Mercury Interactive's Security Stress Test

System and application-testing vendor Mercury Interactive Corp. is making its first foray into the security monitoring market. Some analysts say Mercury's move makes sense since sites heavily armed with security applications sometimes see their performance suffer.

Starting at $25,000, and available July 16, Mercury Interactive's ActiveTest SecureCheck is based on Mercury's load-generation technology and a security-scanning software partnership with Qualys Inc. Mercury also has partnered with Guardent and Asta Networks to help companies improve the security of their systems after the assessment.

SecureCheck runs sites through a security vulnerability and performance gauntlet. First, a map of all systems visible or accessible from the Internet is generated with the Network Discovery Scan. Second, an Infrastructure Vulnerability Scan assesses the potentially hazardous impact of heavy traffic upon software components and security services accessible over the Internet. Third, critical infrastructure and applications are targeted in a denial of service attack simulation from load farms spread across the globe. The idea here is to learn how well the servers stand up to the typical SYN, FIN, smurf, and session floods, as well as HTTP connection blocking and bandwidth saturation. Finally, the service performs an IDS Limits Scan, which tests the performance of intrusion-detection software during times of high traffic and duress.

Customers are then given an assessment report and suggestions for bringing their security up to the standards they've set for themselves.

Hurwitz Group security analyst Pete Lindstrom says these types of tests can be a natural evolution for system testing and management companies. "Security exploits, such as denial-of-service attacks, are often identified by management tools, so it's reasonable for the vendors to add complementary security features."