Non-disruptive diagnostic and attack testing methods and systems
Testing methods and systems provide a Diagnostic Testing Service as well as an attack simulation service, for a perimeter security system, in a non-disruptive manner, so that the production targets can be tested while normally functioning, and do not have to be brought down for testing. The testing methods can be implemented, such that they are vendor and device type neutral, considering the overall strategy utilized to prevent perimeter security system attacks.
1. A method for testing comprising:
(a) configuring a coordination device in communication with a production network, the production network including at least one production service, the production network interfacing with an external network at a perimeter of the production network, the at least one production service downstream from the external network, and a perimeter security system (PSS) for mitigating multiple threats upstream from the at least one production service;
(b) receiving, by the coordination device, pre-attack notification information, the pre-attack notification information including: one or more types of attacks to be launched against the at least one production service; and
(c) collecting, by the coordination device, operation data corresponding to the traffic sent to the at least one production service, the traffic which has at least partially traversed the perimeter security system (PSS) during an attack, where the attack is based on the one or more types of attacks of the received pre-attack notification information, and the collecting during the attack based on the one or more types of attacks of the received pre-attack notification information.
2. The method of claim 1 , wherein the coordination device includes at least one emulated service for receiving a simulated attack associated with the pre-attack notification information, and/or for receiving pre-attack notification information or signaling.
3. The method of claim 1 , wherein the traffic includes packets.
4. The method of claim 1 , wherein the traffic includes simulated attack traffic and/or monitor traffic.
5. The method of claim 1 , wherein the traffic includes legitimate traffic.
6. The method of claim 1 , additionally comprising: monitoring response operation data of one or more monitors during the attack by a monitor controller, and, determining whether the response operation data is within a predetermined range.
7. The method of claim 6 , wherein if the response operation data is determined to be outside of the predetermined range, either altering or terminating the attack.
8. The method of claim 1 , additionally comprising: monitoring coordination agent operation data during the attack by a monitor controller or the coordination device, and a coordination agent is on a production server and/or the coordination device.
9. The method of claim 8 , wherein the monitor controller or the coordination device determines whether the coordination agent operation data is within a predetermined range.
10. The method of claim 9 , wherein if the coordination agent operation data is determined to be outside of the predetermined range, either altering or terminating the attack.
11. The method of claim 1 , additionally comprising, the coordination device sending the collected operation data to a collection point which evaluates the operation of the perimeter security system (PSS).
12. The method of claim 11 , wherein the collection point comprises a monitor controller.
13. The method of claim 1 , wherein the coordination device collecting the operation data includes receiving a copy of the traffic sent to the at least one production service from a mirror port, the traffic having at least partially traversed the perimeter security system (PSS) during the attack, the mirror port along the production network and/or the external network and in communication with the coordination device.
14. The method of claim 1 , wherein prior to a simulated attack, and the collecting by the coordination device, generating a baseline associated with one or more monitor responses for the at least one production service.
15. The method of claim 1 , wherein prior to a simulated attack, and the collecting by the coordination device, generating a baseline associated with one or more coordination agent metrics for the at least one production service and/or the at least one production service hosting at least one production server.
16. The method of claim 1 , wherein prior to the collecting by the coordination device, determining whether the at least one production service is of a predetermined stability to receive the attack.
17. The method of claim 1 , wherein the pre-attack notification information includes the time when the attack is launched, and one or more parameters of the attack.
18. The method of claim 1 , additionally comprising: configuring one or more coordination agents on at least one production server hosting the at least one production service, each of the one or more coordination agents configured for: (i) receiving the pre-attack notification information; (ii) collecting the traffic received on the at least one production service and/or the at least one production server; or, (iii) collecting coordination agent operation data from the one or more coordination agents indicative of the operation of the at least one production server.
19. The method of claim 18 , additionally comprising: monitoring the one or more coordination agents for coordination agent operation data during the attack, and, determining whether the coordination agent operation data is within a predetermined range.
