Reproducible Software Vulnerability Testing with IaC

Cybersecurity is more important now than ever. Attackers maliciously use vulnerabilities to exploit IT systems. Software developers are responsible for fixing the reported vulnerabilities in their own products, while system administrators should assess the impacts of attacks against their working systems. However, they are wasting time to make the problem appear because provisioning is a complex and troublesome process. This paper presents a model of vulnerability testing and our original system which enables efficient and automatic reproduction of the vulnerable environments and replicable execution of attacks. We utilize the Infrastructure as Code (IaC) principle. Vulnerability testing is represented as code and the system automates the process of provisioning vulnerable environments and executing attacks through machine-readable definitions, rather than manual configuration and execution. A simple human-readable YAML language is used for writing testing definitions. If the definitions are maintained in publicly accessible repositories, security experts have a chance to contribute their knowledge and expertise to the community and an open-source style ecosystem may be created.