MGR Effitas - 360 Degree Assessment & Certification Q3 2019

[harlan4096]

Introduction

MRG Effitas has a core focus on efficacy assessments both in the anti–financial fraud space and also in the traditional “Real World” detection tests.

The methodology employed in this test maps closely to Real World use.

This Programme is called a “360 Assessment” since it deals with the full spectrum of malware instead of just financial malware. In the 360 Assessments, trojans, backdoors, financial malware, ransomware and “other” malicious applications are used. Besides the “Real world test”, we performed tests to check PUA/adware protection, exploit/fileless protection, measured the false positive detection rates and also the performance impacts of the security products.

Executive Summary

This Certification Programme is designed to serve as a reflection of product efficacy based on what we have previously termed “metrics that matter”.

In many of our previous tests, particularly those that have focused on financial malware, we started with the assumption that the endpoint has already been compromised. Being one of the world’s largest supplier of early-life malicious binaries and malicious URLs, and from our own simulator development, we know that all endpoints can be infected, regardless of the security solutions employed.

For us, a product’s ability to block initial infection (although critical in most cases) is not the only metric that matters. One also needs to measure the time taken for the security product to detect malware on a system and remediate it.

When conducting these tests, we tried to simulate normal user behaviour. We are aware that a “Real World” test cannot be conducted by a team of professionals inside a lab because we understand how certain types of malware work, how malware attacks and how such attacks could be prevented. Simulating normal user behaviour means that we paid special attention to all alerts given by security applications. A pass was given only when alerts were straightforward and clearly suggested that malicious action should be blocked
...

Full PDF Report