AV-Comparatives: Business Security Test August-September 2019 – Factsheet

[harlan4096]

Introduction

This is a short fact sheet for our Business Main-Test Series, containing the results of the Business Malware Protection Test (September) and Business Real-World Protection Test (August-September). The full report, including the Performance Test and product reviews, will be released in December.

To be certified in December as an “Approved Business Product” by AV-Comparatives, the tested products must score at least 90% in the Malware Protection Test, and at least 90% in the overall Real-World Protection Test (i.e. over the course of 4 months), with zero false alarms on common business software. Tested products must also avoid major performance issues and have fixed all reported bugs in order to gain certification.

Please note that the results of the Business Main-Test Series cannot be compared with the results of the Consumer Main-Test Series, as the tests are done at different times, with different sets, different settings, etc.

Information about additional third-party engines/signatures used by some of the products: Cisco, FireEye, Seqrite and VIPRE use the Bitdefender engine (in addition to their own protection features).

Note that Endgame was acquired by Elastic N.V. on Oct 8, 2019. The product is now called Elastic Endpoint Security.

In business environments, and with business products in general, it is usual for products to be configured by the system administrator, in accordance with vendor’s guidelines, and so we invited all vendors to configure their respective products. About half of the vendors provide their products with optimal default settings which are ready to use, and did therefore not change any settings. Cloud and PUA detection have been activated in all products. We currently do not include any PUA in our malware tests.

Below we have listed relevant deviations from default settings (i.e. setting changes applied by the vendors):

Bitdefender: “HyperDetect”, “Device Sensor” and “EDR Sensor” disabled.

Cisco: everything enabled.

CrowdStrike: everything enabled and set to maximum, i.e. “Extra Aggressive”.

Endgame: Enabled Software and Hardware protection options: all enabled; Protected Applications: “Browser”, “Microsoft Suite” (incl. Fltdr.exe and EQNEDT32.exe), “Java” and “Adobe”. Malware (on-execution and on-write): “On – Prevent mode”; Process Injection: “On – Prevent mode”; Options: all enabled; “Aggressive” threshold. Adversary behaviors: all enabled; Credential dumping: enabled; Ransomware: disabled. Note that settings were renamed in the newer version.

FireEye: “Real-Time Indicator Detection” disabled, “Exploit Guard” and “Malware Protection” enabled.

Fortinet: Real-Time protection, FortiSandbox, Webfilter and Application Firewall (in order to use Detect & Block Exploits) enabled.

McAfee: “Email attachment scanning” enabled; “Real Protect” enabled and set to “high” sensitivity, “read/write scan of Shadow Copy Volumes” disabled, “Access Protection” and “Exploit Prevention” disabled.

Microsoft: Cloud protection level set to “High”.

Sophos: “Web Control” and “Protect against data loss” disabled.

SparkCognition: all “Policy Settings” and all “Attack Vectors” settings enabled.

Trend Micro: Behaviour monitoring: “Monitor new encountered programs downloaded through web” enabled; “Certified Safe Software Service for Behaviour monitoring” enabled; “Smart Protection Service Proxy” enabled; “Use HTTPS for scan queries” enabled; Web Reputation Security Level set to Medium; “Send queries to Smart Protection Servers” disabled; “Block pages containing malicious script” enabled; Real-Time Scan set to scan “All scannable files”, “Scan compressed files to Maximum layers 6”; “CVE exploit scanning for downloaded files” enabled; “ActiveAction for probable virus/malware” set to Quarantine; Cleanup type set to “Advanced cleanup” and “Run cleanup when probable virus/malware is detected” enabled; “Block processes commonly associated with ransomware” enabled; “Anti-Exploit Protection” enabled; all “Suspicious Connection Settings” enabled and set to Block.

Avast, ESET, K7, Kaspersky, Panda, Seqrite, Symantec, VIPRE: default settings.
...

Full Report