the known source code patterns, sending an alert to the user indicating that the received source code matches the pattern.

Automatic integrity vulnerability detection in an integrated development environment

A computer-implemented method for generating penetration tests automatically includes parsing an existing system test case, and identifying a particular program call in the system test case. The particular program call can require a particular data access authorization. The method further includes, in response to the system test case including the particular program call, generating a penetration test using a predetermined attack vector. The method further includes executing the penetration test and detecting an unauthorized access being performed during the penetration test. Further, the method includes responsively, sending a notification that identifies the particular program call.

Automatic penetration testing enablement of regression buckets

A method includes receiving test objective data indicates an objective to be achieved during a cybersecurity test of a target system. An attack tree is generated by processing the test objective data into attack tree data including a plurality of data parameter sets and links between data parameter sets. Complexity of the attack tree is analyzed based on the test objective data using a combinatorics model. The attack tree is reduced to achieve the objective of the cybersecurity test based on the analyzed complexity of the attack tree.

Combinatorial test design for optimizing parameter list testing

Aspects of the invention include executing a first test case on a system, capturing a first state of the system during execution of the first test case, determining a first result of the first test case, performing a second execution of the first test case on the system in response to the first result of the first test case being an unexpected result, capturing a second state of the system during the second execution of the first test case, determining a second result of the first test case, analyzing the first state and the second state to determine a state similarity score, and categorizing the first result as a false positive based at least in part on the state similarity score being above a first threshold and a determination that the second result is a different result than the first result.

Test case failure with root cause isolation

Techniques for system kernel error identification and reporting for a computer system are described herein. An aspect includes detecting an error during the execution of a program. Another aspect includes determining whether the error is a system kernel error in the program. Another aspect includes, based on determining that the error is a system kernel error, generating a report regarding the determined system kernel error.

System kernel error identification and reporting

A system includes a memory system and a processing system operably coupled to the memory system. The memory system includes a plurality of address spaces. The processing system is configured to perform operations including creating a data space from within a primary address space and a primary address space number access list entry referencing the data space. An unauthorized caller routine in a home address space configured to issue a service request including an address space-switching program call from the home address space to a program call target routine in the primary address space. The address space-switching program call references the primary address space number access list entry in the primary address space. A vulnerability identifier associated with the program call target routine is created and logged based on one or more conditions indicative of a cross-memory integrity violation detected responsive to the service request.

Cyber security for space-switching program calls

A system includes a memory system and a processing system operably coupled to the memory system. The processing system is configured to perform operations including setting a target register to point to a first protected storage location of the memory system resulting in a protection exception upon access, calling an authorized service, and confirming that the authorized service uses the target register based on detecting the protection exception. The target register is adjusted to point to a parameter list including one or more known values and a pointer to a second protected storage location resulting in the protection exception upon access to confirm use of a value of the parameter list responsive to calling the authorized service. Parameter list testing and target register testing is repeated for locations in the parameter list and target registers to construct a testing profile for vulnerability testing of the authorized service.

Cyber security testing for authorized services

A computer program product for cross-site request forgery (CSRF) prevention is provided and includes a computer readable storage medium having program instructions embodied therewith. The program instructions are readable and executable by a processing circuit to cause the processing circuit to issue a server request for a certificate, which is associated with a user, responsive to a client request to visit a uniform resource indicator (URI) being received, validate the certificate upon receipt in fulfillment of the server request, compare a referrer listed in a header of the client request with a list of certificate elements in the certificate, authenticate the user in accordance with correlation between the referrer and at least one of the certificate elements and authorize the client request to visit the URI upon the user being authenticated.

Cross-site request forgery (CSRF) prevention

A method includes receiving a message in a JavaScript object notation (JSON) format from a first processor, converting the message from the JSON format into a hypertext markup language (HTML) format, and presenting the content of the message in the HTML format to a user on a display.

Mainframe web client

A method includes receiving a start request from a client at a launcher application programming interface (API), determining whether an existing time sharing option (TSO) address space associated with a user of the client is available, retrieving security environment data associated with the user from a security product responsive to determining that no existing TSO address space associated with a user of the client is available, saving the retrieved security environment data as a security object, generating a message queue, generating a terminal status block (TSB) and saving the terminal status block, creating a TSO address space in a processor, sending an instruction to an operating system to start the TSO address space, and sending a message queue identifier associated with the message queue and an address space token associated with the TSO address space to the client.

Growing community of inventors

Poughkeepsie, NY, United States of America

Michael Page Kasper