What’s new in FortiTester 7.2.0
FortiTester 7.2.0 offers the following new features and enhancements:
Support ATT&CK V10 Breach Simulation
FortiTester v7.2 comes with a new MITRE ATT&CK framework supporting MITRE matrix v10 and sub-techniques, released as beta and running concurrently with the previous v6 matrix. Users are encouraged to try and migrate to this version. Note: The two versions (v6 and v10) are not compatible. Here’s an overview of differences between different versions:
|
FortiTester v3.9/4.x/7.0/7.1 |
FortiTester v7.2 |
Comments |
|
|---|---|---|---|
|
MITRE ATT&CK matrix version |
V6 |
V10 |
|
|
Sub-techniques support |
No |
Yes |
|
|
End point agents support |
Windows only |
Windows / MAC / Linux |
|
|
Number of techniques (Abilities) |
26 default 300+ total |
95 default 200+ total |
More updates will be made available for v10 via FortiGuard |
|
Default Campaigns (Adversaries) |
4 (Credential Dumping, Execution_Through_API, PowerShell, Scheduled_Task) |
8 (Check Systems Environment, Create Exfiltrate Directory, User and Domain information Extraction, Process Enumeration, Signed Binary Proxy Execution, Find and Exfiltrate files, Install Powershell, Bypass UAC User Access control on Windows) |
|
|
Exfiltrate files |
Separate server on network |
FortiTester |
New ATT&CK v10 menu
MITRE v10 with sub-techniques support:
Separation of Test Case ports and physical ports
This new feature allows configuration export/import between different models.
Previous v7.2 Fortitester configuration could only be exported/imported between the same model. In v7.2 this limitation is removed, made possible with the use of Test Case ports mapping to physical ports in tests. With this change, FortiTester introduces new objects, such as port mapping and port settings.
Allocation of extra vCPUs for VMs
FortiTester v7.2 allows for the allocation of two extra vCPUs more than total licensed vCPU for system management. For example, a VM04 can use 4 vCPU for traffic generation and an extra 2 vCPU's for system management.
Support of Virtual Router in SSLVPN testing
SSLVPN case include CPS, RPS, CC and Throughput now supports Virtual Router. VR is useful in public cloud testing where IP assignment is limited (e.g. AWS public cloud). Now, many SSLVPN client IP's can be simulated using VR.
Improved Report generation time
Report generation for longer tests cases (e.g. couple of hours up to days) received improvements in report generation time.
New DNS Zone Transfer support
Added DNS-AXFR case. This simulates attacker use of AXFR zone transfer as an attack vector for DDoS attacks. This new feature establishes a TCP connection (three-way handshake), simulates a DNS zone transfer (AXFR), and closes the TCP connection.
Single Packet control for DDoS testing
In previous version DDoS tests uses system default ‘mix’ of attacks (such as SYN_flood, FIN_Flood etc). Some parameters were set and not configurable by the user. In v7.2 a new single packet case option allows an advanced configuration item to refer Single Packet Group object. This feature is used to simulate a DDoS attack, specially related to the MIRAI attacks simulation.
Supports IBM Public cloud platform
New platform IBM released for FortiTester.
New ICMP test
Added ICMP Case. This allows FortiTester to generate ICMP traffic with different settings such as packet size etc, to test DUT’s capability to parse/route ICMP traffic, offering a ‘flood’ option to send simultaneous pings within configured time interval (up to 600ms).