Mu's Internet attacks in a can

Mu Dynamics' Mu-4000 Analyzer and Published Vulnerability Attacks take a hammer to our UTMs

Ixia's IxLoad system was key to our scenario-based UTM test by allowing us to fire a baseline of legitimate traffic through the devices' various firewall interfaces and VPNs. The Mu test tool let us systematically test each UTM's attack blocking capabilities. Only by using the Mu tool were we able to measure the impact of attacks on performance and to learn that the threat defenses of some UTMs leave a lot to be desired.

The Mu-4000, with Mu's Published Vulnerability Attacks module, does not replay captured attacks, but rather generates attacks against known vulnerabilities according to the environment under test and in compliance with the industry's common taxonomy. The attacks can be run against actual devices (Web servers, switches, routers, firewalls) or in pass-through mode, where the Mu-4000 connects through a device (like a UTM) and attacks a simulated server on another Mu-4000 interface.

[ When is a UTM not a UTM? Read the overall conclusions of the InfoWorld Test Center's great UTM challenge. Read the reviews: Astaro Security Gateway 425 | SonicWall NSA E7500 | WatchGuard Firebox Peak X5500e | ZyXel ZyWall USG1000 | Compare the UTMs feature by feature. ]

In addition to generating exploits based on vulnerabilities from both public and private sources, the Mu tool provides an outstanding set of reports from each test run. Each attack in an analysis is explained in context with the vulnerability and exposes the XML definition for the attack so that vendors can dive into what-if customization. In addition to the published vulnerability attacks (PVAs), the Mu-4000 can also "mutate" portions of the attack similar to how many zero-day attack variants are created. These mutations now no longer match the original attack signatures and can expose weaknesses in security device algorithms. We did not expose our UTMs to these attack mutations; our test only included Mu's known attacks.

We also chose not to run Mu's denial-of-service module, fearing that the UTM vendors would be unwilling to confront it. However, the DoS module seems to do a great job of simulating even huge bot networks to pound the heck out of any unlucky device. It may not come in a review like this one, but we'll have an opportunity to exercise the DoS functionality before too long. There's just too much to talk about regarding the ways that network infrastructures respond to massive traffic attacks.

<!--StartFragment-->[ Read more about our UTM acid test and the Ixia test tool: "How to stress a UTM" | "Ixia IxLoad's multithreaded testing" ]<!--EndFragment-->

Read more about security central in InfoWorld's Security Central Channel.