Vulnerabilities / Threats
11/16/2009
04:21 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Most Security Products Fail Initial Certification Tests

A study based on the testing of thousands of security products over 20 years finds that most require several rounds of testing before achieving certification.

Seventy-eight percent of security products do not perform as intended when first tested and typically require at least two rounds of further testing to achieve certification, claims a report released on Monday.

The "ICSA Labs Product Assurance Report" comes from ICSA Labs, a division of Verizon Business. The company offers vendor-neutral certification and testing of security products.

The report was produced in conjunction with the Verizon Business Data Breach Investigations research team and was based on the testing of thousands of security products over the past 20 years.

The report aims to make buyers aware that "all is not as it seems in the world of security products" and to make vendors aware of common pitfalls in the certification process.

George Japak, managing director, ICSA Labs and a co-author of the report, said in a statement that vendors should view certification failures as opportunities to improve their products.

Only 4% of products pass on the first round. Nonetheless, most vendors address shortcomings in their products and resubmit them, which is why 82% of products submitted for certification eventually receive it.

That 82% figure represents an average that includes anti-virus, network firewall, Web app firewall, network IPS, IPSec VPN, SSL VPN, and Custom Testing products. In most of these categories, the percentage of products eventually receiving certification ranged from 80% and 100%. But one category, network IPS, represented an outlier: Only 29% of network IPS products ever attained certification.

The report says the category covers "a complex technology with difficult testing requirements" and notes that many vendors, unable to pass the rigorous tests, dropped out of the certification process.

The primary reason for these certification failures is that the products tested don't do what they're supposed to do.

For an anti-virus product, that means failing to block viruses and for an IPS (intrusion prevention system) that means failing to block malicious network traffic.

Failure to properly log data represented the second most common reason for certification failure.

Security problems represent the third most common reason for certification failure. These are seen in 44% of security products.

"One of the more ironic examples we've ever come across was a Web application firewall that turned up numerous vulnerabilities within its Web administration interface," the report states. "Cross-site scripting, SQL injection, and buffer overflow vulnerabilities and unencrypted admin interfaces are some of the common security issues identified within the Custom Testing engagements, Web Application Firewalls, and Network Firewalls programs."

Register now for Black Hat DC, the largest and the most important security conference series in the world. It happens Jan. 31-Feb. 3, 2010, in Arlington, Va. Find out more and register.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-9676
Published: 2015-02-27
The seg_write_packet function in libavformat/segment.c in ffmpeg 2.1.4 and earlier does not free the correct memory location, which allows remote attackers to cause a denial of service ("invalid memory handler") and possibly execute arbitrary code via a crafted video that triggers a use after free.

CVE-2014-9682
Published: 2015-02-27
The dns-sync module before 0.1.1 for node.js allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the first argument to the resolve API function.

CVE-2015-0655
Published: 2015-02-27
Cross-site scripting (XSS) vulnerability in Unified Web Interaction Manager in Cisco Unified Web and E-Mail Interaction Manager allows remote attackers to inject arbitrary web script or HTML via vectors related to a POST request, aka Bug ID CSCus74184.

CVE-2015-0884
Published: 2015-02-27
Unquoted Windows search path vulnerability in Toshiba Bluetooth Stack for Windows before 9.10.32(T) and Service Station before 2.2.14 allows local users to gain privileges via a Trojan horse application with a name composed of an initial substring of a path that contains a space character.

CVE-2015-0885
Published: 2015-02-27
checkpw 1.02 and earlier allows remote attackers to cause a denial of service (infinite loop) via a -- (dash dash) in a username.

Dark Reading Radio
Archived Dark Reading Radio
How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industrys professional organizations about how security pros can get more involved with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.