SPECIAL EDITION

Special Edition is the blog for security testing business SE Labs. It explains how we test security products, reports on the internet threats we find and provides security tips for businesses, other organisations and home users.

Wednesday, 17 July 2019

The best security tests keep it real

Why it's important not to try to be too clever

Latest reports now online for enterprisesmall business and home users.

Realism is important in testing, otherwise you end up with results that are theoretical and not a useful report that closely represents what is going on in the real world. One issue facing security testing that involves malware is whether or not you connect the test network to the internet.

The argument against this approach is that computer viruses can spread automatically and a test could potentially infect the real world, making life worse for computer users globally. One counter argument goes that if the tester is helping improve products then a few dozen extra infected systems on the internet is, on balance, worth it considering there are already millions out there. The benefits outweigh the downside.

Another counter argument is that viruses such as we understand them from the 90s are not the same as they are today. There are far fewer self-replicating worms and more targeted attacks that do not generally spread automatically, so the risk is lower.

Connecting to the internet brings more than a few advantages to a test, too. Firstly, the internet is where most threats reside. It would be hard to test realistically with a synthetic internet.

Secondly, for at least 10 years most endpoint security products have made connections back to management or update servers to get the latest information about current threats. So-called 'cloud protection' or 'cloud updates' would be disabled without an internet connection, effectively reducing the products' protection abilities significantly. This then makes the test results much less accurate when running assessments.

There are cases in which turning off the internet is useful, though. Last year we ran a test to check whether or not artificial intelligence could predict future threats. We ran our Predictive Malware Response Test without an internet connection to see if a Cylance AI brain, which had been built and trained three years previously, could detect well-known threats that had come into existence since then. You can see the full report here.

But that was a special case. When assessing any security product or service for real-world, practical purposes, a live and unfiltered internet connection is probably a useful and even necessary part of the setup.

Naturally we have always used one in our testing, at one point even going as far as using consumer ADSL lines when testing home anti-malware products for extra realism. When reading security tests check that the tester has a live internet connection and allows the products to update themselves.

-

If you spot a detail in this report that you don't understand, or would like to discuss, please contact us via our Twitter or Facebook accounts.

SE Labs uses current threat intelligence to make our tests as realistic as possible. To learn more about how we test, how we define 'threat intelligence' and how we use it to improve our tests please visit our website and follow us on Twitter.

This test report was funded by post-test consultation services provided by SE Labs to security vendors. Vendors of all products included in this report were able to request early access to results and the ability to dispute details for free. SE Labs has submitted the testing process behind this report for compliance with the AMTSO Testing Protocol Standard v1.0. To verify its compliance please check the AMTSO reference link at the bottom of page three of this report or here.

UPDATE (24th July 2019): The tests were found to be compliant with AMTSO's Standard.

Our latest reports, for enterprisesmall business and home users are now available for free from our website. Please download them and follow us on Twitter and/or Facebook to receive updates and future reports.

Wednesday, 5 June 2019

How can you tell if a security test is useful or not?

How to tell if security test results are useful, misleading or just rubbish?

Latest reports now online.

In security testing circles there is a theoretical test used to illustrate how misleading some test reports can be.

For this test you need three identical chairs, packaging for three anti-virus products (in the old days products came on discs in a cardboard box) and an open window on a high floor of a building.

The methodology of this test is as follows:
  1. Tape each of the boxes to a chair. Do so carefully, such that each is fixed in exactly the same way.
  2. Throw each of the chairs out of the window, using an identical technique.
  3. Examine the chairs for damage and write a comparative report, explaining the differences found.
  4. Conclude that the best product was the one attached to the least damaged chair.
The problem with this test is obvious: the conclusions are not based on any useful reality.

The good part about this test is that the tester created a methodology and tested each product in exactly the same way.* And at least this was an 'apples to apples' test, in which similar products were tested in the same manner. Hopefully any tester running the chair test publishes the methodology so that readers realise what a stupidly meaningless test has been performed, but that is not a given.