20. The method of claim 19 , wherein if the coordination agent operation data is determined to be outside of the predetermined range, either altering or terminating the attack.
21. The method of claim 20 , wherein either altering or terminating the attack is performed by a monitor controller and/or the coordination device.
22. The method of claim 1 , additionally comprising: configuring one or more monitors along the external network, each of the one or more monitors configured for:
receiving the pre-attack notification information; and
collecting monitor operation data based on the pre-attack notification information and the collecting during the attack, from one or more of:
the perimeter security system (PSS); or,
the at least one production service.
23. The method of claim 22 , additionally comprising: monitoring, by a monitor controller, the monitor operation data during the attack, and, determining whether the monitor operation data is within a predetermined range.
24. The method of claim 23 , wherein if the monitor operation data is determined to be outside of the predetermined range, either altering or terminating the attack.
25. The method of claim 1 , additionally comprising: configuring one or more attack simulators along the external network, each of the one or more attack simulators configured for:
receiving the pre-attack notification information; and
collecting simulator operation data based on the pre-attack notification information and the collecting of responses during the attack, from one or more of:
the perimeter security system (PSS); or,
the at least one production service.
26. The method of claim 1 , wherein the attack is initiated by one or more simulators in communication with a simulator controller.
27. The method of claim 26 , wherein the simulator controller is in communication with a monitor controller.
28. The method of claim 27 , wherein the monitor controller is in communication with the one or more simulators.
29. The method of claim 28 , wherein if the simulator controller loses communication with the monitor controller, the simulator controller initiates notification to the one or more simulators to terminate the attack.
30. The method of claim 1 , wherein the attack is initiated by a simulator controller and performed by one or more simulators.
31. The method of claim 30 , wherein if any of the one or more simulators loses communication with the simulator controller or a monitor controller, the simulator that has lost the communication terminates the attack.
32. The method of claim 1 , wherein the perimeter security system (PSS) is within the production network and at least partially in the external network.
33. The method of claim 25 , wherein the perimeter security system (PSS), includes at least two of the group of:
External Security Services (ESS) Module;
Distributed Denial of Service (DDoS) mitigation module;
Firewall;
Antivirus;
Anti-malware;
Sandbox protections;
Antispam;
Web Application Firewall (WAF); or
Intrusion Protection System (IPS).
34. The method of claim 1 , additionally comprising:
analyzing the operation data collected by a monitor controller and/or the coordination device, the analyzing including:
identifying vulnerabilities in the components of the perimeter security system (PSS); and
sending commands from an Application Program Interface (API) controller towards the perimeter security system (PSS) for remediating at least one of the components of the perimeter security system (PSS) having the identified vulnerabilities.
35. The method of claim 1 , additionally comprising analyzing the operation data in the traffic by processes including deep packet inspection (DPI).
36. A method for testing a mirror port for communication with a coordination device, the mirror port along either an external network or a production network, the method comprising:
receiving, by the coordination device, pre-diagnostic notification information, the pre-diagnostic notification information including:
test diagnostic traffic to be used for the testing of the coordination device and at least one mirror port associated with the coordination device, the test diagnostic traffic including at least one of: a number of the packets and/or certain data within the packets, of the test diagnostic traffic, and
a time when the test diagnostic traffic will be transmitted to at least one production service along the production network;
the at least one mirror port providing a copy of the test diagnostic traffic to the coordination device, corresponding to the time that the test diagnostic traffic was transmitted to the at least one production service, for which the test diagnostic traffic traversed at least one of the external network or the production network, towards the at least one production service; and
analyzing at least one of: the number of packets and/or the certain data within the packets, in the copy of the test diagnostic traffic to the coordination device, as provided in the pre-diagnostic notification information received by the coordination device, to determine operational status of the at least one mirror port.
