Recently I have been struggling with some of the more theoretical parts of penetration testing as a lot of CTFs don't go over why things are happening.

This isn't really a necessary part of most CTFs, as most are designed to be a game, but if I want to be more than just a penetration tester I want to know why the XSS alert pops and not just find a flag by using a tool.

To be a good security engineer/penetration tester one should be able to tell a software engineer what/where the real issue is and be able to tell them how they might fix it and this can be done through Root Cause Analysis of a bug.

What is RCS?

Root Cause Analysis (RCA) is an analysis of an issue, generally negative, and finding where it originated from. What is the "Point A" that triggered the events that cause said issue.

Why is RCS Important?

I like to think of root cause analysis as dealing with weeds in a garden. If you are only pulling the dandelion flowers off then the weed will keep coming back. But, if you go after the roots and can pull them up then you have found the cause of the weed and can prevent it from growing again.

In security doing root cause analysis is a very important part of triaging a bug report. It is used to help identify where the issue is originating from to prevent a bug from being reported multiple times and ensuring the quality of the product over its life.

How do You Analyze the Root Cause?

There are a handful of ways to do a RCA

Keep in minds when picking one that every method won't work for every situation so here are a few popular ones:

• Five Whys Analysis - is a tool that can be used in troubleshooting, quality improvement and problem solving. It is done when a problem arises by simply keep asking the question "why" until you reach the underlying source of the problem, and until a robust counter-measure becomes apparent.(1)
• Problem Tree Analysis - is a tool to break up a problem into smaller parts parts. It starts with the core problem and descending till creating a family tree structure of the problem itself. (2)
• Fishbone/Ishikawa - is used to group causes into different sub-categories like methods, measurements, materials and many others for easier determination of the cause.(3)

No Matter What Tool You Choose, a Root Cause Analysis Consist of a few Consistent Steps

1. Define the problem in as much detail as possible
2. Gather data associated with the problem.
3. Identify any causes of the problem.
4. Identify any consequences of the problem.
5. Determine the Root Cause(s)
6. Identify any solutions that will be effective in preventing repeat problems.
7. Implement appropriate changes
8. Monitor changes to ensure that they effectively fixed the problem (2, 7)

Importance of Root Cause Analysis

"Performing a root cause analysis is one of the most important things you can do to improve operations and drive a continuous operations improvement mindset." (9)
Though often overlooked, a root cause analysis makes it easier to communicate what’s known and what needs a little more work. It allows all people involved to see how all of the pieces fit together and, most importantly, helps eliminate the need of taking unnecessary action, as well as reduce the cost associated with erroneous/excesses repairs, like a data breach.

Happy Hacking

References

1. https://www.thecompassforsbc.org/sbcc-tools/5-whys-getting-root-problem-quickly
2. https://www.12manage.com/description_problem_analysis_tree.html
3. https://www.6sigma.us/etc/what-are-common-root-cause-analysis-rca-tools/
4. http://www.bawiki.com/wiki/Fishbone-Diagram.html
5. http://www.root-cause-analysis.co.uk/images/Green%20RCA%20mini%20guide%20v5%20small.pdf
6. https://www.brighthubpm.com/project-planning/57124-overview-of-root-cause-analysis-techniques/
7. https://www.masterclass.com/articles/how-to-perform-a-root-cause-analysis#5-popular-root-cause-analysis-methods
8. https://expertprogrammanagement.com/2019/05/the-5-whys/
9. http://informationsecurityhq.com/how-to-perform-a-root-cause-analysis/

Please Note that I am still learning. If something that I have stated is incorrect please let me know. I would love to learn more about what I may not understand fully.