DEFEND. THEN DEPLOY. - Codenomicon

DEFEND. THEN DEPLOY.PREEMPTIVE SECURITY AND ROBUSTNESS TEST SOLUTIONSWhat measures canmitigate our qualityand zero-day exposure?GENERAL MANAGERNETWORK DEVICE DEVELOPERAre flaws and patchesimpacting sales anddamaging our brand?DEVELOPMENT DIRECTORCONSUMER DEVICEDEVELOPERHow resilient is our service?Will the next attack take us down?CHIEF SECURITY OFFICERCARRIER / OPERATORDo our IT infrastructuredefenses align with complianceand risk management best practices?CHIEF INFORMATION OFFICERFINANCIAL SERVICES ENTERPRISECodenomicon DEFENSICS preemptive security and robustness testing solutions empower customersto mitigate unknown and published threats in products and services prior to release or deployment -before systems are exposed, outages occur and zero-day attacks strike.

Features and BenefitsDEFENSICSDefend. Then Deploy.The Codenomicon DEFENSICS test platform providespreemptive security and robustness for Internet,wireless and digital media systems. DEFENSICS is themost effective black-box, negative test solution fordevelopers, service providers and enterprises tomitigate security exposure and system failure risks intheir applications, devices and services.Organizations are moving rapidly to take advantageof evolving converged networks and open standards.Unfortunately, in today’s connected world, threats toonline applications, networks, mobile devices andcritical infrastructure are accelerating with devastatingconsequences. In the effort to quickly leveragethe use of internetworked, wireless, mobile,distributed and client-based systems, the industry isobserving applications and respective infrastructurethat contain protocol flaws and security issues.Sophisticated attack methods, organized cyber-crimeand ever- changing attack vectors require vigilantcounteraction.Codenomicon DEFENSICS contributes to ISOdevelopment and test compliance due processstandards. The DEFENSICS test platform is used bydevelopment and security personnel in a lab orstaged environment to automate tests than extendquality and security assurance – quickly, easily andreliably. By employing DEFENSICS test softwareagainst products and services prior to release ordeployment, users can address unknown andpublished threats before systems are exposed,outages occur or zero-day attacks strike.Unlike code and web application analyzers andvulnerability scanners, DEFENSICS security androbustness test platform identifies device, softwareand service issues in advance of the threat – withoutthe burden of requiring expert resources, source codeaccess, in-depth product knowledge, definingadditional test cases, or materially prolonging testprocesses. Armed with this rigorous testing solution,users can avoid costs and liabilities associated withupgrades, patches, recalls, and service interruptionsdue to availability loss and security breaches.BROADEST PROTOCOL COVERAGEEnsure the security and robustness of yourimplementation quickly, easily and with confidence.DEFENSICS uniquely covers over 130 interfaces andformats – enabling testing of systems from the link-levelcommunications all the way up to application protocol.Beyond supporting most IP-based protocols, thecoverage extends to wireless and digital media such asMPEG video. This extensive suite coverage providesusers with intelligent negative testing and maintainedRFC coverage – identifying known and new vulnerabilitiesand hidden flaws in your current systems today, andas your protocol implementation requirements evolve.THOUSANDS OF PRE-BUILT TEST CASESInstantly expand your quality and security testscope without the manual creation cost. EachDEFENSICS test tool contains thousands of pre-defined,fully configurable test cases at your fingertips.Leveraging over ten years of security research, the testcases are optimized to efficiently discover irregularresponse, slower system reaction or terminatedprocesses or system crashes. With only knowing the testtargets protocol interfaces, DEFENSICS users can readilystart testing and see immediate results.PROVEN TEST METHODOLOGY AND TECHNOLOGYThoroughly test protocol implementations tomitigate unknown and published vulnerabilities.Beyond simple robustness test tools that mutate aroundknown vulnerabilities, trivial message sequences orrandom anomalization, Codenomicon provides fullmodel-based testing with the deepest possiblecoverage for each tested protocol. Codenomicon’spatent-pending Attack Simulation