37. The method of claim 36 , wherein the test diagnostic traffic is sent from at least one diagnostic monitor.
38. The method of claim 36 , wherein the test diagnostic traffic comprises legitimate traffic from the external network.
39. The method of claim 36 , wherein the analyzing the certain data within the packets includes deep packet inspection.
40. The method of claim 36 , wherein the at least one production service is hosted by one or more production servers.
41. The method of claim 37 , wherein the test diagnostic traffic is transmitted independently of the at least one diagnostic monitor, when a start time and/or end time of the test diagnostic traffic is unknown.
42. A method for determining the route of an attack into a production network, the production network including at least one production service, from at least two network segments, including at least one external network segment, comprising:
(a) configuring one or more coordination devices for communication with at least two of the network segments, each of the at least two network segments communicating with: 1) a production network, and 2) a perimeter security system (PSS), the perimeter security system (PSS) upstream from the at least one production service;
(b) receiving, by the one or more coordination devices, pre-attack notification information, the pre-attack notification information including: one or more types of attacks for launching along any one or more of the at least two network segments, and targeting the at least one production service; and
(c) collecting, by the one or more coordination devices, operation data corresponding to traffic sent along at least one of the network segments towards the at least one production service and the operation data having at least partially traversed the perimeter security system (PSS) during an attack based on the one or more types of attacks of the received pre-attack notification information, and the collecting during the attack based on the one or more types of attacks based on the received pre-attack notification information.
43. The method of claim 42 , wherein the pre-attack notification information includes, a time of the attack, and one or more of: the type of the attack, a number of packets in the attack, and/or certain data in the packets in the attack.
44. The method of claim 43 , wherein the time of the attack includes an exact time of the attack.
45. The method of claim 43 , wherein the time of the attack includes an approximate time of the attack.
46. The method of claim 42 , wherein the at least one production service is hosted by one or more production servers.
47. The method of claim 42 , wherein the perimeter security system (PSS) is within the production network and at least partially in the at least one external network segment.
48. The method of claim 47 , wherein the perimeter security system (PSS) comprises at least two of the group of:
External Security Services (ESS) Module;
DDoS mitigation module;
Firewall;
Antivirus;
Anti-malware;
Sandbox protections;
Antispam;
Web Application Firewall (WAF); or
Intrusion Protection System (IPS).
49. The method of claim 42 , wherein the attack is initiated by one or more simulators in communication with a simulator controller.
50. The method of claim 49 , wherein the simulator controller is in communication with a monitor controller.
51. The method of claim 50 , wherein the one or more simulators are in communication with the monitor controller.
52. The method of claim 51 , wherein if any of the one or more simulators loses communication with the simulator controller or the monitor controller, the one or more simulators terminates the attack.
53. The method of claim 52 , wherein if the simulator controller loses communication with the monitor controller, the simulator controller initiates a notification to the one or more simulators to terminate the attack.
54. A method for testing depth of penetration for perimeter security of a network, comprising:
(a) configuring at least one coordination device for communication with at least two points of at least one network, the at least one network including at least one production service, and a perimeter security system (PSS) for mitigating multiple threats upstream from the at least one production service;
(b) receiving, by the at least one coordination device, pre-attack notification information, the pre-attack notification information including: one or more types of attacks to be launched against the at least one production service;
(c) collecting, by the at least one coordination device, operation data which has at least partially traversed the perimeter security system (PSS) during an attack of the one or more attack types in the received pre-attack notification information, and the collecting from the at least two points of the at least one network, based on the attack of the one or more attack types from the pre-attack notification information; and
(d) analyzing the operation data collected by the at least one coordination device from the at least two points of the at least one network, for one or more of: packet leakage and/or the certain data within the packets, to determine one or more of: the downstream depth of penetration through the perimeter security system (PSS) towards the at least one production service by the attack, or, the effectiveness of one or more components of the perimeter security system (PSS).
