Could someone describe the difference between MAS and CA? Is MAS derived from CA or do they share similar principles, or are they completely different entities that are used together to simulate complex behaviors?
Please go through the link bewlo to get the more details about the topic you are referring to:
http://link.springer.com/chapter/10.1007/978-1-4471-0709-5_4#
Related
I am currently looking for a proprietary Breach and Attack Simulation (BAS) solutions or open-source threat simulators to automatically test a wide range of attacks and malicious activities, perform security audits and find security gaps in a company to strengthen its defense.
I planned to make a market research about the existing attack and breach simulation solutions by comparing their features to know which one will best fit the requirements of the company.
I managed to make a comparison of open source threat simulators because there are scientific articles (such as Zilberman P., Puzis R., Bruskin S., Shwarz S. and Elovici Y., SoK: A Survey of Open-Source Threat Emulators, Polina Zilberman, 3 March 2020). The articles make useful comparison between the open-source threat simulators and explain the procedure and steps to make the right choice among the existing open-source threat simulator according to the company's environment, objectives, operations, etc.
However, when it comes to proprietary BAS solutions, it is more difficult to make a meaningful comparison as they are highly expensive, close source and do not provide detailed documentation. I have found a few websites that rank the best BAS platforms such as the following sites:
https://roi4cio.com/catalog/en/products?categories=895
https://www.comparitech.com/net-admin/best-bas-tools/
https://www.esecurityplanet.com/products/breach-and-attack-simulation-bas-vendors/
https://www.peerspot.com/categories/breach-and-attack-simulation-bas
https://sourceforge.net/software/breach-and-attack-simulation-bas/
Based on these sites, I chose the following BAS vendors: SafeBreach, Picus Security, Cymulate, XM Cyber, AttackIQ, CyCognito. For each of them, a demo has been requested by putting in the user information like email address. Normally, I will get the demos for the next few days. Based on the demos, I hope it will be possible to compare the features of the different proprietary BAS products.
Does anyone know of any useful papers, articles, websites, posts or books that provide a detailed comparison or explanation of existing proprietary BAS solutions? Can anyone help me or advise me on how to obtain and search information about existing proprietary BAS solutions? In this way, it will be possible to choose the BAS solution that best suits the needs of the company.
Thank you very much,
Nicolas Gennart.
You can check the SANS whitepaper in the link. Advantages of Going Purple
Below is a link to an article from SafeBreach that may help. We have a wealth of resources on our website and I am more than glad to have a discussion with you about BAS solutions. Also, Gartner has invaluable resources that I can offer you. My email is ann.chesbrough#safebreach.com.Four Pillars of BAS
As I am largely self taught I often struggle with knowing the terminology surrounding something I logically understand, which can cause difficulty when I want to research more about it.
I (think I) know that an online service/API that your application can communicate with (e.g. through http) but which sits on another company's server falls under SaaS but may have a more specific name I am unaware of.
How is this distinguished from an application you download and install on your own server and still communicate with through an API e.g. PredictionIO?
It is very difficult to word a question when essentially I am saying 'I have literally no idea what I am talking about can you please steer me in the right direction' so I apologise for how poorly this is asked but that is what makes it so difficult to google!
What I am looking for is the keywords I need to conduct my own investigation and perhaps some good high level resources so I can familiarise myself with the classifications
Thank you
While PredictionIO is a great product (or was not sure after SalesForce acquisition), I wouldn't call that SaaS.
Most people refer to SaaS as a true hosted solution where a customer only needs to log in and create an account to get started. PredictionIO still requires infrastructure, management of VMs, etc.
Examples of SaaS would be Dropbox, Crashlytics, MixPanel, Sumo Logic, SalesForce, Stripe, etc.
I'm not sure if this is the right place to ask this question but here goes.
I'm currently looking into some different techniques to model a business proces. I need to find a suitable option for my company which develops all kind of web applications.
What i have found so far:
UML, specificly the activity diagrams
Flow charts
Windows workflow foundation
Business process modeling
I had a dive into the world of workflows but it's mainly about automating a process of a company and thats not what I'm looking for. My focus is on software and the process within.
If anyone else knows some other technique or can tell me the advantages or disadvanteges of the techniques I allready found that would be much appreciated because I'm a little stuck right now.
