Decreasing an indetermination of evaluation of time to compromise Server-Side Web Application of Industrial Control System

At the present stage of development of methods and ways of organizing cyber defense of critical infrastructure facilities, one of the effective approaches is the systematic search for vulnerabilities of such facilities in the form of penetration testing. The main form of penetration testing should be considered practical proof of the possibility of unauthorized and remote imposition of a demonstration malware program with authorized powers as part of one of the components of the critical infrastructure system. As an indicator of the effectiveness of organizing the penetration testing process, it is proposed to use the time spent on achieving the tactical goal of the Compromise System.Estimating the time required to achieve the Compromise System tactical objective in real-world penetration testing is subject to many uncertainty factors. Two approaches are proposed to reduce the impact of uncertainty. The first is by implementing methods of decision support information theory at the stages of achieving the tactical goals of Reconnaissance and Resource Development. The second is the use of decision-making criteria under uncertainty to process the results of experimental tests of demonstration malware, when passing the casual chain Initial Access -Execution. The substantiation of the formulated provisions was carried out by studying the structural and casual relations of the subject area based on the analysis of The Cyber Kill Chain, The Unified Kill Chain, Ethical Hacking Methodology and the taxonomies of expert knowledge Adversarial Tactics, Techniques & Common Knowledge.A substantial description of the methodology for assessing the reduction of uncertainty, estimating the time of compromise of Server-side Web Application components during the passage of the casual chain Initial Access -Execution (in the context of the stage of achieving the tactical goal of Gaining Access penetration testing) by the Exploit Public-Facing Application method based on the application of decision-making criteria under conditions of uncertainty is presented.