Sometimes test reports come with very vague statements about, "how we tested".

When evaluating a test report of anything, not only security products, we advise that you check how the testing was performed and to check whether or not it has been found compliant with a testing Standard, such as the Anti-Malware Testing Standards Organization's Standard (see below).

Headline-grabbing results (e.g. Anti-virus is Dead!) catch the eye, but we need to focus on the practical realities when trying to find out how best to protect our systems from cyber threats. And that means having enough information to be able to judge a test report's value rather than simply trusting blindly that the test was conducted correctly.

*Although some pedants might require that each chair be released from the window at exactly the same time – possible from windows far enough apart that the chairs would not entangle mid-air and skew the results in some way.

-

If you spot a detail in this report that you don't understand, or would like to discuss, please contact us via our Twitter or Facebook accounts.

SE Labs uses current threat intelligence to make our tests as realistic as possible. To learn more about how we test, how we define 'threat intelligence' and how we use it to improve our tests please visit our website and follow us on Twitter.

These test reports were funded by post-test consultation services provided by SE Labs to security vendors. Vendors of all products included in these reports were able to request early access to results and the ability to dispute details for free. SE Labs has submitted the testing process behind this report for compliance with the AMTSO Testing Protocol Standard v1.0. To verify its compliance please check the AMTSO reference link at the bottom of page three of each report or here.

UPDATE (10th June 2019): The tests were found to be compliant with AMTSO's Standard.

Our latest reports, for enterprise, small business and home users are now available for free from our website. Please download them and follow us on Twitter and/or Facebook to receive updates and future reports.

Wednesday, 10 April 2019

Enemy Unknown: Handling Customised Targeted Attacks

Detecting and preventing threats in real-time

Computer security products are designed to detect and protect against threats such as computer viruses, other malware and the actions of hackers.

A common approach is to identify existing threats and to create patterns of recognition, in much the same way as the pharmaceutical industry creates vaccinations against  known biological viruses or police issue wanted notices with photographs of known offenders.

The downside to this approach is that the virus or criminal has to be known to be harmful, most likely after someone has become sick or a crime has already been committed. It would be better to detect new infections and crimes in real-time and to stop them in action before any damage is caused.

This approach is becoming increasingly popular in the cyber security world.

Deep Instinct claims that its D-Client software is capable of detecting not only known threats but those that have not yet hit computer systems in the real world. Determining the accuracy of these claims requires a realistic test that pits the product against known threats and those typically crafted by attackers who work in a more targeted way, identifying specific potential victims and moving against them with speed and accuracy.

This test report used a range of sophisticated, high-profile threat campaigns such as those believed to have been directed against the US Presidential election in 2016, in addition to directing more targeted attacks against the victim systems using techniques seen in well-known security breaches in recent months and years.

The results show that Deep Instinct D-Client provided a wide range of detection and threat blocking capability against well-known and customised targeted attacks, without interfering with regular use of the systems upon which it was deployed. The deep learning system was  trained in August 2018, six months before the customised targeted threats were created.

Latest report now online.

Wednesday, 20 March 2019

Assessing next-generation protection

Malware scanning is not enough. You have to hack, too.

Latest report now online.

The amount of choice when trialling or buying endpoint security is at an all-time high. It has been 36 years since 'anti-virus' first appeared and, in the last five years, the number of companies innovating and selling products designed to keep Windows systems secure has exploded.

And whereas once vendors of these products generally used non-technical terms to market their wares, now computer science has come to the fore. No longer are we offered 'anti-virus' or 'hacker protection' but artificial intelligence-based detection and response solutions. The choice has never been greater, nor has the confusion among potential customers.

While marketing departments appear to have no doubt about the effectiveness of their product, the fact is that without in-depth testing no-one really knows whether or not an Endpoint Detection and Response (EDR) agent can do what it is intended.

Internal testing is necessary but inherently biased: 'we test against what we know'. Thorough testing, including the full attack chains presented by threats, is needed to show not only detection and protection rates, but response capabilities.

