Measure Network Performance, Security and Stability

Editor's Notes

• #2: BreakingPoint was founded to help companies harden the critical components of their cyber infrastructure to be resilient against hostile conditions. And, when we say harden, we mean measurably and scientifically. This presentation willshow you precisely how this new type of product will help you pinpoint previously impossible to detect weaknesses and vulnerabilities in the discrete components of your cyber infrastructure.
• #3: One of the key drivers in designing the product and the company is the deteriorating state of cyber security. This is what led the founders to pioneer the industry’s first and only Cyber Tomography Machine that enables you to pinpoint previously impossible to detect stress fractures lurking in your cyber infrastructure.The company was founded in 2005 by engineers with experience developing high performance network and security equipment. The BreakingPoint team pioneered products at companies such as Netspeed, now part of Cisco, TippingPoint now 3Com, Hekimian, and others. In fact, our entire management team has a long track record in the network, security and performance assurance industries, launching companies that have sold for more than $3 billion. With this experience, the team has developed and honed a precision product that enables repeatable, scientific, and measurable assessments of resiliency—the optimal balance of performance and security. This powerful product combined with our exclusive Application and Security research services and support, help organizations ensure resilient cyber infrastructures. With a unique product that directly addresses growing needs for the world’s largest Enterprise, Government agencies and contractors as well as Service Providers and Equipment Manufacturers BreakingPoint has driven the rapid adoption of our products and consistently strong revenue growth. Today, BreakingPoint has become the standard for helping these customers harden their critical infrastructures to withstand attack and high stress load.BreakingPoint is headquartered in Austin, Texas with offices, customers, resellers and support teams worldwide.
• #4: BreakingPoint products are designed for the world in which we live—a perilous interconnected universe with escalating network traffic and cyber attacks from a growing list of enemies. It is the only product that allows you to pinpoint previously impossible-to-detect weaknesses and vulnerabilities in network components such as firewalls, Intrusion Prevention Systems (IPS), servers, and data centers before they can be exploited to wreak havoc within your critical network infrastructure.  Why is BreakingPoint seeing triple-digit growth during recent history’s worst economic crisis? The answer is simple: BreakingPoint gives you the peace of mind you need to know that your cyber infrastructure will survive in the face of attack and high stress conditions.Why is this so critical today?Trust is broken: Buyers no longer trust the sources they once did to provide them with the answers they need to ensure their network is secure and high performance.Stakes are higher: The costs and liabilities associated with even the smallest security breach are escalating.Budgets are tight: Companies must scrutinize every IT purchase to ensure they are getting the most value for their dollar.There is little appetite for risk: You need to know with certainty how every network device, network or data center in your critical infrastructure will performance with the Global cyber infrastructure is under attack. It was never designed to be impervious to high-stress traffic. Each day, tens of thousands of individuals attack networks throughout the world, for reasons ranging from amusement to organized cyber crime. In fact, cyber attacks have become pandemic. They are like a costly disease in need of eradication. Unfortunately, just like a virus, these attacks morph to evade detection. Just when you think that your cyber defense systems are configured to block these attacks, hackers introduce new, more sophisticated evasions.The problem has become so bad and the costs so high, that addressing the world’s security vulnerabilities has become a top priority for the biggest enterprises and nations .But, there is much work to do, as the world’s top Governments, Enterprises, and Service Providers are operating on a cyber infrastructure riddled with thousands of weaknesses and vulnerabilities. These weaknesses are virtual stress fractures that can easily be triggered to cause devastating damage in the form of loss of intellectual property, paralyzed operations, and staggering legal liabilities.Until now, there was no way to determine how key components of IT infrastructure would hold up under crippling conditions, leaving us all exposed to cyber exploitation, theft, and acts of terrorism. 60 linear feet
• #5: Why Cyber Tomography? Why Now?While the term Cyber Tomography may sound like an improbable way to describe a cyber security product, consider the following analogy. X-ray Computed Tomography (CT)—or the medical CAT scan—was a breakthrough that allowed physicians to visualize the inner workings of the complex human body under prescribed scenarios to detect impossible-to-see abnormalities.  Much like a CAT scan requires the injection of dyes and the emission of radiation in order to see into the body, BreakingPoint’s Cyber Tomography Machine (CTM)—the BreakingPoint Storm CTM—emits extreme application and malicious traffic into network devices and systems while recording and displaying the effects over time. By pioneering Cyber Tomography, BreakingPoint enables users to see for the first time the virtual stress fractures lurking within their cyber infrastructure. Cyber Tomography is a scientific method of identifying the weaknesses and vulnerabilities of a cyber infrastructure component in order to measure its resiliency under high-stress hostile conditions. With repeatable, scientific, and measurable assessments of resiliency—the optimal balance of performance and security—you will know with certainty how your network will perform in the face of extreme traffic volume and attack. With the BreakingPoint Storm Cyber Tomography Machine you can “X-ray” cyber infrastructure components to exposes previously impossible to detect vulnerabilities within cyber infrastructure components before they are exploited to destroy what is most important to you—your customer data, your assets, your reputation, and even national security.
