Erschließung, Optimierung und Bewertung von Verwundbarkeitsanalysen mittels öffentlich zugänglicher Suchmaschinen

More and more information systems are now available over the Internet. As a result of rising complexity and network integration, the number of vulnerabilities is increasing. To meet the growing threat situation, a higher amount of security measures is required. For this issue, the question whether and how alternative approaches of vulnerability detection can be developed and optimized, especially for auditors with publicly available search engines, has to be answered. Furthermore the achievable quality, especially in comparison with conventional vulnerability analysis methods needs to be evaluated. In Summary, an approach was developed using classical and subject-specific search engines as well as an aggregation of both. The search engine results are automatically linked to existing vulnerability catalogs. The systematic and conceptual approach developed for this purpose was then practically implemented and experimentally evaluated using a demonstrator in an extensive field trial. For this purpose a method for validating the results was investigated. This validation method showed that the approach provides better results than expected and is particularly suitable for the in-time determination of vulnerabilities in large-scaled networks. In addition, it is also possible to carry out vulnerability analyses of network areas or domains in inadequate or unclear legal situations. Thus, the approaches presented in this work are an important contribution for the assessment of alternative vulnerability analysis methods.