System and method for secure evaluation of cyber detection products
A system and method for the secure and private demonstration of cloud-based cyber-security tools. Using an advanced sandboxing design patterns, isolated instances of virtual networks allow a potential client to compare their existing cyber defense tools against a set of cloud-based tools. Capitalizing on non-persistent and secure sandboxes allow the invention to demonstrate fully functional and devastating cyber-attacks while guaranteeing strict privacy and security to both existing customers and potential ones. Additionally, instantiating separate sandboxed observed systems in a single multi-tenant infrastructure provide each customer with the ability to rapidly create actual representations of their enterprise environment offering the most realistic and accurate demonstration and comparison between products.
1. A system for secure evaluation of cybersecurity tools is disclosed, comprising:
a computing device comprising a memory and a processor;
a first set of cybersecurity defense tools operating in a production environment and connected to a client's computer network;
a sandbox environment manager comprising a first plurality of programming instructions stored in the memory and operating on the processor, wherein the first plurality of programming instructions, when operating on the processor, cause the computing device to:
create a sandbox environment for testing of a virtual computer network, the virtual computer network comprising one or more virtual domain controllers, one or more member servers, and one or more workstations; and
create an observed system within the sandbox environment, the observed system comprising an isolated instance of the virtual computer network, and a second set of cybersecurity defense tools; and
a secure tunnel from the observed system to the first set of cybersecurity defense tools;
wherein the performance of the first and second sets of cybersecurity defense tools is compared when defending against a plurality of cyberattacks within the observed system;
wherein the sandbox environment is provided with a set of controlled computing resources of the computing device for its operation and is prevented from accessing any other computing resources of the computing device.
2. The system of claim 1 , further comprising an observed system manager comprising a second plurality of programming instructions stored in the memory and operating on the processor, wherein the second plurality of programming instructions, when operating on the processor, cause the computing device to:
operate the observed system as a test of the virtual computer network and the cybersecurity defense tools against the malware;
allow a user to monitor and change the operation of the observed system during operation; and
display results from the test of the observed system.
3. The system of claim 1 , wherein the observed system comprises a subset of the virtual computer network, and wherein a plurality of simulations of the observed system are carried out each using a different set of initial conditions.
4. A method for secure evaluation of cybersecurity tools is disclosed, comprising the steps of:
operating a first set of cybersecurity defense tools operating in a production environment connected to a client's computer network;
creating a sandbox environment for testing of a virtual computer network, the virtual computer network comprising one or more virtual domain controllers, one or more member servers, and one or more workstations;
creating an observed system within the sandbox environment, the observed system comprising an isolated instance of the virtual computer network, and a second set of cybersecurity defense tools;
operating the observed system as a test of the virtual computer network and the cybersecurity defense tools against the malware;
establishing a secure tunnel from the observed system to the first set of cybersecurity defense tools; and
comparing the performance of the first and second sets of cybersecurity defense tools when defending against a plurality of cyberattacks within the observed system;
wherein the sandbox environment is provided with a set of controlled computing resources of the computing device for its operation and is prevented from accessing any other computing resources of the computing device.
5. The method of claim 4 , further comprising the steps of:
allowing a user to monitor and change the operation of the observed system during operation; and
displaying results from the test of the observed system.
6. The method of claim 4 , wherein the observed system comprises a subset of the virtual computer network, and wherein a plurality of simulations of the observed system are carried out each using a different set of initial conditions.