Antivirus Tool Fail: Blocking Success Varies By 58%

Only two of 13 endpoint security software scanners blocked more than 80% of known exploits, NSS Labs study reports.

Who Is Hacking U.S. Banks? 8 Facts (click image for larger view and for slideshow)
In a test of 13 top endpoint security suites, only two blocked known exploits more than 80% of the time.
That finding comes via a new report from independent testing firm NSS Labs, which
studied the effectiveness
of leading Windows endpoint--often referred to as antivirus--security suites.
In terms of their overall ability to block known exploits, NSS found that Kaspersky Internet Security 2012 stopped 92.2% of threats, while Alwil Avast Pro Antivirus 7 blocked 81.9%. Next in line were Symantecs Norton Internet Security version 19 (74.1%), AVG Internet Security 2012 (73.3%), ESET Smart Security 5 (70.7%), Trend Micro Titanium Maximum Security version 6 (69.8%), McAfee Internet Security 11 (65.5%), and Avira Internet Security 2012 (64.7%).
Meanwhile,
Microsoft Security Essentials
only blocked about half of the exploits it encountered, followed by F-Secure Agent version 1.57 (44.8%), Norman Security Suite 9.00 (42.2%), Panda Internet Security 2012 (38.8%), and Total Defense Internet Security Suite version 8 (34.5%).
According to a September 2012
antivirus market-share
report from research firm OPSWAT, in North America, Microsoft controls 27% of the market, followed by Symantec (16%), Avast (11%), and AVG (10%).
[ Defense isnt enough to protect your systems. See
Play Offense On Security In 2013: Gartner
. ]
In todays era of
advanced persistent threats
,
spear-phishing attacks
,
social engineering campaigns
, and drive-by attacks, are
endpoint security solutions
performing well enough? The NSS Labs report suggests not. Most vendors lack adequate protection against exploits, according to the report. As a result, based on market share, between 65% and 75% of the world is poorly protected, and 75% to 85% in North America is poorly protected.
For its tests, NSS Labs used a Web server to attempt to infect its test PCs, but only using known exploits which have been seen on the Internet and in circulation for months, if not years. In other words, testers employed no
zero-day vulnerabilities
. In addition, the firm studied how different browsers reacted to the various exploits, using all versions of Internet Explorer since IE6, multiple versions of Firefox, as well as Apple Safari, and Google Chrome.
On that front, researchers issued a stark security warning--to consumers, but also applicable to businesses--that anyone still using IE6 must be technically knowledgeable enough to employ other defenses, or will almost certainly be compromised. Thats because when using IE6, only the McAfee endpoint security product blocked 100% of drive-by-download attacks, delivered via either HTTP or HTTPS. While four other products also performed well, Microsofts wasnt one of them. Ironically, Microsoft Security Essentials was one of the poorest performers at protecting users of IE6, and failed to block any of the Office 2003 exploits when delivered via Internet Explorer 6, according to the report.
Of course, security experts always recommend that businesses employ
layered information security defenses
, and not rely solely on antivirus software to block threats. According to NSS Labs, those extra layers of business defense should include, at a minimum, a robust
patch management program
, including rapid upgrading to the latest browser versions and browser plug-ins, as well as the use of an
intrusion prevention system
(IPS), especially in businesses that allow--explicitly or otherwise--employees to connect their own devices to the corporate network, per the
bring-your-own-device
(BYOD) movement.
While the report focuses on consumer-grade antivirus software, its important to note that most endpoint security vendors consumer-grade suites include a more sophisticated array of exploit-blocking tools than their enterprise-grade software. Thats due in part to the industry assumption that for many consumers, the only defense standing between their PC and a malware infection is the antivirus software. Furthermore, those defenses are facing an ever-increasing number of threats, as the reported number of new vulnerabilities has been increasing by about 30% per year. Even one exploit that slips past the security defenses could result in an infection, allowing attackers to
install additional malware
onto the PC, or
add the PC to their botnet
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Antivirus Tool Fail: Blocking Success Varies By 58%