• #6: Businesses, Governments, and Internet users expect secure, reliable, and fast access to data and communications. When security measures slow network performance, communications are lost, agility is compromised, and billions of dollars are wasted. If security measures are not rigorous, critical information and national security are compromised and costs skyrocket. The goal is to find the optimal balance of security and performance to assure cyber infrastructure resiliency.The enemy of resiliency is network mayhem. Today’s public and private network infrastructures are complex, dynamic, and increasingly vulnerable to network mayhem in the form of cyber attacks, viruses, human error, and escalating traffic from bandwidth-heavy or easily compromised applications such as BitTorrent, Gmail, YouTube, Twitter, iPhone, Skype, and hundreds of others. Based on a breakthrough in network processor technology and a future-proof product architecture, only BreakingPoint can produce the real world conditions necessary to provide this insight: A custom blend of stateful application and malicious traffic for your network at 40 gigabits per second.An always-current real world mix of applications and attacks.Unprecedented scalability producing true global network scenarios and traffic from millions of users.  Emits High Stress Traffic Comprised of Millions of Users,40 Gb of Stateful Applications and 80,000 SSL Sessions Per SecondBreakingPoint Storm CTM emits a high-speed mix of hundreds of application protocols, thousands of security attacks and millions of users to measure the resiliency of your network infrastructure against attack and high-stress load. High Speed Blended Application Traffic – Assault network devices and networks with up to 40 Gigabits per second of stateful application traffic in a single chassis.Network Processor Based Architecture – Reach unprecedented performance and throughput levels with the only product architected for ultimate performance, realism and responsiveness using a patent-pending network processor-based product. The native 64-bit architecture delivers unprecedented performance in a single 3-slot chassis:30 million concurrent TCP sessions 80,000+ SSL sessions per second from a single chassis.30 million concurrent TCP sessions1.5 million TCP sessions per second600,000 steady state complete TCP sessions per second1 GigE and 10 GigE Interfaces – Mix or match your choice of an 8-port 1 GigE or 4-port 10 GigE interface cardScalable – Scale to enormous performance levels with multiple chassis using a single interface, one configuration and integrated reporting.Comprehensive: Real World Scenarios The BreakingPoint Storm CTM is the only comprehensive solution providing simulations for any situation. Network Profiles – Use preconfigured traffic profiles built to represent a range of network scenarios—wireless, global service provider, enterprise, government, and others.Application Simulator – Measure the ability of a network device to accurately process a variety of application layer traffic flows Client Simulator – Measure the ability of a server or server farm to efficiently handle extreme traffic volume by simulating the behavior of millions of concurrent users.Security – Subject a device to thousands of unique security attacks to validate blocking capabilities or confirm the stability of devices under attack.Session Sender – Measure a device’s ability to handle concurrent TCP sessions.  It creates and maintains large numbers of valid TCP sessions with contrived data.Stack Scrambler – Measure ability of a device to operate in the face of invalid IP, UDP, TCP, and Ethernet packets produced by fuzzing.Recreate – Capture and recreate traffic flows that are independent of network topology.Routing Robot – Measure a device’s ability to correctly route IP packets by producing IP packets with a UDP payload.  Realistic and Adaptive: 4,500+ Security Attacks, 130+ Applications, Frequent Updates The BreakingPoint Storm CTM adapts to the ever-changing cyber landscape with the latest real-world applications and security attacks.Real-Time Attacks – Search and blend attacks from an extensive and always current library of 4,300 realistic security attacks with updates published by our dedicated team of in-house security researchers.  Using advanced security coprocessor technology, these attacks are randomized, obfuscated, and undetectable by trivial pattern-matching Intrusion Prevention System (IPS) algorithms.Microsoft Tuesday Updates – Ensure your network or device is fully covered with full Microsoft Tuesday coverage.Custom Attack Toolkit – Use this optional toolkit to write and accelerate your own attacks.Real-World Applications – Select and blend stateful application traffic from a library of over 100 of the world’s most popular protocols: AOL® IM, FIX, IBM DB2, VMware® VMotionTM, HTTP, Microsoft® CIFS/SMB, MAPI, Oracle, Encrypted BitTorrent™, eDonkey, RADIUS, SIP, Windows Live Messenger, World of Warcraft®, Yahoo!