Transcription
The most important thing we build is trustADVANCED ELECTRONIC SOLUTIONSAVIATION SERVICESTeraVM CybersecurityThreat Database OverviewCOMMUNICATIONS AND CONNECTIVITYMISSION SYSTEMS
What’s at stake?Availability, Confidentiality, IntegrityCybersecurity, threats defy logic– Non-discriminatory nature of attacks i.e. we’re all targets (from a user smartphone e.g.Stagefright to an enterprise application e.g. Joomla)– Varied targets to manifest an exploit i.e. the network stack, a network application to localmachine & applications– Sophistication of the attack: reported vulnerabilities (CVE linked) versus unknown (tomorrow’sexploit)118 February 2016www.cobham.com/wireless
How robust is your security appliance &network applied security policy settings?Defining a comprehensive security test strategy is key:– Validation with the known versus unknown vulnerabilities(Do you validate with evolved threats created from known CVEs)– Ability to validate with the good, the bad and your own traffic signature(Validation for false-positives and false-negatives)– Continuous assessment through the lifecycle of the security deployment(Continuously analysing threat databases for new exposures)Don’t just rely on a CVE database to detect actual exploits2www.cobham.com/wireless
TeraVM cybersecurity threat databaseThe GOOD, the BAD and your OWNEmulated TargetsAssess for vulnerabilities traversing tothe insideClient Devices & ApplicationsCybersecurity AttacksServerServers & ApplicationsCompromised EndpointTeraVM comprehensive validation for security counter measures:– Emulate both attacker and victim (devices and applications)– Support for mixed traffic of good/bad/own– Share threat libraries among a user group3www.cobham.com/wireless
TeraVM sample Common Vulnerability &Exposures (CVE)Network UsersNetwork Services, Servers & InfrastructureAdobe: Acrobat and Reader, Flash Player,PhotoshopApache Software Foundation: Web Server, Tomcat,GeronimoApple: Safari, QuickTime PlayerCitrix: XenCenterWebCisco: IP PhoneCisco: ACS, Catalyst, IOSMcAfee: VirusScanMcAfee: SecurityCenter, E-Business ServerMozilla: Firefox, Seamonkey, ThunderbirdMicrosoft: IIS, Exchange Server, SQL serverMicrosoft: Windows, Internet Explorer,Powerpoint, Outlook, etcOracle: Hyperion Financial ManagementSun Microsystems: Web ServerSun Microsystems: Java RuntimeEnvironment, JDKSymantec: Veritas NetBackupA sample of the database is shown above, the complete list of the repository with 8,000 threat and exploits is available on request4www.cobham.com/wireless
TeraVM vulnerability assessment reportDon’t loose the needle in the IPstackAssessment report:Failed CVE #### (vulnerability exposure)AttackerNormal userEmulated TargetUsing TeraVM’s integratedevent policy manager quicklyidentify holes in securityTeraVM’s per flow assessment enables– Each and every threat-needle to be magnified out of the potential gigabits of traffic– Users to accurately validate the impact that security hardening has on legitimate flows– Repeatability with realism e.g. all TCP sessions are fully stateful sessions5www.cobham.com/wireless
Under attack - assess with real scenariosScale to the ferocity of a modern attackCourtesy of : http://map.ipviking.com/TeraVM enables users to deliver highly scaled and varied attack scenarios– Validate with real world scenarios i.e. variation, duration and ferocity– Determine robustness of security appliances and policy settings6www.cobham.com/wireless
Invest in the future with TeraVMEvolve defences with the threat-scapeContinuous security lifecycle assessment with TeraVM– TeraVM enables continued assessment of vulnerabilities withregular validation with the latest cybersecurity threats andexploits– TeraVM’s quarterly updates educates end-users to potentialthreats– TeraVM enables validation of ongoing security patching prior torelease7www.cobham.com/wireless
TeraVM external repositoryDon’t limit yourself to fingerprintsGet a hand on your security by using your own threats– TeraVM enables the use of an external storage device fortraffic signatures i.e. 1xTeraByte of additional data– Save and use a mix of YOUR own application traffic capturesfor assessing YOUR security– Easily extend/update the TeraVM supported cybersecuritythreat library818 February 2016www.cobham.com/wireless
McAfee: VirusScan Mozilla: Firefox, Seamonkey, Thunderbird Microsoft: Windows, Internet Explorer, . McAfee: SecurityCenter, E-Business Server Microsoft: IIS, Exchange Server, SQL server Oracle: Hyperion Financial Management Sun Microsystems: Web Server Symantec: Veritas NetBackup . -TeraVM enables the use of an external storage device for
