NSS Labs rated 13 advanced endpoint security products, flagged 2 with caution rating

[vemn]

Advanced endpoint security products don’t do you much good if they can be evaded or eat your time by consistently throw false positives. Since enterprises are expected to defend against sophisticated threats and money in the security budget only goes so far, you might be interested in the results from NSS Labs’ testing of 13 security vendors AEP solutions. The results were released during the RSA conference.

According to NSS Labs’ CEO Vikram Phatak, “The AEP test results provide vendor neutral insight and analysis to help enterprises accelerate their decision process and make informed decisions about when to deploy these products to manage their risk posture.”

NSS Labs said, “To determine the efficacy of the AEP products and validate their claims of technological differentiation with proactive blocking and active detection of known and unknown threats, the leading AEP vendor products were examined for their security effectiveness and total cost of ownership.”

Continue reading...

 

[509322]

Cylance scores 3rd, but complains: NSS Labs Names Cylance as a Leader in 2017 Advanced Endpoint Testing

 

[509322]

They should be happy with what they got...

I have yet to see a test they did not complain about in one form or another. According to them, the entire industry is wrong - if I am making sense of the "Smoke and Mirrors."

 

[509322]

Wow, they must think they HAVE to be the best of the best and there is no other option.

Nixon-grade paranoia...

 

[509322]

Uh, what?

Before your time. President Nixon and his administration were notorious for their paranoia. Hence "Nixon-grade paranoia."

 

[vemn]

CrowdStrike Initiates Legal Action Against NSS Labs For Misappropriation of Intellectual Property and Engaging in a Sham Transaction to Illegally Obtain Access To Our Falcon Software

this guy is complaining too...

 

[509322]

It is best practice to test softs on your specific system anyway. A published test provides some useful infos, but completely relying on it without doing your own testing is foolish.

 

[Deleted member 178]

They have to complain because they are funded by 3rd parties, if they can't be the top one , money will go elsewhere...simple business logic.

 

[vemn]

And while all this is happening, another participant got news as well.

https://labs.mwrinfosecurity.com/assets/BlogFiles/mwri-carbon-black-cb-response-xss-2017-01-24.pdf

But applause to them for honouring the findings and patch asap.

 

[RmG152]

What is an evasion?

 

[vemn]

What is an evasion?

Bypassing the detections of the security feature?
Or you are looking for more in depth explanation how evasion takes place?

 

[SHvFl]

Cylance scores 3rd, but complains: NSS Labs Names Cylance as a Leader in 2017 Advanced Endpoint Testing

They have to get 100% to support their marketing mate. Even if they were first with 99.69% they don't care because writing we have 99.69% protection is not equal to 100%.
Sure wanting perfection is not a bad thing but in practice none can have 100% if they don't block everything not whitelisted manually. I guess 100% protection helps push older people in charge to buy their protection.

 

[vemn]

They have to get 100% to support their marketing mate. Even if they were first with 99.69% they don't care because writing we have 99.69% protection is not equal to 100%.
Sure wanting perfection is not a bad thing but in practice none can have 100% if they don't block everything not whitelisted manually. I guess 100% protection helps push older people in charge to buy their protection.

100% detection on controlled samples.... probably

 

[509322]

With these tests, and any ensuing controversy, it is the user who has to wonder "What is accurate, what is correct, what is the truth ?"

Unfortunate.

That's why I say there is no substitute to testing a product on your specific system.

 

[soccer97]

Agreed. As I was taught a long time ago "Always Evaluate your Sources, Potential Conflicts of interests, and How the research (any type) is funded when evaluating the reliability, results, and information".

With these tests, and any ensuing controversy, it is the user who has to wonder "What is accurate, what is correct, what is the truth ?"

Unfortunate.

That's why I say there is no substitute to testing a product on your specific system.

Agreed. As I was taught a long time ago "Always Evaluate your Sources, Potential Conflicts of interests, and How the research (any type) is funded when evaluating the reliability, results, and information".

100% agree with your own testing. That is why companies offer evaluations periods to test their software prior to purchase.

Very good point.