® Messenger, and many others.With the unique capability to simulate these real world conditions at never before seen performance levels, only BreakingPoint products can truly measure the resiliency and accuracy of products that rely on deep packet inspection (DPI) technology—network devices, lawful intercept systems, data loss prevention solutions and more. By measuring the resiliency—performance, security and stability—of discrete network components under high-stress hostile conditions, BreakingPoint enables you to find the hidden stress fractures lurking within your critical network. BreakingPoint creates network mayhem by simulating true global network conditions with a current mix of blended application traffic and live security attacks at live network speeds, as well as traffic from millions of users, to assure resilient networks, Web applications and cloud services.Powered by high-speed network processors and specialized hardware, the BreakingPoint Storm emits high-speed simulations composed of a global, custom, and current mix of application and attack traffic. This precision product then images the effects of the stress vectors on a discrete device or a device within a network.
• #7: Interpreting the results of product, network and data center assessments is almost as big a challenge as creating the conditions required to score them. This is especially true as network performance levels and traffic volume grow unabated. BreakingPoint provides the wizard-like Simulation Labs and Automated Reported you need to accelerate the set up of complex simulations and interpret the results. The product generates executive-level results with analysis of results as well as detailed documentation for experts who wish to drill deep into the details of each assessment. Use these graphical reports to accelerate troubleshooting, provide definitive evidence of product issues to vendors, validate remediation and compliance.....Real World Application and Network ProfilesPre-configured stateful application traffic profiles for a range of networks: wireless, service provider, enterprise, government, higher education and othersBlend of 130+ global applications such as AOL IM®, BlackBerry Services, BBCiPlayer, eDonkey™, Encrypted BitTorrent™, FIX/FIXT, HTTP, HTTPs, IBM DB2®, MAPI, Microsoft® CIFS/SMB, Oracle®, PP Live, QQ IM, RADIUS, SIP, Skype,SMTP, VMware® VMotion™ Windows Live Messenger, World of Warcraft®, Yahoo!® Messenger No performance degradation with blended protocolsStateful recreate of captured traffic including industry leading 8 Gigabytes of traffic capture per bladeOptional Custom Application Toolkit for proprietary applications Near Real Time Security AttacksSearchable library of more than 4,300 live security attacks and frequent updatesOnly comprehensive Microsoft® Tuesday coverage 80+ evasions to validate common security defensesOptional Custom Attack Toolkit  All-Inclusive Application and Threat Intelligence Access the latest attacks and applications as well as new product features, upgrades,maintenance, service and supportBacked by dedicated Application and Threat Intelligence team DPI, Data Loss Prevention, Anomaly Detection, and Lawful Intercept ValidationDPI validation using “needle in a haystack” scenariosEmbed anomalous traffic patterns and multi-lingual keywords into tens of millions of data streams Easy to Use, Easily ScalableIntuitive object oriented user interface for creating realistic simulationsWizard-like labs for accelerating configurationScales to unlimited performance levels with a single interface, one configuration and integrated reporting Unprecedented Performance and Throughput from a Single Chassis30 Million concurrent TCP sessions1.5 Million TCP sessions per second600,000+ complete TCP sessions per second40 Gigabits per second of blended application traffic80,000+ SSL sessions per second Comprehensive IPv6 Compliance ValidationMost current and complete IPv4/IPv6 dual stack validation capabilities
• #8: All-Inclusive Applications, Attacks, Service and SupportHardening cyber infrastructure is not just a “one and done” procedure. Hackers, organized criminals, and enemies of the state don’t sit still. They are highly motivated to morph and evolve their attacks for financial gain. BreakingPoint products are architected to adapt rapidly to change. This is the only way to ensure networks will be always resilient against attack. BreakingPoint continuously introduces security strikes and applications from BreakingPoint Labs through our Application and Threat Intelligence (ATI) service and support program. The only research team of its kind, BreakingPoint Labs is a team of security researchers and application protocol engineers committed to keeping the BreakingPoint Storm CTM completely current. The research team provides frequent strike and protocol updates and is on-call to provide users with any requested protocol, typically in a matter of hours. The combination of the BreakingPoint Storm CTM and up-to-date security strikes and protocols enables you to find critical cyber infrastructure vulnerabilities before it is too late.Along with the latest security attacks and applications, you will also see frequent new product featuresand performance upgrades as they are releasedDetailed, programmatic methodologies are available for most network and security devices as well as for validating specific technologies and systems at www.breakingpoint.com/resources.Security is in BreakingPoint’s DNA. Take advantage of our expertise, connections and insider knowledge to keep you always up to date.
