Critical.
Authoritative.
Strategic.
Subscribe to CIO Magazine »

Microsoft vows to improve security suite after failed evaluation

AV-Test.org failed the company again in another round of security software testing
  • (IDG News Service)
  • 17 January, 2013 03:45

Microsoft vowed on Wednesday to improve two of its security products after both failed to pass an evaluation by a Germany security software testing organization.

The company's Security Essentials and Forefront Endpoint Protection failed to earn a "certified" status in a latest round of testing by AV-Test to see how effective the products are against malicious software.

AV-Test, which conducts tests every two months at its laboratories in Magdeburg and Leipzig, also failed PC Tools' Internet Security 2012 and AhnLab's V3 Internet Security 8.0. In October, AV-Test failed to give Microsoft certified status for its Security Essentials versions 4.0 and 4.1.

Security software companies have often contested the conditions under which their products are examined by testing organizations following a poor rating, frequently arguing that testing parameters are flawed.

Joe Blackbird, a program manager in Microsoft's Malware Protection Center, softly contested AV-Test's methodology, which involves running the software security against a range of malware.

Blackbird wrote that Microsoft prioritizes how it provides protection based on the prevalence of threats. Many of the malware samples that AV-Test used were never encountered by millions of Microsoft systems, he wrote on a company blog.

In one example, Microsoft detected only 72 pieces of malware out of a sample of 100 pieces of zero-day malware, or attack code for which a detection signature has not been created yet.

But "we know from telemetry from hundreds of millions of systems around the world that 99.997 percent of our customers hit with any zero-day did not encounter the malware samples tested in this test," Blackbird wrote.

Microsoft did not detect about 9 percent of 216,000 pieces of "recent" malware in the AV-Test evaluation. But Blackbird wrote that 94 percent of missed samples were never encountered by the company's customers.

"When we explicitly looked for these files, we could not find them on our customers' machines," according to Blackbird.

Microsoft calculated that .0033 percent of its customers were impacted by malware that the company did not detect. But Blackbird noted that Microsoft had since added detection for some of those threats. Nonetheless, "we're committed to reducing our 0.0033 percent margin to zero," Blackbird wrote.

In December, Blackbird wrote that Microsoft processed 20 million new potentially malicious files. The company prioritizes how it blocks those threats, and added protection for four million of those.

"Those 4 million files could have been customer-impacting if we had not prioritized them appropriately," Blackbird wrote.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.

Comments are now closed.
Related Coverage
Related Whitepapers
Latest Stories
Community Comments
Tags: intrusion, security, Microsoft, AV-Test, Exploits / vulnerabilities
Latest Blog Posts
Whitepapers
  • Facebook Graph Search POV
    A description and analysis of Facebook Social Graph, monetization opportunities and its value to businesses.
    Learn more »
  • IBM X-Force Threat Intelligence
    In the second half of 2013, the advancement of security breaches across all industries continued to rise. Within this report, we’ll explain how more than half a billion records of personally identifiable information (PII) such as names, emails, credit card numbers and passwords were leaked in 2013 - and how these security incidents show no signs of stopping.
    Learn more »
  • The F5 DDoS Protection Reference Architecture part 3 of 3
    This whitepaper is the third in a three-part series on distributed denial of service attacks (DDoS) and multi-tier DDoS protection. This section refers to case studies of different approaches to deploying protection architecture, including an enterprise customer scenario, an FSI customer scenario and an SMB customer scenario. The paper explains how these options should provide the flexibility and needed to combat the modern DDoS threat.
    Learn more »
All whitepapers
rhs_login_lockGet exclusive access to Invitation only events CIO, reports & analysis.
Salary Calculator

Supplied by

View the full Peoplebank ICT Salary & Employment Index


Computerworld
ARN
Techworld
CMO