Mu Security Releases the Mu-4000 Security Analyzer Appliance

contents

hardware

Mu Security has announced a major new release of its flagship Mu-4000 Security Analyzer appliance. The Mu-4000 improves the reliability and uptime of networked products and IP business services by proactively addressing robustness and resiliency factors before systems are deployed in production environments. As a result, Mu Security's growing service provider customer base is avoiding service outages and reducing customer churn. Mu Security's third-generation solution maximizes customer ROI with new features including sharable analysis templates, interactive graphical response time charting and dynamic stateful protocol fuzzing as the basis for robustness analysis.

With the introduction of Sharable Analysis Templates, Mu Security is establishing strategic best practices for system testing across organizations. Organizations often find it very difficult to add security metrics or repeatable processes across groups. Typically, only a small, specialized incident response group within a company has security expertise, whereas the larger product certification/testing group often lacks sufficient security knowledge to test for product robustness.

Mu Security's Mu-4000 platform now supports customizable analysis templates that easily transfer between Mu-4000 appliances to help disseminate scarce security knowledge within organizations. By capturing best practices that can be replicated, the new Mu-4000 is greatly simplifying robustness testing, and thereby enabling a repeatable security process as a key competitive differentiator for Mu's customers.

Latency-sensitive applications unable to process valid data in specific timeframes may not meet response-time goals or service level agreements. Legacy fuzzing tools have never before attempted to measure a target system's ability to process valid traffic while being probed by invalid traffic.

With Response Time Charts, the updated Mu-4000 interactively exposes quality and availability issues to accelerate remediation. Customers can actively gauge a system's ability to maintain control and specific performance levels while processing unexpected inputs. In addition to hard failures (e.g., system crashes), users can now isolate hard-to-detect "soft faults" including memory leaks, CPU utilization spikes and rising latency levels to help service providers maintain SLAs by avoiding costly downtime.

Most static fuzzers tend to focus only on the protocol specification without any regard to how the target's implemented or deployed. This approach tends to have a least-common-denominator effect, making many static attack vectors irrelevant in the real world.

The new Dynamic Stateful Fuzzing engine overcomes these major limitations by first accessing the target system to map out the target's exact capabilities. After this step, the engine computes a set of attack vectors tailored to the target, and then dynamically executes them. The result is much deeper attack surface coverage with more vulnerabilities being uncovered.

Furthermore, this is the only solution to support user-defined protocol extensions, allowing customers to use their Mu-4000 to dynamically construct attack vectors over and beyond what Mu provides out-of-the-box.

Many protocols have multi-packet exchanges, like HTTP or SIP dialogs. The only way to get deep coverage of the protocol implementation is to exercise it in all its valid and invalid states. Only the Mu-4000's dynamic stateful fuzzing engine can deliver structurally and semantically invalid attacks in all the relevant states of stateful protocols. These attacks include valid packets sent at the wrong time, or packets that are never valid, but are designed to cause damage to the code that implements the protocol's state machine(s). This latest Mu-4000 provides deeper and broader attack surface coverage, and enables customers to significantly reduce service-impacting vulnerabilities.

write your comments about the article :: © 2007 Networking News :: home page