• #9: Organizations at the forefront of the war on cyber crime rely on BreakingPoint products and expertise to: Evaluate Network Equipment: Evaluate and select the most appropriate network equipment for your infrastructure with standardized, repeatable and deterministic product assessments. Measure and harden the resiliency of firewalls, IPS, UTM, and other devices by subjecting them to real world conditions prior to deployment and after patches or configuration changes. Harden Network Infrastructures: Assault network infrastructures with a custom, global and current blend of stateful applications, live security attacks, and extreme high stress load to measure resiliency. Gain visibility into never before seen areas of your network, probing every weakness and vulnerability to pinpoint hidden stress fractures.Optimize Data Center Resiliency: Simulate the behavior of millions of users, a crush of real world application traffic and live security attacks to ensure data centers will be resilient under hostile conditions. All without the need to deploy racks of high-speed servers and costly software.Mitigate Device and Patch Deployment Risks: Mitigate the risk of rollouts, patches, updates, and remediation with predictive insight into how your network will perform under a changing mix of high stress and hostile conditions. Automatically produce detailed reports to speed problem resolution.Maintain Resiliency and Compliance: Identify network devices or systems that would benefit from tuning and configuration changes. Audit and maintain standards compliance.Research and Train Security Experts: Simulate and analyze real world global-scale network conditions to conduct research and train security experts. 
• #10: Hardening network infrastructures with the BreakingPoint Storm CTM and Resiliency ScoreNetworks are under constant attack. Pinpointing vulnerabilities and weaknesses within devices and systems is the first step in hardening the overall cyber infrastructure. Assault network infrastructures with a custom, global and current blend of stateful applications, live security attacks, and extreme high stress load to measure resiliency. Gain visibility into never before seen areas of your network, probing every weakness and vulnerability to pinpoint hidden stress fractures.Certification for performance and security is nothing new; in fact, we have come to expect it for everything from our phones to our automobiles. Yet cyber infrastructure equipment, which supports our businesses and governments, has no standardized certification for performance and security. Instead we rely on statements made in product marketing literature, which are based on best-case scenarios, not real-world truths. Organizations want measurable answers, not assurances, when it comes to cybersecurity. The BreakingPoint Resiliency Score replaces marketing assurances with the measurable answers needed to harden cyber infrastructure against attack and peak application load. Using BreakingPoint Resiliency Score, available within the BreakingPoint Storm CTM, enterprises, service providers and government agencies can evaluate equipment using an objective, repeatable and scientifically measured certification of the performance, security and stability of any network or network device. The BreakingPoint Resiliency Score is a highly automated, relevant and reproducible scoring mechanism that measures the performance, stability and security of a network or network device under real-world application traffic, real-time security attacks, heavy user load, and other methods. The BreakingPoint Resiliency Score lets you:Conduct standardized, deterministic and repeatable bake-offs to evaluate vendor performance and security claims.Establish risk models for managed security service engagements.  Institute and consistently analyze accurate and realistic liability models.Identify deployments that are inherently less resilient and therefore have more risk.Create tiered pricing models that take into account the liability and risk models.Identify and remediate security and performance degradation over time to ensure ongoing resiliency.Rightsize your infrastructure by evaluating resiliency based on deployment scenarios.Make more informed network device or service purchase decisions. 
