Innostage Lab Benchmarks PT NGFW 1.10.3 Performance in Eight Load Scenarios
Innostage has published the first part of its independent laboratory evaluation of PT NGFW 1.10.3, focusing on performance under realistic loads rather than isolated vendor specifications.
The team selected version 1.10.3 because it carried the FSTEC certificate required for many Russian government and critical-infrastructure projects, even though 1.11.1 was already available.
Traffic was generated with Cisco TRex using an EMIX profile derived from real internal network captures. The mix comprised HTTPS (5 %), RTSP (28 %), HTTP (14 %), SMB (43 %), SIP (5 %), and RDP (5 %).
The test bed included two PT NGFW 2010 appliances in an HA cluster with aggregated 10/25 GbE interfaces, a management server running Debian 11, multiple Cisco TRex instances, and supporting Windows and Linux hosts.
In the first scenario the firewall sustained 700 000 new TCP connections per second before degradation, compared with the vendor claim of 900 000 CPS. The difference is attributed to the HA-cluster configuration with LACP and a 1 KB response size versus the vendor’s 0.001 KB test.
The second test confirmed the advertised 6.4 million concurrent sessions under a 10 000-rule policy with logging and application control enabled.
Subsequent EMIX tests measured throughput while progressively enabling IPS, application control, antivirus, NAT, URL filtering, and logging. Even with all modules active the device delivered approximately 27 Gbps, exceeding several vendor-stated figures obtained under lighter configurations.
Related articles
How to Properly Compare CDNs: TTFB, p95 Latency, Caching, DDoS Protection and True Pricing
Selecting a CDN based solely on the number of points of presence is as unreliable as choosing a car by dashboard buttons. Networks with dozens of global PoPs may underperform for audiences concentrated in Novosibirsk or Yekaterinburg, while smaller regional providers often deliver superior peering with Russian operators. The article evaluates CDNVideo, EdgeCenter, Curator, NGENIX and Yandex Cloud CDN across verifiable features, network design, caching behavior, security controls, operations and commercial models. Performance data is separated because marketing claims cannot substitute for independent measurements from services such as CDNMON. Emphasis is placed on p95 metrics, cache hit ratios, origin shielding, raw logs and API limits rather than marketing scores. The analysis shows that no single universal ranking exists; optimal choice depends on traffic profile, audience geography, security requirements and operational workflows.
Java Card Tutorial: Implementing Supplementary Security Domain to Limit ISD Privileges
A detailed technical guide demonstrates how to create a Supplementary Security Domain (SSD) on Java Card platforms to isolate applet management from the Issuer Security Domain (ISD). The approach prevents full card compromise if ISD keys are exposed by restricting SSD privileges to specific functions such as accepting extradition only from the ISD. Using the FunGP library and SCP02 protocol, the tutorial walks through installation, personalization with encrypted keys, and extradition of applets under the new domain. GlobalPlatform specifications including GP CS v2.3 and GP CIC v2.0 are followed for install parameters, privileges, and STORE DATA commands. After personalization the SSD reaches the PERSONALIZED lifecycle state, allowing secure delegation of applet control while the ISD retains overall card management rights. The method eliminates the need for custom operating systems and provides a standards-compliant way to enforce least-privilege access on smart cards.
Linus Torvalds Embraces Generative AI for Coding After Initial Skepticism
Linus Torvalds has publicly shared his evolving views on generative AI tools for programming during the Open Source Summit Europe. The Linux creator noted that AI assistance makes small personal projects more enjoyable by accelerating the path from idea to working result. He described using an AI model to modernize the outdated C-based user interface of a custom guitar pedal project. Initial AI output proved unusable until Torvalds supplied the existing implementation and clear instructions on required changes. Torvalds emphasized that AI helps newcomers achieve tangible outcomes that feel meaningful compared to professional-grade software. At the same time he urged caution when applying these tools to serious kernel development work. He also highlighted the growing burden on maintainers who must review increasing volumes of low-quality, AI-generated vulnerability reports and superficial patches.
Hacker or Engineer? Reconstructing Attack Chains in Industrial OT Networks
Positive Technologies expert Anton Kutepov presents a detailed educational scenario from the Standoff online polygon to demonstrate how security teams can trace an attack from initial perimeter compromise to unauthorized writes on a PLC. The case begins with an unexpected SCADA server command to a hydrocracking unit controller outside the maintenance window. By correlating network traffic, endpoint telemetry, authentication logs, and asset context, analysts reconstruct the full path: exploitation of a vulnerable DMZ system, lateral movement via Kerberoasting and Active Directory certificate abuse, RDP access to an engineering workstation, and finally weakening of Windows Defender on the SCADA server before issuing the control command. The analysis shows that a single permitted industrial protocol operation becomes suspicious only when placed in the context of prior defensive control changes and anomalous access routes. The article stresses that protecting OT environments requires continuous asset inventory, unified telemetry from traffic and endpoints, and pre-approved response playbooks that avoid disrupting the physical process.