RedWolf Insider Threat Platform

​The most comprehensive Insider Threat scenario generator

Today's security infrastructures often combine multi-vendor technologies in a 'defense-in-depth' approach. The effectiveness of the security system depends upon the right technologies, deployment and configuration. Traditional security testing systems are too often focused on 'vulnerabilities' and neglect the need to test the functionality of the system as a whole. Redwolf Internal Security threat simulator addresses this need by providing an easy-to-use security 'threat' generator loaded with test-cases designed specifically to test security system functionality and controls across a broad number of categories

• Data Leakage:  Varied content types (office, financial, credit card, PII, CAD/CAM, etc...) through multiple channels (Social networking, instant messaging, email, webmail, Skype, Peer to Peer, etc...)
• Employee Internet Usage:  Simulate abuses of: Social Networking, Webmail, Instant Messaging, Peer to Peer, Internet file hosting, Honeypots, VOIP, Internet Downloads
• Malware: Safely simulate malware ingress from a variety of internet sources, local malware activation, malware-internet C2 communications, simulated compromised hosts
• Network Mapping:  network probing, Server mapping, switch network mapping, passive fingerprinting
• Security Bypass Techniques: Request obfuscation, Open proxies, Onion Routing (TOR),  VPN's (HTTPS, SSL, IPSEC),  DNS Tunneling, ICMP Tunneling

RedWolf's simulations can be grouped by 'Persona'. The relative complexity and techniques used match the persona profile. Example personas include:



• Standard Employee - A regular user with no malicious or mischievious intent who still may accidentally violate corporate security policy.
• Generation-Y - A user who wishes to, for non-malicious reasons attempts to bypass corporate security controls (e.g. to access Facebook or Webmail).
• Insider Mole  - A human, trained in data ex-filtration.
• Malware - Automatic, robotic behavior of the lifecycle of malware.

 

• Firewalls
• Network IDS/IPS
• Host IDS/IPS
• VM Ware Virtual Security
• HTTP/HTTPS/Socks Proxies

• System is delivered as a VM Ware appliance
• Monthly, quarterly and yearly licenses
• Enterprise licences for use on one legal entity. Price based on size of network
• Auditor licenses for security consultants. Usage based pricing