• #11: Accurate Lawful Intercept validationDPI, Data Loss Prevention, Anomaly Detection, and Lawful Intercept ValidationDPI validation using “needle in a haystack” scenariosEmbed anomalous traffic patterns and multi-lingual keywords into tens of millions of data streams Push lawful intercept systems to the limit to validate accuracy and boost performanceCountries throughout the world have adopted legislative and regulatory requirements for providers of public and private communication services (service providers) to design and implement their networks to support authorized and legal electronic surveillance. Lawful intercept is used to gather and pass on information that can aid criminal investigations and protect national security interests. International standards organizations are also developing standards to guide service providers and manufacturers in specific lawful intercept capabilities. Lawful intercept evaluationThe burden of installing and operating lawful intercept (LI) systems falls on the shoulders of the service providers. Deadlines imposed by local and international bodies are looming, and the imperative is clear: implement lawful intercept capabilities in full compliance with standards requirements, and to do so as quickly and cost effectively as possible. Lawful intercept is a complex capability and poses formidable technical and practical challenges and not all platforms are equally suited to the task. Service providers are now evaluating lawful intercept technologies and services in order to find the best fit and meet their deadlines and requirements.Lawful intercept and deep packet inspection (DPI)Lawful intercept relies upon validated performance of deep packet inspection (DPI) devices </solutions/harden-cyber-infrastructure/dpi-performance-validation/>  in order to conduct electronic surveillance of circuit and packet-mode communications as authorized by judicial or administrative order. To track and interpret specific communication sessions, lawful intercept systems must be able to inspect not only packet headers and footers, but also the payloads themselves, where the message contents are carried. DPI, as discussed in this same solutions section, is very demanding on cyber infrastructure devices and systems, potentially introducing latency. Specifically, traffic from applications such as VoIP, chat and peer-to-peer (P2P) involve not only a primary connection between initiator and responder, but also secondary connections negotiated within the primary connection. This complexity within a lawful intercept solution using DPI capabilities can be a huge challenge for network and IT administrators.Lawful intercept MUST workThere is not room for error when talking about lawful intercept. These systems can not miss even one stream of data, since this could be the difference when stopping criminal activity. Additionally it has become clear from government regulations of lawful intercept that if a system does not work properly their could be significant punishments for the service provider that choose and implemented this system. Validating that a lawful intercept solution is working properly means simulating the exact and unique network traffic the system will see in the real world and pinpointing any vulnerabilities or weaknesses in the system before it is deployed.Validating lawful intercept with BreakingPoint Storm CTM™Service providers are asking themselves if their lawful intercept solution will stand up in high-stress hostile network conditions, be accurate at all times, recognize all languages, all while not introducing unacceptable latency to their services. BreakingPoint Storm CTM </cyber-tomography-products/breakingpoint-storm-ctm/>  allows service providers to realistically validate the performance, accuracy and stability of any lawful intercept solution prior to deployment and throughout the system's life cycle. The key is in simulating real-world application traffic that lawful intercept systems must be able to recognize including all major web mail, P2P, VoIP and other communication protocols. Additionally this must be done at high-performance and with the ability to hide data streams within packets in order to truly test the lawful intercept system. BreakingPoint Storm CTM provides the key capabilities for validating lawful intercept:Verify lawful intercept accuracyLawful intercept systems typically begin capturing communications in response to a triggering event, such as the detection of a user login belonging to a surveillance target, or a keyword match (e.g., “bomb.”). This, of course, includes recognizing trigger events that are using foreign languages. The BreakingPoint Storm CTM provides more than 100 application protocols to ensure the lawful intercept system can handle each, but also allows for embedded data or "needle in a haystack" simulation. Users can embed text or files within any application protocol and validate that the lawful intercept solution finds the potential trigger.Assess lawful intercept performanceThe importance of lawful intercept not withstanding, the performance of a network or services can not suffer when the system is deployed. Today, since government mandates specify that lawful intercept activity must be undetectable to parties being monitored, the systems are passive and not sitting in-line. This means any processing latency is not detectable to users. However, as lawful intercept systems evolve and take on a greater role in responding to illegal content, in-line handling will become necessary. The BreakingPoint Storm CTM allows service providers to plan for the future of lawful intercept by generating application traffic at line speeds of tens of gigabits per second. Simulating realistic traffic at these speeds will not only validate that the lawful intercept solution works properly, but will also identify performance issues that may arise when it is deployed.The BreakingPoint Storm CTM is the only solution that service providers can rely on to validate lawful intercept system performance during pre-deployment assessment and throughout the systems life cycle to ensure it continues to work as promised within your changing landscape.
