MITRE Changes the Game in Security Product Testing

Nonprofit has published its first-ever evaluation of popular endpoint security tools - measured against its ATT&CK model.

There were no grades, scores, or rankings, but todays official release by MITRE of the results from its tests of several major endpoint security products could signal a major shift in the testing arena.
MITRE, a nonprofit funded by the US federal government, in its
inaugural commercial tests
pitted each product against the well-documented attack methods and techniques used by the Chinese nation-state hacking group APT3, aka Gothic Panda, drawn from MITREs widely touted - and open - ATT&CK model.
Endpoint detection and response (EDR) vendors Carbon Black, CrowdStrike, CounterTack, Endgame, Microsoft, RSA, and SentinelOne played blue team with their products against a red team of experts from MITRE. Unlike traditional third-party product testing in security, the ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) approach uses open standards, methods, and the vendors perform live defenses with their products.
The testing operates in a collaborative manner. They invited the vendors in to help them drive the tool and show how they find [attacks], says Mark Dufresne, vice president of research for Endgame. MITRE was sitting right there, and the product wasnt just chucked over the wall and tested like in many other third-party tests.
It was a collaborative and conversational, versus transactional, model, he says.
MITRE tracks and documents how the tools are tuned and configured, and how they do or dont detect an offensive move by its APT3 red team, for example. The results get published on MITREs website for anyone to see and study.
We really want this to be a collaborative process with the vendors; we want them to be part of the process, says Frank Duff, MITREs lead engineer for the evaluations program. The goal is both to improve the products as well as share the evaluations publicly so organizations running those tools or shopping for them can get an in-depth look at their capabilities, according to Duff.
MITRE chose APT3s methods of attack, which include credential-harvesting and employing legitimate tools used by enterprises to mask their activity. Each step of the attack is documented, such as how the tool reacted to the attacker using PowerShell to mask privilege-escalation. ATT&CK is based on a repository of adversary tactics and techniques and is aimed at helping organizations find holes in their defenses. For security vendors, ATT&CK testing helps spot holes or weaknesses in their products against known attack methods.
The collaborative and open testing setup represents a departure from traditional third-party testing. Vendors and labs traditionally have had an uneasy and sometimes contentious relationship over control of the testing process and parameters. Longtime friction in the security product test space erupted into an ugly legal spat in September, when testing firm NSS Labs filed an antitrust lawsuit against cybersecurity vendors CrowdStrike, ESET, and Symantec, as well as the nonprofit Anti-Malware Testing Standards Organization (AMTSO), over a vendor-backed testing protocol.
The suit claims the three security vendors and AMTSO, of which they and other endpoint security vendors are members, unfairly allow their products to be tested only by organizations that comply with
AMTSOs testing protocol standard
.
The whole testing landscape is a real mess, Endgames Dufresne says. [But] as a vendor, its important to be there.
NSS Labs, which is a member of AMTSO, was one of a minority of members that voted against the standard earlier this year; the majority of members support it and plan to adopt it. Our fundamental focus is if a product is good enough to sell, its good enough to test. We shouldnt have to comply to a standard on what and how we can test, said Jason Brvenik, chief technology officer at NSS Labs, in an
interview
with Dark Reading after the suit was filed.
Traditional third-party tests, such as those conducted by NSS Labs, AV-Test, and AV-Comparatives, focus mainly on file-based malware, Endgames Dufresne explains, looking at whether the security product blocks specific malware. We do participate in those ... but they truly miss a huge swath of overall attacker activity.
MITREs Duff says there are different security product tests for different purposes. ATT&CK is all about openness and providing context to the evaluation, he says. All different testing services have their own purpose, value, and approaches. This is our approach, and we are hoping it resonates to the public.
Even so, malware-based testing isnt likely to go away. I think some buyers like to see a number like those tests provide, Endgames Dufresne says.
Greg Sim, CEO of Glasswall Solutions, says third-party testing was overdue for a change. Even when they garner high scores from the antimalware testing labs, some products continue to fail in real-world attacks, he says. I think theres going to be a different model, he says, noting that his firm has run tests with MITRE, which it considers an example of a reputable third party for testing.
Another security vendor executive who requested anonymity says MITREs entry into the testing arena came just at the right time. Emulating tradecraft of a known adversary, nation/state - for us on the vendor side, we’re saying, Hallelujah, they are doing it the right way, he says.
MITREs new testing service represents new territory for the nonprofit, but that doesnt mean its federal government work will subside. Vendors pay a fee, which MITRE would not disclose. MITRE historically has focused on doing testing of solutions for US government customers or sponsors. That role is not going anywhere, Duff notes.
MITRE hasnt yet set a timeframe for its next series of tests, he adds, but the team will pick another APT group to emulate.
We are just trying to get at the ground truth on these tools, Duff says.
Related Content:
Mastering MITREs ATT&CK Matrix
Threat Hunting: Rethinking Needle in a Haystack Defenses
NSS Labs Files Antitrust Suit Against Symantec, CrowdStrike, ESET, AMTSO
7 Cool New Security Tools to be Revealed at Black Hat Europe

Black Hat Europe returns to London Dec 3-6 2018 with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the
conference
and
to register.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
MITRE Changes the Game in Security Product Testing