Simulated Hacker Attacks

When battling a determined foe, combatants often try to simulate an enemy's plan of attack and prepare defenses and potential counterattacks. That's true for armies, boxers, and business-technology managers who must fend off hackers looking for new ways to attack computers and networks.

It's a tough challenge when more than 70 software vulnerabilities are discovered each week, and all a hacker needs to do to gain access is find one misconfigured server, an unpatched operating system, or a poorly designed application. Even with a full suite of security technology such as antivirus software, firewalls, patch-management applications, and network and software vulnerability scanners, it can be hard for security professionals to find all of the potential holes in their systems and know which vulnerabilities pose the greatest risk to their assets.

Skybox's attack-simulation software pays for itself, WesCorp's Hoff says.

Business-technology managers can benefit from looking at their infrastructure the same way hackers analyze computer systems and networks, says Chris Hoff, chief information security officer and director of enterprise security services for financial-services cooperative Western Corporate Federal Credit Union. To accomplish that, Hoff has turned to Skybox View from Skybox Security Inc., which combines information from a variety of sources, including asset- and network-management tools, firewalls, and vulnerability scanners, to simulate how hackers might attack. Pricing for Skybox View starts around $50,000.

Hoff says Skybox View software has helped him more efficiently protect WesCorp's systems by showing him a variety of ways a hacker might attempt to breech those systems. It also helps him focus on fixing the software vulnerabilities that create the most risk to his systems and predict how system changes, such as adding a server or application, could potentially create new security holes.

"The power with this type of software is the security professional can create what-if scenarios that help them to more quickly spot likely vulnerabilities hackers would attack," says Pete Lindstrom, research director at Spire Security.