EventTracker asked SE Labs to conduct an independent test of its EDR agent, running the same tests as are used against some of the world’s most established endpoint security solutions available, as well as some of the newer ones.

This report shows EventTracker's performance in this test. The results are directly comparable with the public SE Labs Enterprise Endpoint Protection (Oct – Dec 2018) report, available here.

Wednesday, 20 February 2019

Can you trust security tests?

Clear, open testing is needed and now available

Latest reports now online.

A year ago we decided to put our support behind a new testing Standard proposed by the Anti-Malware Testing Standards Organization (AMTSO). The goal behind the Standard is good for everyone: if testing is conducted openly then testers such as us can receive due credit for doing a thorough job; you the reader can gain confidence in the results; and the vendors under test can understand their failings and make improvements, which then creates stronger products that we can all enjoy.

The Standard does not dictate how testers should test. There are pages of detail, but I can best summarise it like this:
Say what you are going to do, then do it. And be prepared to prove it.
(Indeed, a poor test could still comply with the AMTSO Standard, but at least you would be able to understand how the test was conducted and could then judge its worth with clear information and not marketing hype!)

We don't think that it's unreasonable to ask testers to make some effort to prove their results. Whether you are spending £30 on a copy of a home anti-antivirus product or several million on a new endpoint upgrade project, if you are using a report to help with your buying decision you deserve to know how the test was run, whether or not some vendors were at a disadvantage and if anyone was willing and able to double-check the results.

Since the start of the year we put our endpoint reports through the public pilot and then, once the Standard was officially adopted, through the full public process. Our last reports were judged to comply with the AMTSO Standard and we've submitted these latest reports for similar assessment.

At the time of writing we didn't know if the reports from this round of testing complied. We're pleased to report today that they did. You can confirm this by checking the AMTSO reference link at the bottom of page three of this report or here.

If you spot a detail in this report that you don't understand, or would like to discuss, please contact us via our Twitter or Facebook accounts.

SE Labs uses current threat intelligence to make our tests as realistic as possible. To learn more about how we test, how we define 'threat intelligence' and how we use it to improve our tests please visit our website and follow us on Twitter.

This test report was funded by post-test consultation services provided by SE Labs to security vendors. Vendors of all products included in this report were provided with early access to results and the ability to dispute details for free. SE Labs has submitted the testing process behind this report for compliance with the AMTSO Standard v1.0.

Our latest reports, for enterprise, small business and home users are now available for free from our website. Please download them and follow us on Twitter and/or Facebook to receive updates and future reports.

Wednesday, 12 December 2018

How well do email security gateways protect against targeted attacks?

Email security test explores how and when services detect and stop threats.

Latest report now online.

This new email protection test shows a wide variation in the abilities of the services that we have assessed.

You might see the figures as being disappointing. Surely Microsoft Office 365 can’t be that bad? An eight per cent accuracy rating seems incredible.

Literally not credible. If it misses most threats then organisations relying on it for email security would be hacked to death (not literally).

But our results are subtler than just reflecting detection rates and it’s worth understanding exactly what we’re testing here to get the most value from the data. We’re not testing these services with live streams of real emails, in which massive percentages of messages are legitimate or basic spam. Depending on who you talk to, around 50 per cent of all email is spam. We don’t test anti-spam at all, in fact, but just the small percentage of email that comprises targeted attacks.

In other words, these results show what can happen when attackers apply themselves to specific targets. They do not reflect a "day in the life" of an average user's email inbox.

We have also included some ‘commodity’ email threats, though – the kind of generic phishing and social engineering attacks that affect everyone. All services ought to stop every one of these. Similarly, we included some clean emails to ensure that the services were not too aggressively configured. All services ought to allow all these through to the inbox.

So when you see results that appear to be surprising, remember that we're testing some very specific types of attacks that happen in real life, but not in vast numbers comparable to spam or more general threats.

