AUSTIN, Texas, Sept. 20, 2018 (GLOBE NEWSWIRE) -- NSS Labs, Inc., a global leader and trusted source for independent, fact-based cybersecurity guidance, today announced the results of the fourth iteration of its Next Generation Intrusion Prevention System (NGIPS) Group Test. In this test, seven products from six market-leading security vendors were evaluated to help enterprises make informed decisions regarding which NGIPS products are the best fit for their environments.
The role of an NGIPS is to protect enterprises and provide granular visibility into network traffic. An NGIPS decodes and inspects network traffic, allowing legitimate traffic to pass, blocking traffic that has been identified as malicious or unwanted, and also resisting evasion techniques. NGIPS are typically placed behind firewalls or used between internal networks and implemented as transparent inline devices.
87.6% of US enterprises surveyed in an NSS Labs research study reported deploying NGIPS technology. The study revealed that the top challenges experienced by enterprises with NGIPS technology include false positives, difficulty in managing rules, and few actionable alerts.1
Cybersecurity is now a never-ending game of cat and mouse. Attackers are developing new techniques to exploit vulnerabilities at an ever-increasing pace. Additionally, attackers are “going back to the well” and exploiting old vulnerabilities using variants of known exploits. To address this trend, the 2018 NGIPS Group Test was expanded to include resiliency testing. A system’s resiliency can be defined as its ability to protect against multiple variants of an exploit, not just the known exploit. By testing resilience, NSS Labs enables enterprises to know which NGIPS products will continue to protect them after the spotlight has moved on.
Key Take-aways from the 2018 NGIPS Group Test
Security Effectiveness:
- The Security Effectiveness of a device is determined by factoring the results of evasions testing and stability and reliability testing into the exploit block rate.
- Overall Security Effectiveness of the tested products ranged from 25.0% to 99.8%, with four of the seven tested products achieving a rating greater than 99.4%.
- The average Security Effectiveness rating was 66.2%; five of the tested products received an above-average Security Effectiveness rating, and two of the tested products received a below-average Security Effectiveness rating.
- Total Cost of Ownership (TCO) per Protected Mbps:
o In NSS Labs testing, a unique formula, Total Cost of Ownership (TCO) per Protected Mbps, is used to enable value-based comparisons of NGIPS products in the market. TCO per Protected Mbps is calculated using three-year TCO, security effectiveness, and NSS-tested throughput.
o TCO per Protected Mbps ranged from US$2 to US$199, with most tested products costing less than US$8 per protected Mbps.
o The average TCO per Protected Mbps was US$47.66; five of the tested products were rated as having above-average value, and two of the tested products were rated as having below-average value.
- Evasions:
o Attackers use evasions to bypass security controls. A single evasion can grant an attacker access to your network. What’s worse, when an attacker successfully uses an evasion to bypass defenses there is no trace of the attack. There is no log; there are no alerts.
o In the 2018 NGIPS Group Test, products were tested against 147 evasions to evaluate how well the products were able to detect and block the evasions.
o Two of the tested products missed at least one evasion.
- Stability:
o An unstable device that disrupts traffic unexpectedly can have serious consequences. Testing revealed some products had stability issues with certain versions.
“Over the past few years, rapid adoption of social media, streaming video, teleconferencing, and other bandwidth-intensive technologies have led to significant network behavior changes,” said Jason Brvenik, Chief Technology Officer at NSS Labs. ”To address these challenges, enterprises have begun to embrace a zero-trust security framework, which eliminates the idea of trusted (or internal) networks. Findings from the 2018 NGIPS Group Test provide critical insights into performance and security effectiveness to help enterprises understand which products are best suited to help address a zero-trust security model without requiring complete network redesign.”
The following products were tested:
- Forcepoint Forcepoint NGFW v6.3.6
- Fortinet FortiGate 500E v5.6.4GA build 7892
- Fortinet FortiGate 3000D v5.6.4GA build 7892
- IBM QRadar XGS5200 v5.4.0.4
- Juniper Networks SRX4200 v15.1X49-D140.2
- Palo Alto Networks PA-5220 PAN-OS 8.1.2
- Trend Micro TippingPoint 8400TX v5.1.0.4965
As with all NSS Labs group tests, there is no fee for participation, and the test methodology is available in the public domain to provide transparency and to help enterprises understand the factors behind test results. Click here for more information about our group test policies.
Click here for more information on this test and the test methodology used or to purchase the individual test reports. Click here to download the Security Value Map™, which provides a graphic comparison of Security Effectiveness and TCO across the tested products.
Additional Resources:
- Purchase the NSS Labs 2018 NGIPS Group Test Reports
- View the 2018 NGIPS Group Test Methodology
- View the NSS Labs Evasions Testing Methodology v1.1
- Read our blog titled “Detection and Prevention: The IPS in the US Enterprise”
- Learn more about NSS Labs’ Security Product Testing
- Learn more about NSS Labs’ Test Policies
- Learn more about NSS Labs’ Cloud Platform for Continuous Security Validation
- Follow NSS Labs on Twitter
- Follow NSS Labs on LinkedIn
About NSS Labs, Inc.
NSS Labs, Inc. is recognized globally as the most trusted source for independent, fact-based cybersecurity guidance. Our mission is to advance transparency and accountability within the cybersecurity industry. Our unmatched foundation in security testing, along with our extensive research and global threat analysis capabilities, provide the basis for NSS Labs’ Cloud Platform for Continuous Security Validation. This cloud platform empowers enterprises with objective, empirical data and allows them to gain continuous visibility, gather actionable insights, and rationalize investments in their cyber programs. The cloud platform lets enterprises know where they stand by continuously validating the effectiveness of their security products and assessing the impact of unmitigated risks to the enterprise stack. This gives business leaders the relevant information they need to substantiate their security investments. CISOs, Chief Security Architects, SOC and Threat Analysts, and information security professionals from many of the world's largest and most demanding enterprises rely on trusted information from NSS Labs. For more information, visit www.nsslabs.com.
Contact:
Jessica Johannes
Phone: +1 512-498-7076
jjohannes@nsslabs.com