Security Testing for IP Services

Security Testing is a critical aspect of testing IP Services that is often overlooked. The Security Test Solution from Mu Dynamics provides three unique benefits to test teams:

• Quickly accurately and thoroughly test for exploitable software weaknesses. For the first time, Mu Dynamics allows testers to quickly drive millions of fuzz test cases through the service in a highly accurate manner. These tests are auto-generated by the Mu Test Suite and are based on patterns of weaknesses in code and design that have been identified by Mu Dynamics and others in the industry.

• Proactively test for known security attacks. The Mu Security test Solution helps automate testing against known security attacks or exploits.  This is to prevent specific attacks from exploiting known weaknesses of systems and services that have already been deployed.

• Test for network weaknesses related to Denial of Service (DoS) Attacks. The Mu DoS module helps identify the weakest link in the service. It also helps determine if the service will gracefully return to normal operation after the DoS attack is removed.

Broadly speaking, there are two aspects of security testing that need to be addressed; proactive and reactive testing. Both these aspects are important to ensuring that IP services remain secure once deployed.  The proactive security testing methodology aims to expose software weakness in IP Service before deployment on the real network.  These weaknesses could be software bugs, poor exception handling for unexpected input or poor design against resource exhaustion attacks such as distributed DoS. The modules that are appropriate for testing the security of an IP service are:

• Studio Zx
• Studio Fx
• Protocol Fuzzing
• Denial of Service
• Published Vulnerabilities

Once vulnerabilities are discovered, service providers and product vendors often put perimeter defense systems in place such as Intrusion Prevention Systems and Firewalls as a reactive and preventive measure. Testing in this reactive fashion is critical as it is often impractical to patch all of the deployed service elements in a timely fashion. The modules that are appropriate for this purpose are:

• Published Vulnerabilities
• Studio Zx
• Denial of Service