Right now BPMN (Business Process Modeling Notation) and UML activity diagrams are the two most popular options for that.
I think of BPMN as the right choice when you are modeling the business aspects of the organization and move to Activity Diagrams as soon as you drill down to the technical design of the software system (as a core component of the UML language, activity diagrams are a better fit when having to combine workflow information with other views of the system, expressed also as UML diagrams like class diagrams or sequence diagrams).
Note that now a UML profile for BPMN is being created which means that you will be able to mix BPMN and UML diagrams in the same project
I suggest you consider ISO/IEC 24744. It will give you a very different perspective, since it does not use the ubiquitous "organisation as machine" metaphor, going for a more opportunistic, people-oriented viewpoint.
In other words, ISO/IEC 24744 does not represent a business process as a workflow where the process to follow is the driver. Instead, a business process is represented through the work products that are involved and the people that act upon them. The process performed plays an important but secondary role.
If you are interested in why this is so, or what the advantages are, let me know and I'll be happy to elaborate.
I think you are asking about transforming your business requirements/rules into technical requirements and then into a design? After that you will implement this design into code.
Am not sure if this is what you are asking about..
I work on a project known as the Security Development Lifecycle (SDL) project at Microsoft (http://microsoft.com/sdl) - in short it's a set of practices that must be used by product groups before they ship products to help improve security.
Over the last couple of years, we have published a great deal of SDL documentation, as customers ask for more information about what we're doing.
But what I'd like to know is:
What are you doing within your organization to help improve the security of your product?
What works? What doesn't work?
How did you get management to agree to this work?
Thanks.
Honestly, Reading your book was a good start. :-)
Responding to your questions:
Crypto is a hobby of mine that I sometimes blog about (e.g. on TLS and AES). After writing my own implementation of AES, I learned enough to know beyond a reasonable doubt that I should never use my own implementation but rather use the ones written by the CryptoAPI and OpenSSL guys.
Code reviews where people that are good at security issues are marked as required.
Having a class on-site with labs to raise awareness of issues mentioned in your book as well internal mailing lists discussing new issues.
Several folks listen to the Security Now podcast to keep current on what types of issues are out there and what is getting attacked. This indirectly affects design.
Except for an on-site course and buying the code review tool, none of these require management approval.
I'm an indie mac developer, but also a platform security evangelist: I'm the author of Pro Cocoa Application Security published by Wrox. In that book I champion the secure dev technique I use myself: it's based on the Swiderski and Snyder threat modeling, but with two changes. I make it lighter weight by considering which entry points access which assets without using DFDs. I also put more focus on identifying users and misusers, which I think makes it more applicable to shrinkwrap software.
As far as tool support is concerned, I use the Xcode static analyzer (based on clang), but have found it doesn't detect some common vulnerabilities. I did file bugs though :-). I also always use the gcc _FORTIFY_SOURCE macro. There aren't good Mac risk analysis tools but I'm working on that... ;-)
I've spoken on security to Mac devs at conferences and in podcasts and gotten plenty of feedback, if you want me to clarify anything I've said or are interested in the community feedback please ask in comments. Private questions are welcome to (though I'd prefer to stay on the forum): iamleeg at securemacprogramming dot
com.
We think before we code. Strangely enough, it avoids many bugs, including those which are exploitable by adverse parties and henceforth known as "security holes".
Part of the trick is not letting anyone near a keyboard unless he has a solid amount of experience and expertise.
We are trying to better understand how to set up MapPoint (or another map application) to optimize delivery routes for us. We have the ability to push lists of delivery addresses from our .NET system but need some simple options for the drivers to select a starting point address and to be able to reorder the addresses visually if necessary. Please advise if there is sample code available for this, if we can do it through a hosted version of MapPoint or if we need to host a copy of MapPoint (or another application) on our server.
It's probably worth reading up on the travelling salesperson problem, and look into some of the algorithms used to give answers for that. You've not specified the type of transport (i.e. are you doing multi-drop, or are you following a model closer to shipping containers?).
As an aside, MapPoint might not have the best licensing model for you, and systems I've seen in the past that do this sort of thing use other routing engines, such as Clavis from AND.
There are a lot of specialist applications out there, and if you're writing this for internal use, I'd suggest evaluating those first.