Engine (ASE)dynamically creates attack simulations to intelligentlytest a more extensive input space – at specific field,structural and message sequence levels mostsusceptible to fault, failure and security exposure. Thenet result is the identification of zero-day threats andnew exposures in even the most hardened and complexprotocol implementations.COMPLETE AND COMPREHENSIVE DOCUMENTATIONDetailed, online documentation expedites problemresolution. DEFENSICS comes with detailed documentationfor each test case to help you remediate flawsdiscovered from the systems under test. All test reportshave direct links to test cases identifying a particularproblem. Testers escalate issues to the respective vendoror development team with the exact test scenario andinput that generated the bug – streamlining problemlocation within the application function and subsequentresolution.IMMEDIATE REPRODUCTION AND REGRESSIONIdentified flaws are absolutely repeatable andtraceable. DEFENSICS users from quality assurance andsecurity analysts to engineering can remotely access thesame system and reproduce any identified flaws. Usershave fully integrated documentation, the exact test caseconstruct and input context to determine the rootcause of the defect. This negates problems where bugreproduction needs identical test environments, whichcan be an issue for externalized test applets. Theconvenience to readily reproduce bugs facilitatesprompt reaction and fix verification.INTUITIVE AND EXTENSIBLEAn easy to use test solution with easy-to-interpretresults. Users get up-to-speed and are effective withDEFENSICS quickly with access to fully indexed,well-described test cases and configuration options allwithin an intuitive interface. Users can observe tests inaction or review detailed test results linked to test casedocumentation. The platform has a completecommand-line interface and supports third party toolsand scripts. The system can interface with externalinstrumentation and monitors within defined testcondition triggers. All test results are presented in astandard format that can be conveniently incorporatedwithin existing reporting processes and systems. TheDEFENSICS platform yields accelerated time-to-value.SOFTWARE FLEXIBILITYOne test solution that supports mobile use, multilocationuse and immediate access.The DEFENSICS test platform operates on popular OS’sand nominal hardware – even on a laptop. Oursoftware-only solution gives engineering and securityprofessionals the flexibility to immediately test anysystem or devices in the field and in the lab. Thesoftware supports remote users, multiple sites, multipleprotocols, external audits and third party licensemanagement systems. By making the system accessibleto different teams and users, organizations can increaseusage and optimize resources while reducing expertstaff utilization as well as extra travel and preparationcosts.QUALITY AND SECURITY TEST BEST PRACTICESDon’t let tools dictate your processes. The DEFENSICStest platform is designed to integrate into your softwaredevelopment and system deployment test processes.The software-based test solution can be fully controlledwithin third-party test harnesses and supports a robustcommand interface. The standard reports and pinpointregression test capabilities allow for dependable testbaselines, trending and continuous security and qualityimprovement. DEFENSICS delivers a cost-effective andefficient means for product acceptance and securedevelopment lifecycle management.MULTIPLE ATTACK VECTOR DEFENSENot only are Internet-based protocols vulnerable.While the testing of IP-based protocols remains crucial, itis only one potential attack surface in increasingly opensystems. Implementation errors in the handling ofwireless inputs or digital media can be equally harmfulfor target systems. Codenomicon DEFENSICS is the onlysecurity and robustness solution that methodicallycovers the testing of three critical attack vectors:network, wireless and digital media. This includessupport for VoIP, Bluetooth, 3G, email and digital contentsuch as JPEG images, MP3 audio and MPEG4 video.DEVELOPERSWhat test measures can mitigate your system fault andzero-day attack exposures? How can you immediatelyextend your quality and security test capability?CARRIERS / SERVICE PROVIDERSHow resilient is your new service? Will the next attack affect availability?How can you enforce infrastructure or partner resiliency standards?

