Press

NSS Labs Test Show Enterprise End Point Protection Solutions Improving Ability to Block Exploits, Evasions and Phishing Attacks

February 25, 2013

AUSTIN, Texas – February 25, 2013 – NSS Labs today released three new 2013 Corporate End Point Protection Comparative Analysis Reports, which evaluated 11 enterprise level end point protection (EPP) products to test their effectiveness in blocking exploits and evasions. While only 3 of the 11 vendors – McAfee, Kaspersky and Microsoft – scored 100% across all 6 types of evasion testing, the average score across all vendors increased to an average of 87% in 2013 testing, compared to 27% in NSS’ 2010 tests. In exploit testing, the top 3 vendors – McAfee, Kaspersky and Symantec – all scored over 90%, with an overall group average of 74.5%, also an improvement over 2010 test results.

NSS vulnerability research has shown that the number of vulnerabilities disclosed in 2012 jumped 26% after a 5-year decline. Given the growing availability of exploit toolkits that automate the creation of evasions and exploits targeting newly-discovered and existing vulnerabilities, NSS recommends that enterprises – especially those that have implemented a bring your own device (BYOD) policy – fully understand the ability of their EPP solutions to adequately protect against key exploits and types of evasions.

NSS’s research yielded several key conclusions:

  • Enterprise EPP products differ up to 53% in effectiveness at blocking exploits: Protection levels in the 2013 tests ranged from 97% (McAfee) to 41% (Panda). The top 3 vendors all scored over 91% with half (4) of the remaining 8 vendors scoring in the 70 – 80% range. In 2010 exploit testing, the overall block rate ranged from 20% to 100% with an overall average of 67%.
  • Default vendor settings may favor performance over security: While all of the vendors tested were able to block exploits once malicious files were decompressed, only 3 of the 11 vendors – ESET, Kaspersky, and Trend Micro – blocked all of the compressed threats upon download. NSS believes having a default setting that does not inspect compressed downloads is typically a choice of performance over security and that malicious downloads inside of compressed files should be blocked by default.
  • Vendors’ anti-evasion protection against encoded payloads and layered evasions has greatly improved since 2010: In 2010, none of the products scored 100% and most scored below 40% in their ability to handle encoded payloads. In 2013 tests, 8 of the 11 vendors scored 100% in these tests – followed by one vendor scoring 83% and two that only scored 17%. In 2010, even single layers of evasion caused problems for many vendors, but in 2013, all 11 vendors scored 100% even when attempts to use as many as 4 levels of obfuscation were used.
  • Web browsers rather than EPP should be considered the first line of defense against phishing: Modern Web browsers now offer 90% to 94% protection against phishing according to recent NSS tests. Only one of the vendors tested – Trend Micro – scored as well or better than current Web browsers did in these latest tests. Organizations should still take time to educate users about phishing and best practices for avoiding phishers’ increasingly deceptive attacks.
  • Detection of exploits delivered via HTTP vs. HTTPS can vary as much as 39% in a single product: Only 3 of the 11 vendors blocked the same percentage of exploits when delivered via HTTP and HTTPS. On average, there was a 7% difference in the ability of products across the board to block HTTPS vs. HTTP exploit attacks. NSS believes security product should ideally protect against all exploits for a given vulnerability, regardless of the transport protocol.
  • Enterprise Using Internet Explorer 6 (IE6) may be less protected against exploits: Because some enterprises are still using IE6, NSS ran tests using exploits requiring IE6 and those that did not. For exploits not requiring IE6, the average block rate across all products was 77% with a range of 44% to 98%. For those requiring IE6, the average block rate dropped to 65% with a range of 20% to 100% effectiveness. Enterprises running IE6 should be aware of this discrepancy and evaluate their EPP defenses carefully, given IE6’s impact on their attack surface.

Commentary: NSS Labs Research Director Randy Abrams

“The simple detection of malware is insufficient to cope with the multitude of attacks that companies face today; for example, Facebook and Apple have both recently fallen prey to Java exploits that resulted in breaches,” said Randy Abrams, Research Director at NSS Labs. “With phishing and targeted drive-by attacks (ambiguously referred to as watering hole attacks) targeting users who may be outside perimeter defenses, endpoint protection products are often the last line of defense and criminals can – and do – use obfuscation techniques to evade malware detection. Most Endpoint protection products are dealing well with evasions for the exploits they detect, however there is still a lot of room for improvement in the detection of known exploit attempts and simply detecting exploits alone falls short of the protection needed by today’s enterprises.”