• E-mail
• Print
• Comment
• Font Size
• Digg
• del.icio.us
• Discuss article

Mu Security Creates New Category of 'Security Analyzers'; Announces First Product and Early Customer Traction Deployments of Mu-4000 Security Analyzer Uncover More Than 40 Zero-Day Vulnerabilities in Leading IP Systems and Software Applications

Posted on: Monday, 3 April 2006, 09:00 CDT

Mu Security, a pioneer in the new security analyzer market, today emerged from stealth mode on its one-year anniversary to introduce its first product, the Mu-4000 Security Analyzer. Mu's security analyzer is a purpose-built appliance that utilizes a systematic and repeatable process to identify unknown and known security vulnerabilities in any IP-based system, application or network device without requiring access to any source code. Security analyzers are essential to moving the industry from its current reactive approach to a predictive and proactive stance that identifies and helps remediate vulnerabilities before systems and applications are deployed in both enterprise and service provider production networks.

"The ability to discover zero-day vulnerabilities and identify the cause of each is a powerful capability for any company," noted Chris Christiansen, vice president of security products and services for IDC. "There are likely to be numerous exploitable vulnerabilities in field-installed systems that require remediation today. Mu is focused on equipping the industry with a proactive security flaw detection system that will minimize the number and severity of these zero-day exploits. Armed with the ability to find security vulnerabilities, users are no longer in the unenviable position of serving as a vendor's outsourced QA department for de-bugging vulnerable systems."

The Mu-4000 helps enterprises, service providers and product vendors employ a three-stage security analysis process that mutates communication between systems to emulate the myriad vulnerability discovery techniques hackers utilize, then actively monitors the results to identify and log successful attacks, and ultimately manages the automated analysis to isolate, characterize and document the failure for rapid remediation. The system's extensible design supports internally developed and third-party security analysis suites allowing users to methodically analyze products and applications for security vulnerabilities during the development or evaluation stages, prior to release or deployment.

While the layers of security now widely deployed in enterprise and service provider networks are certainly helpful, successful attacks are increasingly exploiting new vulnerabilities on a daily basis in software and the defense-in-depth equipment itself. A leading provider of IT security services, Secunia (http://www.secunia.com), has already published more than 1,000 vulnerabilities during the first three months of 2006, a 20 percent increase over the same period in 2005. To isolate and remediate vulnerabilities before possible exploitation, leading Fortune 100 enterprise, service provider and IP-connected product vendors have already deployed more than a dozen of Mu's Security Analyzers. Deployment scenario examples from nine different vendor and end user customers are now available online at http://www.musecurity.com/solutions/customers.html.

Dozens of New Zero-day Vulnerabilities Discovered

The Mu-4000 has already uncovered more than 40 new zero-day vulnerabilities in a diverse set of IP-based products in the consumer, enterprise and service provider markets. This includes e-commerce servers, home gateways, point-of-sale systems, VoIP phones, database applications, network switches, routers, firewalls, IDP devices and UTM systems. Once vendors remediate newly discovered zero-day vulnerabilities, they collaborate with Mu Security to selectively disclose specific details.

To identify previously undetected vulnerabilities in a wide range of IP-based products and applications, Mu leverages its comprehensive Protocol Spidering(TM) technology that probes for exposures caused by layered protocols and their many interdependencies. The Protocol Spidering engine in the mutate stage mimics the patterns inherent in complex and interconnected protocols. These unavoidable and frequently vulnerable interdependencies are found in every system and application that utilizes standard or proprietary protocols and data types. Through Protocol Spidering, the Mu-4000 is able to analyze the attack surface at the exploitable intersections of code, interfaces, services, protocols and practices available to all users, with a strong focus on what is accessible to unauthenticated users.

The Mu-4000 security analyzer is considerably easier for non-experts to use compared with vulnerability scanners that audit for known attacks, or source code analyzers that target common programming errors. The Mu-4000 is also distinguished by its ability to monitor and automatically manage the vulnerability analysis process. For example, software and hardware "re-starters" are used to reset or reboot systems that lock up during the analysis, allowing the Mu-4000 to operate completely unattended. The monitor automatically collects all relevant information required to identify the precise set of stateless or stateful conditions that caused the vulnerability, which substantially improves productivity during the remediation effort.

"Mu is dedicated to eventually eliminating security vulnerabilities across the full spectrum of IP-based systems and applications," commented Ajit Sancheti, co-founder and CEO of Mu Security. "While efforts to implement defense-in-depth network security strategies have met with some success, the vulnerabilities these systems are designed to prevent show no sign of abating. By focusing initially on the myriad inter-dependencies among the network protocols that account for the significant majority of vulnerabilities, Mu is delivering a unique methodology to proactively uncover known and previously undetected security vulnerabilities."

The Mu-4000 Security Analyzer has three related yet distinct customer segments. The first include organizations utilizing networking products, such as government agencies, larger enterprises and service providers that want to assess the comparative security readiness of new solutions or new product releases prior to deployment. The second segment represents networking systems and software vendors that need to assess security during product update and development cycles, particularly in the quality assurance testing phase. The third segment is made up of independent labs and certification agencies that evaluate networking products, potentially against a benchmark standard or in a comparative "bake-off" among competitive offerings.

Product Description

The Mu-4000 Security Analyzer operates using a three-stage process: mutate, monitor and manage. The Mu-4000 subjects the target under analysis to a virtually unlimited numbers of attacks (the mutations), closely monitors and captures the results in a database, and manages the results in actionable ways, both during and after the analysis. All three steps are fully configurable by users possessing different skill levels, allowing the Security Analyzer to meet the needs of non-experts and security specialists requiring granular control over the analysis. The design is also extensible, which enables organizations to add their own suites of mutations, or external attack vectors, test beds and vulnerability triggers.

The Mu-4000 is a self-contained, rack-mountable (2U) appliance that includes four Gigabit Ethernet and two serial ports for interfacing to the targets being analyzed, two power relay plugs for off/on recycling of systems that lock up during a failure, and both Ethernet and serial management console ports. The use of multiple device interfaces allows parallel testing for comparison purposes, as well as for load-balancing or distributing attacks. The ability to restart the target device, either with a software reset or by cycling power, allows tests to proceed to completion unattended.

Product Pricing and Availability

The Mu-4000 Security Analyzer, which was available for early release to select customers in the fourth quarter of 2005, is now generally available. The appliance has a U.S. list price starting at $35,000, with incremental pricing based upon the number of selected protocols.

About Mu Security

Mu Security is a start-up pioneering a new class of security analysis system that provides a rigorous and streamlined methodology for verifying the security readiness of any IP-based product or application. Founded by the pioneers of intrusion detection and prevention technology, Mu Security is backed by preeminent venture capital firms that include Accel Partners and Benchmark Capital. The company is headquartered in Sunnyvale, CA. For more information, visit the company's website at www.musecurity.com.

Source: Business Wire

More News in this Category