Design and Development of an Analytical Data Warehouse for Supporting the Process of Conducting Penetration Tests and Preparing Reports on the Results of Vulnerability Assessments

The threats to business from information security are increasing every day. The number of cyberattacks is rising with the growing profitability of such attacks, and the public is becoming aware of new methods of conducting cyberattacks, which often outpace developments in defense mechanisms and tools. All companies, regardless of their size or industry, are vulnerable to cyberattacks. There will always be ways to penetrate a business's infrastructure, due to various factors such as human error, vulnerabilities in the software or code used. Recognizing this fact allows companies to strive to stay one step ahead in identifying new vulnerabilities that could lead to reputational and financial losses. Conducting controlled penetration tests is one of the effective ways for companies to discover vulnerabilities in their products before others do. The outcome of penetration tests is a significant amount of data on the vulnerabilities found, which require prompt remediation and secure storage of such information. To enhance the efficiency and speed of addressing these vulnerabilities, it is necessary to implement new functionality into existing company information systems. Data warehouses are one of the popular solutions to such problems, often complemented by data marts. Subsequently, BI tools are also used, which present the stored information in a presentable form through visualization in graphs and tables. This work is dedicated to the design and development of an analytical data warehouse for supporting the process of conducting penetration tests and preparing reports on the identified vulnerabilities. Initially, an analysis of the penetration testing process will be carried out, and the necessary models for the data warehouse and data marts will be designed. Subsequently, everything will be implemented in the chosen database management system (DBMS), data will be entered, and visualized through import into a BI report. Such a solution positively impacts the company by accelerating the process of addressing vulnerabilities found during penetration testing and making decisions regarding pentests.