AVLab.pl Cyber Transparency Audit Q2 2024 - "Transparency First. Then Trust"

[Adrian Ścibor]

Community!

We have something completely new for you. We have launched a new service that is not directly security test-oriented for Endpoint Protection.

A few words of explanation are necessary to introduce you:

One of the cornerstones of cybersecurity is to ensure that data and systems are protected from serious consequences. It is difficult to choose a product if a customer does not have the opportunity to check whether the software meets certain standards. Endpoint cybersecurity is a multibillion-dollar industry that lacks standardized policies, yet it impacts businesses around the world.

Endpoint security software is designed to minimize risk. A good way to make it clear for a user that a developer helps to mitigate that risk is to be transparent about how the application works and the processes in the developer’s infrastructure. By disclosing certain statistical information, it is possible to know and understand strengths of a product. This may lead to the resolution of the basic problem, that is the elimination of all remaining gaps. On the other hand, developers who are taking the difficult path of disclosing statistical data from end devices may face public criticism and control, but it is beneficial for all companies and institutions.

In an interpersonal relationship, clear rules are needed to build mutual trust. Transparency should be the cybersecurity industry’s motto to strengthen the end customer’s trust in the people who are responsible for the brand’s image. This is the only way to improve collective thinking about cybersecurity.


This service is aimed at producers who want to go the road of transparency in order to build confidence in themselves through this.

Providers of VPN, DNS and other types of malicious content filtering are part of the methodology. So if you have a service, software, and you are in the cybersecurity industry, we can probably adapt the methodology to your product and extract interesting marketing value from it.


I don't want to copy the report here, so perhaps it would be better if I referred you to read the PDF and the methodology:

Publication: Cyber Transparency Audit Of Xcitium Backend Data - Q2 2024 » AVLab Cybersecurity Foundation

Landing Page: Cyber Transparency Audit

Methodology: Methodology » AVLab Cybersecurity Foundation


We are super-interested in what you think of this initiative!

 

[Bot]

This is an exciting initiative! Transparency in cybersecurity is indeed crucial for building trust. It's great to see a service that encourages this level of openness. I'll be sure to check out the report and methodology. Thanks for sharing!

 

[Bot]

Thanks bro

You're welcome! If you have any more updates or need feedback on anything else, feel free to share.

 

[bazang]

Xcitium
Comodo
Melih

 

[cruelsister]

The report really should be no surprise as protection continues to be optimal.

 

[bazang]

The report really should be no surprise as protection continues to be optimal.

Melih just doing his maverick thingy trying to get other security software publishers to post their stats - which they will never do because the numbers would be shocking even though the numbers would be consistent with user behaviors, baseline configurations, and capabilities.

It would be a "Whiskey Tango Foxtrot" moment. Users would go insane. They could not cope with Kaspersky or any other big name vendor having an overall 15% or higher global infection rate. Claims of "It's a lie! All lies!" or "Oh no. Why do I pay for this garbage?"

 

[Adrian Ścibor]

Interesting opinion.

To dig deeper, note that the methodology may contain interesting points:

I. Requirements for Producers

It is allowed to participate in the audit of a device with the following settings assigned:

Hardened policy: The protection settings have been increased by the administrator or focused on maximum security using a predefined hardened policy prepared by the producer.

I mean, hardened policy protection...

It is certain that the default policy is usually not very good. Especially in medium and Enterprise environments. I myself wonder what the difference would be between these settings from the worldwide statistics for producers XYZ.

Even if, in a hardened policy, this rate was 1-3% this would indicate that minimising the effects of attacks makes sense and that the marketing assurances of producers can be thrown into the hole. Can anyone, therefore, offer guarantees... On the other hand - most of us know that product XYZ does not deliver what its producer says it does, and yet we accept being pressured into doing what the producers want us to say.