Mu Dynamics' Mu-4000 Analyzer and Published Vulnerability Attacks take a hammer to our UTMs
Ixia's IxLoad system was key to our scenario-based UTM test by allowing us to fire a baseline of legitimate traffic through the devices' various firewall interfaces and VPNs. The Mu test tool let us systematically test each UTM's attack blocking capabilities. Only by using the Mu tool were we able to measure the impact of attacks on performance and to learn that the threat defenses of some UTMs leave a lot to be desired.
The Mu-4000, with Mu's Published Vulnerability Attacks module, does not replay captured attacks, but rather generates attacks against known vulnerabilities according to the environment under test and in compliance with the industry's common taxonomy. The attacks can be run against actual devices (Web servers, switches, routers, firewalls) or in pass-through mode, where the Mu-4000 connects through a device (like a UTM) and attacks a simulated server on another Mu-4000 interface.
[ When is a UTM not a UTM? Read the overall conclusions of the InfoWorld Test Center's great UTM challenge. Read the reviews: Astaro Security Gateway 425 | SonicWall NSA E7500 | WatchGuard Firebox Peak X5500e | ZyXel ZyWall USG1000 | Compare the UTMs feature by feature. ]
In addition to generating exploits based on vulnerabilities from both public and private sources, the Mu tool provides an outstanding set of reports from each test run. Each attack in an analysis is explained in context with the vulnerability and exposes the XML definition for the attack so that vendors can dive into what-if customization. In addition to the published vulnerability attacks (PVAs), the Mu-4000 can also "mutate" portions of the attack similar to how many zero-day attack variants are created. These mutations now no longer match the original attack signatures and can expose weaknesses in security device algorithms. We did not expose our UTMs to these attack mutations; our test only included Mu's known attacks.
We also chose not to run Mu's denial-of-service module, fearing that the UTM vendors would be unwilling to confront it. However, the DoS module seems to do a great job of simulating even huge bot networks to pound the heck out of any unlucky device. It may not come in a review like this one, but we'll have an opportunity to exercise the DoS functionality before too long. There's just too much to talk about regarding the ways that network infrastructures respond to massive traffic attacks.
Windows 7 is suddenly telling users it isn't genuine -- and it has nothing to do with Windows being...
Windows users are reporting significant problems with four more October Black Tuesday patches
The larger design is very welcome, but there's much more to the iPhone 6 than a bigger screen
Sponsored by Rackspace
Sponsored by Nuage Networks
Sponsored by Fibre Channel Industry Association
InfoWorld picks the best hardware, software, development tools, and cloud services of the year
Microsoft CEO Satya Nadella is showing the same kind of leadership that Steve Jobs used to rescue Apple...
If you’re doing one or more of these things, it might be time to step away from the IDE and take a...
Black Duck presents its Open Source Rookies of the Year -- the 10 most exciting, active new projects...