Mu Dynamics' Mu-4000 Analyzer and Published Vulnerability Attacks take a hammer to our UTMs
Ixia's IxLoad system was key to our scenario-based UTM test by allowing us to fire a baseline of legitimate traffic through the devices' various firewall interfaces and VPNs. The Mu test tool let us systematically test each UTM's attack blocking capabilities. Only by using the Mu tool were we able to measure the impact of attacks on performance and to learn that the threat defenses of some UTMs leave a lot to be desired.
The Mu-4000, with Mu's Published Vulnerability Attacks module, does not replay captured attacks, but rather generates attacks against known vulnerabilities according to the environment under test and in compliance with the industry's common taxonomy. The attacks can be run against actual devices (Web servers, switches, routers, firewalls) or in pass-through mode, where the Mu-4000 connects through a device (like a UTM) and attacks a simulated server on another Mu-4000 interface.
[ When is a UTM not a UTM? Read the overall conclusions of the InfoWorld Test Center's great UTM challenge. Read the reviews: Astaro Security Gateway 425 | SonicWall NSA E7500 | WatchGuard Firebox Peak X5500e | ZyXel ZyWall USG1000 | Compare the UTMs feature by feature. ]
In addition to generating exploits based on vulnerabilities from both public and private sources, the Mu tool provides an outstanding set of reports from each test run. Each attack in an analysis is explained in context with the vulnerability and exposes the XML definition for the attack so that vendors can dive into what-if customization. In addition to the published vulnerability attacks (PVAs), the Mu-4000 can also "mutate" portions of the attack similar to how many zero-day attack variants are created. These mutations now no longer match the original attack signatures and can expose weaknesses in security device algorithms. We did not expose our UTMs to these attack mutations; our test only included Mu's known attacks.
We also chose not to run Mu's denial-of-service module, fearing that the UTM vendors would be unwilling to confront it. However, the DoS module seems to do a great job of simulating even huge bot networks to pound the heck out of any unlucky device. It may not come in a review like this one, but we'll have an opportunity to exercise the DoS functionality before too long. There's just too much to talk about regarding the ways that network infrastructures respond to massive traffic attacks.
An obscure case involving dental aligners could have huge implications for the free flow of data across...
Samsung's throwing another phablet into the ring, but this one's curved on both sides
Samsung’s back with its fifth-generation phone-tablet hybrid
Your smartphone and desktop computer can interoperate in powerful ways. Here's how to make it happen
We all have our reasons for quitting a job, some of them emotional. Follow these guidelines and you'll...
As vendors crank out more and more certs, their value is flattening, while premium pay for underlying...
Wedded to Git version control and the GitHub cloud service? Learn how to take advantage of the newest...