|
Protocol fuzz testing is increasingly becoming a part of the standard
test and development process within service providers and product
vendors. This technique is used to measure the Resilience and Security
aspects of the service under conditions that are not pristine or
standard. It is the only way to proactively discover and prevent
security issues from occurring in the field.
Mu offers a comprehensive suite of millions of dynamically created fuzz
tests, along with intelligent automation for isolating software bugs.
The dynamic protocol fuzz tests generated by the Mu Test Suite enable
identification of previously unknown weaknesses and vulnerabilities in
a target application or service. Mu's customers launch millions of fuzz
tests against a service to proactively expose weaknesses and take
action to remediate them before these issues lead to field fire drills.
These tests will check to see if the Resilience and Security aspects of
the service being tested are at desired levels. Some typical test types
include:
- Correctly formatted message received in the wrong state
- Semantically incorrect messages from a broken implementation
- Messages that structurally malformed
- Packet
flows that are incorrect due to the actions of intermediate devices
(dropped, corrupted, badly fragmented, truncated, reordered, etc.)
- Buffer overflows
The dynamic fuzz tests deliver a set of variations generated based upon
an operator's service, application or product configuration as well as
the responses from the service. Vendors select their variations based
upon building the highest quality into their products. This allows the
variations to be precisely tailored to the service being analyzed.
Remediation Toolkit
In addition to
finding issues, the Mu helps fix the issues found by providing testers
with remediation assets that can be used by engineers. These assets can
be sent to developers so that issues are replicated and fixed rapidly.
Examples of the remediation assets are packet captures, test
documentation and standalone Linux executables that replicate test
traffic.
|