55. The method of claim 54 , wherein each of the at least two points of the at least one network includes a mirror port.
56. The method of claim 54 , wherein the analyzing the operation data collected by the at least one coordination device, additionally comprises:
identifying vulnerabilities in the one or more components of the perimeter security system (PSS); and
sending commands from an Application Program Interface (API) controller towards the perimeter security system (PSS) for remediating at least one of the one or more components of the perimeter security system (PSS) having the identified vulnerabilities.
57. The method of claim 56 , wherein the one or more components of the perimeter security system (PSS) comprise at least two of the group of:
External Security Services (ESS) Module;
DDoS mitigation module;
Firewall;
Antivirus;
Anti-malware;
Sandbox protections;
Antispam;
Web Application Firewall (WAF); or
Intrusion Protection System (IPS).
58. The method of claim 56 , wherein the at least one network comprises a plurality of networks, the plurality of networks including an external network and a production network, and the at least one production service is on the production network.
59. The method of claim 58 , wherein the perimeter security system (PSS) is within the production network and at least partially in the external network.
60. The method of claim 56 , wherein the identifying vulnerabilities includes instructing the API controller to send one or more commands, and is performed by a monitor controller or the at least one coordination device.
61. The method of claim 54 , wherein the pre-attack notification information includes, a time of the attack, and one or more of: the type of attack, a number of packets in the attack, and/or certain data in the packets in the attack.
62. The method of claim 61 , wherein the time of the attack includes an exact time of the attack.
63. The method of claim 61 , wherein the time of the attack includes an approximate time of the attack.
64. The method of claim 54 , wherein the attack is initiated by one or more simulators in communication with a simulator controller.
65. The method of claim 64 , wherein the simulator controller is in communication with a monitor controller.
66. The method of claim 65 , wherein the one or more simulators are in communication with the monitor controller.
67. The method of claim 65 , wherein if the simulator controller loses communication with the monitor controller or the simulator controller, the simulator controller or the monitor controller initiates a notification to the one or more simulators to alter or terminate the attack.
68. The method of claim 54 , wherein the at least one coordination device includes a plurality of coordination devices, and different ones of the plurality of coordination devices communicate with at least one point of the at least one network.
69. A system for testing comprising:
a coordination device configured for communicating with a network, the coordination device including:
a receiver for receiving pre-attack notification information via the network, the pre-attack notification information including: one or more types of attacks to be launched; and
a collector for collecting operation data corresponding to traffic of an attack on the network which has at least partially traversed a Perimeter Security System (PSS), which was sent to a downstream target on the network, the traffic sent to the network based on the pre-attack notification information, and the collecting is during the attack on the network based on the pre-attack notification information.
70. The system of claim 69 , additionally comprising a Perimeter Security System (PSS) at least partially along the network to protect the downstream target.
71. The system of claim 70 , wherein the perimeter security system (PSS) includes two or more components selected from the group consisting of:
External Security Services (ESS) Module;
DDoS mitigation module;
Firewall;
Antivirus;
Anti-malware;
Sandbox protections;
Antispam;
Web Application Firewall (WAF); or
Intrusion Protection System (IPS).
72. The system of claim 71 , wherein the coordination device communicates with one or more mirror ports which receive traffic having traversed one or more of the components of the perimeter security system (PSS) along the network.
73. The system of claim 69 , wherein the coordination device or a monitor controller is configured to determine, by monitoring the response of the downstream target, whether the operation data is out of a predetermined range, and, if the operation data is out of the predetermined range, initiating a notification to one or more simulators to alter or terminate the attack.
74. The system of claim 69 , wherein the downstream target comprises a production service along the network downstream from the perimeter security system (PSS).
75. The system of claim 74 , wherein the production service is hosted by one or more production servers.
76. The system of claim 69 , wherein at least one emulated service is deployed on the coordination device, the emulated service configured for receiving a simulated attack associated with the pre-attack notification information for receiving pre-attack notification information, and/or, for receiving and sending signaling associated with the pre-attack notification information.