Attacks/Breaches

10/19/2017
12:00 AM
Dark Reading
Dark Reading
Products and Releases
50%
50%

NSS Labs Announces 2017 Breach Detection Systems Group Test Results

Four Products Receive Recommended Rating, other products receive a neutral rating, security recommended rating, and caution rating.

AUSTIN, Texas - NSS Labs, a source for independent fact-based cybersecurity guidance, today announced the results of its Breach Detection Systems (BDS) Group Test. For the 2017 BDS Group Test, NSS Labs expanded test techniques to include new evasions. Evasion techniques are a means of disguising and modifying attacks in order to avoid detection and blocking by security products. These methods are increasingly selected by threat actors to circumvent security controls. Test results indicate that most breach detection systems are unable to stop all evasions, which is a major concern.

According to the Verizon 2017 Data Breach Investigations Report, 75% of data breaches are perpetrated by outsiders. BDS products are now more widely adopted in enterprise security deployments to catch attacks that bypass other perimeter defenses such as next-generation firewalls. The NSS Labs 2017 Enterprise Security Architecture Study indicates that 44.1% of US enterprises deploy BDS products. These products provide enhanced detection of advanced malware, zero-day attacks, and targeted attacks. Data obtained by BDS threat analysis helps to accelerate investigation and remediation, thereby reducing the business impact of threats.

The BDS Group Test reports offer insights into which infection vectors were effective and how long it took for products to detect them. When evaluating breach detection systems, time-to-detect metrics are critical as they directly impact ROI for enterprises.

Seven products from six market-leading security vendors were tested for security effectiveness, performance, stability and reliability, and total cost of ownership (TCO). Of the seven products tested, four received a Recommended rating and two scored 100% for security effectiveness.

Key findings from the test:

  • Five out of the seven products tested missed evasions.
  • Overall Security Effectiveness ranged between 80.2% and 100.0%.
  • The average Security Effectiveness rating was 93.2%; five products received a Security Effectiveness rating above the average, and two received a Security Effectiveness rating below the average.
  • False positive rates ranged from 0% to 0.36%.
  • TCO per Protected Mbps ranged between US$16 and US$128, with most tested products costing less than US$44 per protected Mbps.
  • The average TCO per Protected Mbps (Value) was US$48.82; five products demonstrated value above the average and two demonstrated value below the average.

“The 2017 BDS Group Test revealed that most products were able to detect the majority of breaches within 60 minutes, but some products took several hours to detect the same breaches,” said Jason Brvenik, Chief Technology Officer at NSS Labs. “To reduce the frequency and impact of security incidents, enterprises must consider the detection rate and the time a product takes to detect attacks.”

The following products were tested:

  • Check Point Software Technologies 15600 Next Generation Threat Prevention & SandBlast™ (NGTX) Appliance R77.30
  • Cisco FirePower 8120 v.6 & Cisco AMP v.5.1.9.10430
  • FireEye Network Security NX 10450 v7.9.2 & EX 8400 v7.9.0
  • FireEye Network Security 6500NXES-VA v7.9.2
  • Fortinet FortiSandbox-2000E v.FSA 2.4.1 & FortiClient (APT Agent) v.5.6.0.1075
  • Lastline Enterprise v7.25
  • Trend Micro Deep Discovery Inspector Model 4000 v3.8 SP5 & OfficeScan (OSCE) v.12.0.1807

NSS Labs is committed to providing empirical data and objective group test results that enable organizations to make educated decisions about purchasing and optimizing security infrastructure products and services. As with all NSS Labs group tests, there is no fee for participation, and the test methodology is available in the public domain to provide transparency and to help enterprises understand the factors behind test results. Click here for more information about our group test policies.

Click here for more information on this test, and the test methodology used, or to purchase the individual Test Reports. Click here to download the Security Value Map, which provides a graphic comparison of Security Effectiveness and TCO across the tested products.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Veterans Find New Roles in Enterprise Cybersecurity
Kelly Sheridan, Staff Editor, Dark Reading,  11/12/2018
Empathy: The Next Killer App for Cybersecurity?
Shay Colson, CISSP, Senior Manager, CyberClarity360,  11/13/2018
Understanding Evil Twin AP Attacks and How to Prevent Them
Ryan Orsi, Director of Product Management for Wi-Fi at WatchGuard Technologies,  11/14/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
Online Malware and Threats: A Profile of Today's Security Posture
Online Malware and Threats: A Profile of Today's Security Posture
This report offers insight on how security professionals plan to invest in cybersecurity, and how they are prioritizing their resources. Find out what your peers have planned today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-15759
PUBLISHED: 2018-11-19
Pivotal Cloud Foundry On Demand Services SDK, versions prior to 0.24 contain an insecure method of verifying credentials. A remote unauthenticated malicious user may make many requests to the service broker with different credentials, allowing them to infer valid credentials and gain access to perfo...
CVE-2018-15761
PUBLISHED: 2018-11-19
Cloud Foundry UAA release, versions prior to v64.0, and UAA, versions prior to 4.23.0, contains a validation error which allows for privilege escalation. A remote authenticated user may modify the url and content of a consent page to gain a token with arbitrary scopes that escalates their privileges...
CVE-2018-17190
PUBLISHED: 2018-11-19
In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then runs that code on 'worker' hosts. The master itself does not, by design, execute user code. A specially-crafted request to the master can, however, cause the master to execute code ...
CVE-2018-1841
PUBLISHED: 2018-11-19
IBM Cloud Private 2.1.0 could allow a local user to obtain the CA Private Key due to it being world readable in boot/master node. IBM X-Force ID: 150901.
CVE-2018-18519
PUBLISHED: 2018-11-19
BestXsoftware Best Free Keylogger 5.2.9 allows local users to gain privileges via a Trojan horse "%PROGRAMFILES%\BFK 5.2.9\syscrb.exe" file because of insecure permissions for the BUILTIN\Users group.