Mu Dynamics' Mu-4000 Analyzer and Published Vulnerability Attacks take a hammer to our UTMs
Ixia's IxLoad system was key to our scenario-based UTM test by allowing us to fire a baseline of legitimate traffic through the devices' various firewall interfaces and VPNs. The Mu test tool let us systematically test each UTM's attack blocking capabilities. Only by using the Mu tool were we able to measure the impact of attacks on performance and to learn that the threat defenses of some UTMs leave a lot to be desired.
The Mu-4000, with Mu's Published Vulnerability Attacks module, does not replay captured attacks, but rather generates attacks against known vulnerabilities according to the environment under test and in compliance with the industry's common taxonomy. The attacks can be run against actual devices (Web servers, switches, routers, firewalls) or in pass-through mode, where the Mu-4000 connects through a device (like a UTM) and attacks a simulated server on another Mu-4000 interface.
[ When is a UTM not a UTM? Read the overall conclusions of the InfoWorld Test Center's great UTM challenge. Read the reviews: Astaro Security Gateway 425 | SonicWall NSA E7500 | WatchGuard Firebox Peak X5500e | ZyXel ZyWall USG1000 | Compare the UTMs feature by feature. ]
In addition to generating exploits based on vulnerabilities from both public and private sources, the Mu tool provides an outstanding set of reports from each test run. Each attack in an analysis is explained in context with the vulnerability and exposes the XML definition for the attack so that vendors can dive into what-if customization. In addition to the published vulnerability attacks (PVAs), the Mu-4000 can also "mutate" portions of the attack similar to how many zero-day attack variants are created. These mutations now no longer match the original attack signatures and can expose weaknesses in security device algorithms. We did not expose our UTMs to these attack mutations; our test only included Mu's known attacks.
We also chose not to run Mu's denial-of-service module, fearing that the UTM vendors would be unwilling to confront it. However, the DoS module seems to do a great job of simulating even huge bot networks to pound the heck out of any unlucky device. It may not come in a review like this one, but we'll have an opportunity to exercise the DoS functionality before too long. There's just too much to talk about regarding the ways that network infrastructures respond to massive traffic attacks.
Windows 7 is suddenly telling users it isn't genuine -- and it has nothing to do with Windows being...
Windows users are reporting significant problems with four more October Black Tuesday patches
Microsoft sends KB 2952664 through the automatic update chute for the seventh time -- and still can't...
Sponsored by Nuage Networks
Sponsored by Fibre Channel Industry Association
Your next nerd fight will be over who has the best framework APIs, not syntax
Slimming down your JSON payload can bring significant savings in the mobile era, but beware overdoing...
Owen Garrett of Nginx explains why microservices are taking Web and mobile development by storm and...
Linux's package management headaches could be solved by way of containers, but experts warn it's only...