TECHNOLOGY DESCRIPTION

Through constant analysis of suspicious code and identification of communication with malicious hosts, breach detection systems (BDS) are capable of providing enhanced detection of threats. As threat actors demonstrate the capability to bypass protection offered by conventional endpoint and perimeter security solutions, enterprises must evolve their network defenses to incorporate protection using advanced techniques. The BDS utilizes both static and dynamic analysis techniques to detect advanced malware, zero-day attacks, and targeted attacks that have bypassed network security controls.

Detection products have more flexible deployment options than blocking products and thus can “see” more than blocking products. False positives, which lower operational efficiency, are still a concern with BDS technology, but this is the case for both detection and blocking products.

TECHNOLOGY DESCRIPTION

Through constant analysis of suspicious code and identification of communication with malicious hosts, breach detection systems (BDS) are capable of providing enhanced detection of threats. As threat actors demonstrate the capability to bypass protection offered by conventional endpoint and perimeter security solutions, enterprises must evolve their network defenses to incorporate protection using advanced techniques. The BDS utilizes both static and dynamic analysis techniques to detect advanced malware, zero-day attacks, and targeted attacks that have bypassed network security controls.

Detection products have more flexible deployment options than blocking products and thus can “see” more than blocking products. False positives, which lower operational efficiency, are still a concern with BDS technology, but this is the case for both detection and blocking products.

WHAT WE TESTED

NSS Labs’ Breach Detection Systems (BDS) Group Test evaluates market-leading BDS products on their security effectiveness, performance, and total cost of ownership (TCO). Security effectiveness scores take into account time-to-detect metrics, detection rate, anti-evasion capabilities, and stability and reliability. The test provides Comparative Reports and individual Test Reports to help enterprises make informed decisions to evolve and rationalize their cyber risk programs.

PRODUCTS EVALUATED:

• Fortinet FortiSandbox-2000E v.3.0.0 & FortiClient (ATP Agent) v.5.6.6.1167
• Lastline Enterprise (Sensor 1000) v8.0
• Trend Micro Deep Discovery Inspector Model 4000 (Hardware model 4100) v5.0 & OfficeScan XG SP1