• #12: Each day major changes are taking place that put additional stress on your data center infrastructure and introduce vulnerabilities that could be exploited. Measuring the true performance and security of a data center before deployment of devices and applications, as well as throughout the life cycle of change, leads to better overall optimization and a more resilient infrastructure:Assessing Data Center Resiliency with Extreme Application LoadAssessing Cloud Infrastructure Resiliency Against Hostile ConditionsMeasuring Server Resiliency Under Load and AttackReplicate cyber war to assault cyber infrastructure elements & identify weaknessesMulti-gigabit performance with infinite scalabilityBlended application mix and arsenal of current attacksAbility to write and generate custom applications and attacksEasy to use with single interface and integrated reportingAt one major military installation, BreakingPoint replaced 60 linear feet of racks of high speed servers with just one 2 slot BreakingPoint chassis. Capabilities for server load testing by simulating hundreds of thousands of simultaneous client sessions and generating 40 Gigabits per Second (Gbps) of blended application traffic BreakingPoint Client Simulator enables you to eliminate racks of servers and costly software licenses traditionally required for software-based server load testing. Validating the integrity of server transactions under real-world conditions and peak performance.Allowing companies to easily measure end-to-end performance, diagnose application and system bottlenecks and fine-tune them for optimal performance.
• #13: Standards within networking and IT are constantly evolving, as are government regulations and certification. In this solutions section, we take a look at several solutions BreakingPoint provides for validating the compliance of cyber infrastructure elements and systems:Resiliency ScoringIPv6 Dual Stack Compliance and Performance Validation Changes in your network or threats detected in the wild have an immediate and dramatic impact on resiliency. As resiliency trends down over time due to these changes, BreakingPoint gives you the insight you need to remediate problems driving performance, security and stability back to the right levels. When your monitoring systems detect a change or BreakingPoint’s research team finds a new threat, you can easily update your BreakingPoint Storm CTM to score devices, networks or data centers for resiliency and produce the insight you need to remediate.Hardening cyber infrastructure is not just a “one and done” procedure. Hackers, organized criminals, and enemies of the state don’t sit still. They are highly motivated to morph and evolve their attacks for financial gain. Dedicated Security and Application Research team capturing attacks in the wild and distributing changes to traffic profilesRisk Proof: Mitigate risk of introducing problems with device deployment, patches, updates, and remediation efforts by providing predictive insight into how your network will perform under a changing mix of high stress and hostile conditions. Maintain: Identify network devices or systems that would benefit from tuning and configuration changes.
• #15: This is a partial list of the 130+ application protocols we support. Our coverage includes the most popular protocols for generating real network traffic for both wired and wireless networks. These applications can be blended and delivered statefully and mixed with malicious traffic for the most realistic traffic profiles available. This list increase each week as new protocols are published. Customers with current maintenance contracts have access to all of these protocols as well as any new protocols that are published as part of their all inclusive purchase agreement.
• #16: This is a partial list of the 130+ global application protocols we support. Our coverage includes the most popular protocols for generating real network traffic for both wired and wireless networks. These applications can be blended and delivered statefully and mixed with malicious traffic for the most realistic traffic profiles available. This list increase each week as new protocols are published. Customers with current maintenance contracts have access to all of these protocols as well as any new protocols that are published as part of their all inclusive purchase agreement.