The way that services handle threats are varied and effective to greater or lesser degrees. To best reflect how useful their responses are, we have a rating system that accounts for their different approaches. Essentially, services that keep threats as far as possible from users will win more points than those who let the message appear in or near the inbox. Conversely, those that allow the most legitimate messages through to the inbox rate higher than those which block them without the possibility of recovery from a junk folder or quarantine.

If you spot a detail in this report that you don't understand, or would like to discuss, please contact us via our Twitter or Facebook accounts.

SE Labs uses current threat intelligence to make our tests as realistic as possible. To learn more about how we test, how we define 'threat intelligence' and how we use it to improve our tests please visit our website and follow us on Twitter.

Our latest reports, for enterprisesmall business and home users are now available for free from our website. Please download them and follow us on Twitter and/or Facebook to receive updates and future reports.

Monday, 19 November 2018

Join the most secure one per cent of internet users - in minutes

Hackers have spent well over 20 years stealing users' passwords from internet companies.

They've almost certainly got yours.

The good news is it's very easy to make your passwords useless to hackers. All you do is switch on Two-Factor Authentication (2FA).

2FA is a second login layer

It works much like the second lock on your front door. If someone's stolen or copied your Yale key, that double-lock will keep them out.

A digital double-lock is now vital for protecting your online accounts - email, banking, cloud storage, business collaboration and the rest. It's up there with anti-malware in the league of essential security measures. And it's much easier to pick a 2FA method than choose the right anti-malware (our Anti-Malware Protection Reports can help you there).

So 2FA is essential, easy, and doesn't have to cost a thing. It's a security no-brainer. So how come hardly anyone uses it?

Join the one per cent elite!

Earlier this year, Google revealed that only 10 per cent of their users have ever bothered setting up 2FA. Just a fraction of those - we estimate around one per cent of all internet users - use the most secure type of 2FA, a USB security key.

In this article we'll show you how to join that elite one per cent for less than £20. If you'd rather watch a step-by-step demo, here's our YouTube video.


(This blog reflects the views and research of SE Labs, an independent security testing company. We never use affiliate links.)

Why everyone in your business should use 2FA

You're not the only person who knows your usernames and passwords. Head over to Have I Been Pwned? and type in your email address to find out how many of your accounts have been hit by hacking attacks.

A quick (and scary) web search reveals how many times your passwords have fallen prey to hackers

While you're digesting those results, here's a sobering statistic. More than 90 per cent of all login attempts on retail websites aren't by actual customers, but by hackers using stolen credentials (Shape Security, July 2018).

Nearly everyone has had their passwords stolen. But hardly anyone protects their accounts using 2FA. We're all leaving our front doors unlocked.

And as hackers plunder more and more big-name services (as well as all those services you'd forgotten you had accounts with), the more chance they have to steal the passwords you use everywhere.

This is why you must never using the same password twice. Don't be tempted to use a pattern to help you remember them, either ('123amazon', '123google' and so on). Hackers decode that stuff for breakfast. We're also not keen on password managers. They're Target Number One for hackers.

Instead, store your passwords where no-one can find them (not online!) and deadlock your accounts using 2FA. It's the only way to make them hack-proof.

Why a USB key is the best way to lock your accounts

The 'memorable information' you have to enter when logging into your online bank account is a watered-down version of 2FA. Hackers can easily create spoof login pages that fool you into handing over all your info, as demonstrated in our NatWest phishing attack video.

Proper 2FA methods are much tougher to crack. They involve more than one device, so a hacker can't simply ransack your computer and steal all pertinent data. Without the separate device, your passwords are useless to them.

Use more than one 2FA method if offered. This double-locks your double-locks - and also gives you another way into your account if one method fails. See our 2FA YouTube video for a step-by-step guide to doing this for your Google account.

Here's a quick run-through of your options, starting with the most basic.

Google prompt
How it works: Tap your Android screen to confirm your identity.
Pros and cons: Very quick and easy, but only works with Google accounts and Android devices. Useful as a backup option.