The DEFENSICS AdvantageCodenomicon’s technology spans more than 10 years with a security researchheritage derived from Finland’s Oulu University Secure Programming Groupand first generation PROTOS test tools. Years later, the world-provenCodenomicon DEFENSICS security and robustness test platform remainsunmatched in its ability to find quality, resiliency and security exposuresquickly within the broadest array of applications. Codenomicon has beenrecognized by the industry for its innovations in systematic blackbox negativetesting capabilities – proven through a unique, systematic, repeatable andrigorous test methodology.In Blackbox testing, a test is conducted by providing inputs and monitoringoutputs without having to rely on internal application design details.Robustness means the capability of a system to operate when subjected toanomalous inputs, attacks or other adverse environmental conditions.Robustness testing can reveal protocol implementation flaws that cangenerate issues ranging from anomalous responses and system degradationto system failure – which, if not discovered and resolved, can be exploited toresult in a zero-day attack or becoming a publicly known vulnerability.Protocols refer to the set of rules that describe how to transmit and processdata. The level of risk associated with an implemented protocol, whether it isan open or custom protocol, is relative to the protocol’s novelty, popularity,exposure, complexity, integration difficulty and update frequency.Many organizations and developers are experiencing protocol implementationflaws in products, services and infrastructure that present considerableavailability and security liabilities – least of which causing damage toreputation and financial loss. The challenge in protocol robustness testing ishow to effectively target the infinite amount of possible inputs, how toovercome the difficulties of reaching deeper inside the protocol and toensure the applicability of the tests later for regression testing.Simply put – how can you materially advance quality and security testcapabilities with modest investments in resources and time, with moreassured flaw discovery results, and with expedited means for resolution andvalidation?FIELD LEVELoverflowsinteger anomaliesINPUT ANOMALIESSTRUCTURALunderflowsrepetition of elementsunexpected elementsSEQUENCEout of sequenceomissionsunexpected messagesrepetition of messagesUserDocsRAPIDPROTOCOLMODELERATTACKSIMULATIONENGINEReportingAnomalyLibraryRUNTIMEANALYSISENGINESYSTEMUNDERTESTThe DEFENSICS test platform is based on unique technologies and expertisethat enable an intelligent targeting of robustness flaws. The systemintelligently asserts targeted attack patterns against applications utilizing apatented Attack Simulation Engine (ASE) and deep protocol modelingtechniques to overcome robustness test challenges – DEFENSICS achievesunparalleled efficiency in exposing both known and unknown vulnerabilities.ASE is the industry’s first and only state-aware attack engine that simulatesthe peers of a tested system and drives any protocol implementation throughstate machines to conduct a variety of systematic attacks when the target is atits weakest state. This simulation capability enables testing of complexprotocol dialogues, not just the initial messages or limited sequences.Architecture DEFENSICS GUIsystematicrepeatableintelligent targetingEXPOSE VULNERABILITIEScrashesdenial of servicesecurity exposuresperformance degradationthrashinganomalous behaviorThe deep protocol models provides the source material for crafting test casesfor the message level anomalies that push the target systems to the limits andquite often over the edge. Codenomicon’s test material creation incorporatesmore than ten years of experience in breaking protocols and refiningautomation capabilities of the Attack Simulation Engine. The rules provided tothe ASE automate protocol messages transformation on both structure andfield levels. Structure level transformations include anomalies like reordered orout of context fields, removed or unexpected fields and loop or recursionconstructs. Field level transformations are, for example, overflows, underflowsand format character anomalies. DEFENSICS also utilizes out-of-contextmessages, like incomplete sequences, reordered sequences and removed orrepeated messages, to further test implementations. The methodology, withthree levels of anomalies – sequence, message structure and field-level,enables DEFENSICS to yield highly accurate targeting on the most vulnerableportions of the protocol, while maintaining broad coverage throughautomatic test case generation. In short, if a product or service under testpasses DEFENSICS inspection – risk management and quality assurance isstrong.ENTERPRISESDo your customer-facing application development processes align with risk management best practices?How can you demonstrate quality and security due process and compliance?

