Simulating realistically, no empty promises! Cyritex Security Metrics validation Platform Upgrades Again

This summer, the Mersatech Security Metric Validation Platform V3.0 and its SaaS version were released. Since the launch, we have continuously gathered feedback and various requirements from our customers. As 2023 approaches its end, after interacting with customers and making continuous improvements, we have ushered in the brand new version 3.2. This release brings a series of exciting enhancements, significantly boosting the platform's utility and security.

—

New Target Machine Mode for Detection Rules

The detection rules within the platform can initiate threat detection against real business hosts in the customer's environment. During this process, some attack methods require specific environments or paths to complete detection. Meeting user needs, Mersatech has added a target machine mode, completing the detection of these special rules through the target machine environment created by Mersatech.

—

Unified Upload Interface for Agent Logs

When an error occurs during the validation process, the root cause can be quickly located by checking the agent logs. Given the difficulty of logging into the agent to view logs in many situations, Mersatech has improved the log transmission method based on user habits, allowing agent logs to be fetched to the platform with a single click. This makes it convenient for users to troubleshoot errors or submit logs to Mersatech's after-sales support team for issue resolution.

—

Custom Parameter Judgment for Task Execution Results

Some DNS security products will reply with fixed IP addresses upon receiving malicious domain requests, redirecting user access to a controlled environment. This might cause a discrepancy in the platform's original determination of the malicious domain resolution results. To better adapt to such security products, this upgrade specifically adds a custom function for results.

In the future, Mersatech will add custom result judgments to more types of validation actions to cope with different security product detection and response mechanisms in various customer environments.

—

Protected Sandbox Network Details and Custom Rollback Time

The most noteworthy feature in this product iteration is the optimization and upgrade of the Protected Sandbox. The Protected Sandbox is Mersatech's unique environment that can run destructive endpoint attack behaviors while maintaining zero impact on user assets. Users can safely execute ransomware, cryptominers, and all irreversible destructive attack behaviors in this environment. The unique capability of the Protected Sandbox is attributed to its architecture and functional design by the Mersatech R&D team:

The Protected Sandbox is controlled by strict virtual network access policies. It can only communicate with the validation brain and the endpoint console, and its communication is entirely completed through push methods, isolating attack spillover on the network;
After the task execution is completed, the Protected Sandbox can quickly restore the enterprise standard image template, rapidly cutting off the possibility of destructive actions spreading, and ensuring that the sandbox can continue to execute the next validation action.

▌New Feature: Monitoring and Display

This upgrade simultaneously improves the user experience of the Protected Sandbox, introducing real-time monitoring of sandbox network traffic as well as the display of the current access control list. This helps users know whether redundant policies are open or if some important traffic is being unnecessarily blocked. The figure below displays the current network communication status and details of the Protected Sandbox, which users can intuitively grasp through this table.

▌Validation Library Expansion: Running Real Attack Samples

In addition to functional additions, over the past four months, Mersatech has expanded the validation actions executable within the Protected Sandbox. Currently, the ransomware families tracked and incorporated into the attack simulation library exceed 80, and threat groups have reached 300+. The vast majority of these groups' endpoint validations require the intervention of the Protected Sandbox to complete. The Mersatech security research team spent a great deal of time collecting and analyzing samples from these groups. These samples are not just dropped in the Protected Sandbox, but are actually executed.

▌Real Attack Sample Execution

The video below demonstrates the execution of a ransomware. After execution, the files on the desktop are encrypted, and a ransom note appears, instructing the victim to pay a ransom. After the ransomware takes effect, the Protected Sandbox will quickly restore to the enterprise standard image template, allowing the operating system to be used normally again once restored.

Version 3.2 of the Mersatech Security Metric Validation Platform once again strengthens the execution of real attack samples, maintaining industry leadership while ensuring your environment remains unaffected.

Mersatech upholds the principle of user-first, driving our product innovation with user experience at its core. We look forward to providing you with more efficient and comprehensive security validation solutions to maximize the return on your security investment.