SMS code
How it works: You're texted (and/or voice-messaged) a PIN code to enter after your usual login.
Pros and cons: Authentication is split between two devices. It works on any mobile phone at no additional cost. But it can be slow, and the code may appear on your lock screen.

Authentication app
How it works: A free app, such as Google Authenticator, generates a unique numerical security code that you then enter on your PC.
Pros and cons: Faster and more reliable than SMS, and arguably more secure, but you'll need a smartphone (Android or iOS).

Authenticate your logins with a code that's sent to your phone (and only your phone)

Backup codes
How it works: A set of numerical codes that you download and then print or write down - then keep in a safe place. Each code only works once.
Pros and cons: The perfect backup method. No need for a mobile phone. A piece of paper or locally-stored computer file (with disguised filename) is easier to hide from thieves than anything online.

And the most secure 2FA method of all...

USB security key
How it works: You 'unlock' your accounts by plugging a unique USB stick (such as this YubiKey) into your computer.
Pros and cons: A whole list of pros. USB keys are great for business security, because your accounts remain locked even if a hacker breaches your phone. They're convenient: no need to wait for codes then type them in. And they cost very little considering how useful they are. One key costs from £18, and is all you need to deadlock all your accounts. Buy one for all your employees - and clients!

Give a USB security key to all your employees and clients - their security (and yours) will benefit
Deadlock your Google account: a 2FA walk-through
Google lets you lock down your entire account, including Gmail and Google Drive, using multiple layers of 2FA (which it calls 2-Step Verification). It's one of the most secure 2FA configurations you'll find, and it's easy to set up.

Here are the basic steps. For a more detailed step-by-step guide, see our YouTube video.
  1. Order a USB security key. Look for devices described as FIDO ('Fast IDentity Online') - here's a FIDO selection on Amazon - or head straight for the Yubico YubiKey page. Expect to pay from £18 to around £40.
  2. Go to Google's 2-Step Verification page, click Get Started then sign into your account. Choose a backup 2FA method, click Security Key, then plug in your unique USB stick. Google automatically registers it to you.
  3. Choose a second 2FA method such as SMS code, plus a backup method such as a printable code, Google prompt or authenticator app.
  4. That's it - welcome to the top one per cent!
Double-lock your double-locks by choosing more than one 2FA method - and a backup
Deadlock all your online accounts in minutes

All reputable online services now offer 2FA options. But, as you'll discover from the searchable database Two Factor Auth, not all services offer the best 2FA options.

For example LinkedIn only offers 2FA via SMS, and doesn't support authenticator apps or USB security keys - the most secure types of 2FA. Even Microsoft Office 365 doesn't yet support security keys. We expect better from services aimed at business users.

What's more, 2FA settings tend to be well buried in account settings. No wonder hardly anyone uses them. Here's where to click:
  • Amazon: Go to Your Account, 'Login & security', enter your password again, and then click Edit next to Advanced Security settings.
  • Apple: Go to the My Apple ID page then click Security, Two-Factor Authentication.
  • Dropbox: Click the Security tab to set up SMS or app authentication. To configure a USB security key, follow Dropbox's instructions.
  • Facebook: Go to 'Security and login' in Settings and scroll down to 'Use two-factor authentication'. Click Edit to get set up.
  • LinkedIn: Go to Account Settings then click Turn On to activate SMS authentication.
  • Microsoft: Log in, click Security, click the ridiculously small 'more security options' link, verify your identity, and then click 'Set up two-step verification'. Doesn't yet support USB security keys. Some Microsoft services, such as Xbox 360, still don't support 2FA at all.
  • PayPal: Go to My Profile then click My Settings, Security Key and then Get Security Key. Don't accept the offer to get a new code texted to you every time you log in, because then a hacker can do it too!
  • TeamViewer: Go to the login page, open the menu under your name, click Edit Profile then click Start Activation under the 2FA option. Supports authenticator apps only, not SMS.
  • Twitter: Go to 'Settings and privacy', Security, then tick 'Login verification'.
  • WhatsApp: In the mobile app tap Settings, Account, 'Two-step verification'.