DEFENSICSTest SuitesProtocols SupportedCODENOMICON Ltd.Tutkijantie 4EFIN-90570 OULUFINLAND+358 424 7431101 Metro DriveSuite 660San Jose, CA 95110UNITED STATES+1 408 392 900025/FQueen's Road Centre152 Queen's RoadCentralHONG KONG+852 3426 22900info@codenomicon.comwww.codenomicon.comCore Internet Net Management RoutingIPv4 (TCP, UDP, IPv4,ICMP, IGMP, ARP),IPv6 (TCP, UDP, IPv6,ICMPv6), DNS (Server,Client, Zone Transfer),NTP (Client, Server),DHCP/BOOTP Client,DHCP/BOOTP Server,HTTP Server, HTTPClient, FTP Server,DHCPv6 Client,DHCPv6 ServerHTTP Server, HTTPClient, TLS/SSLServer, TLS/SSLClient, Telnet Server,SSH1 Server, SSH2Server, SNMPv1/v2Server, SNMPv3Server, TFTP Server,UPnP ServerRemote Access VPN VoIPEAPOL Server,PPPoE, DiameterServer, DiameterClient, LDAPv3Server, TACACS+Server, TACACS+NAS, RADIUS(Server, Client),Kerberos ServerIPSec, SSH1 Server,SSH2 Server,TLS/SSL Server,TLS/SSL Client,ISAKMP/IKEv1,IKEv23G Digital Media EmailSCTP, GRE, IPSec,Diameter Server,Diameter Client,LDAP Server,TLS/SSL Server,TLS/SSL Client, SIPUAS, SIP UAC,GTPv1, GTPv0,RADIUS (Server,Client)BluetoothL2CAP, SDP,RFCOMM, OBEX,OPP, FTP, IrMCSynch, BIP, BPP,BNEP, HFP, HSP,DUN, PBAP, FAX,AVRCP, A2DP,HCRP, HID, SAP,HFP Client, HSPClientFile Systems/StorageCIFS/SMB Server,iSCSI Server,SunRPC Server,NFS ServerAIFF, AU, AMR, IMY,MP3, VOC, WAVBMP, GIF, JPEG, MBM,PCX, PNG, PIX, PNM,RAS, TIFF, WBMP, XBM,XPM, WMFAVI, Quicktime, MPG1,MPG2, MPEG4ZIP, CAB, JAR, LHA,GZIPWLAN802.11 Server,802.11 ClientIndustrial AutomationModbus, IPv4 (TCP,UDP, IPv4, ICMP,IGMP, ARP)IS-IS, DVMRP, GRE,OSPFv2, OSPFv3,PIM-SM/DM, RSVP,VRRP, BGP4, RIP,RIPng, MPLS/LDP,HSRPSCTP, H.248, H.323,RTSP Server,TLS/SSL Server,TLS/SSL Client, SIPUAS, SIP UAC,SigComp,RTP/RTCP/SRTP,MGCP, UPnPServerPOP3 Client, POP3Server, IMAP4Client, IMAP4Server, SMTPClient, SMTP ServerLink ManagementLACP, STP, MSTP,RSTP, ESTPTechnical RequirementsSupported Operating SystemsWindows XP SP2 and Linux Fedora Core 5 (or newer)System Requirements1 GHz processor (or faster), 1 GB of free disk space,1024x768 graphics resolution, 256 MB of RAM,CD-ROM or DVD drive, Network card (NIC)Sun Microsystems Java TM 2 Runtime EnvironmentStandard Edition 1.5.0_06 or higher.USB portUSB Bluetooth/WLAN transceivers included withBluetooth and WLAN tools802.11ARPBGP4BOOTPCIFS/SMBDHCPDHCPv6DiameterDNSDVMRPEAPESTPFingerFTPGREGTPv0GTPv1H.248H.323HSRPHTTPICMPICMPv6IGMPIKEv2IMAP4IPsecIPv4IPv6IS-ISISAKMP/IKEiSCSIKerberosLACPLDAPv3LPDMGCPModbusMPLS/LDPMSTPNFSNTPOSPFv2OSPFv3PIM-DM/SMPOP3PPPoERADIUSRIPRIPngRloginRPCRSTPRSVPRTCPRTPRTSPSCTPSigCompSIPSMTPSNMPv1SNMPv2cSNMPv3SRTPSSH1SSH2STPSyslogTACACS+TCPTelnetTFTPTLS/SSLUDPUPnPVLACPVRRPX.509AudioAIFF, AU, AMR, IMY, MP3,VOC, WAVArchivesCAB, GZIP, JAR, LHA, ZIPBluetooth®A2DP, AVRCP, BIP, BPP,DUN, FAX, FTP, HCRP, HFP,HSP, IrMC Synch, L2CAP,OPP, PBAP, RFCOMM, SDP,HID, SAPImagesBMP, GIF, JPEG, MBM, PCX,PIX, PNG, PNM, RAS, TIFF,WBMP, WMF, XBM, XPMVideoAVI, MOV, MPEG1, MPEG2,MPEG4© 2001-2007. Codenomicon and Defensics are trademarks of Codenomicon Ltd. All rights reserved.All other trademarks are the property of their respective trademark holders. The BLUETOOTH word mark andlogos are owned by the Bluetooth SIG, Inc. and any use of such marks by Codenomicon Ltd. is under license.All information subject to change without notice.