  Penetration testing is a well-established practical concept for the
identification of potentially exploitable security weaknesses and an important
component of a security audit. Providing a holistic security assessment for
networks consisting of several hundreds hosts is hardly feasible though without
some sort of mechanization. Mitigation, prioritizing counter-measures subject
to a given budget, currently lacks a solid theoretical understanding and is
hence more art than science. In this work, we propose the first approach for
conducting comprehensive what-if analyses in order to reason about mitigation
in a conceptually well-founded manner. To evaluate and compare mitigation
strategies, we use simulated penetration testing, i.e., automated
attack-finding, based on a network model to which a subset of a given set of
mitigation actions, e.g., changes to the network topology, system updates,
configuration changes etc. is applied. Using Stackelberg planning, we determine
optimal combinations that minimize the maximal attacker success (similar to a
Stackelberg game), and thus provide a well-founded basis for a holistic
mitigation strategy. We show that these Stackelberg planning models can largely
be derived from network scan, public vulnerability databases and manual
inspection with various degrees of automation and detail, and we simulate
mitigation analysis on networks of different size and vulnerability.
