NSS Labs Announces 2018 Next Generation Firewall Group Test

AUSTIN, Texas, July 17, 2018 (GLOBE NEWSWIRE) -- NSS Labs, Inc., a global leader and trusted source for independent, fact-based cybersecurity guidance, today announced the results of its 2018 Next Generation Firewall (NGFW 8.0) Group Test. In this year’s test, 10 products were examined for security effectiveness, performance, and total cost of ownership (TCO). 

The NGFW is the first line of defense against today’s threats and is a critical component of any defense-in-depth strategy. The NGFW market is one of the largest and most mature markets in the cybersecurity industry. According to the NSS Labs 2017 Security Architecture Study, 80.5% of US enterprises deploy NGFWs. ¹ Industry analysts estimate that the NGFW market is estimated to grow from US$2.39 billion in 2017 to US$4.27 billion by 2022 at a compound annual growth rate (CAGR) of 12.3%. ²

Of the products that participated in NSS Labs’ 2018 NGFW Group Test, six out of the 10 products assessed demonstrated resistance to common evasion techniques with the remaining four missing at least one evasion technique. Evasion techniques are commonly used by attackers as a means of disguising and modifying attacks at the point of delivery to avoid detection and blocking by security products. Failure of a security device to correctly identify a specific type of evasion potentially allows an attacker to use an entire class of exploits for which the device is assumed to have protection.  

In this eighth iteration of the NGFW test, NSS Labs expanded its evasion testing to include resiliency against modified exploits. The resiliency of a product is defined as its ability to absorb an attack and reorganize around the attack. When an attacker is presented with a vulnerability, the attacker can select one or more paths to trigger the vulnerability using a nearly infinite number of representations of the exploit. A resilient product will be able to detect and prevent against different variations of an attack. Of the products tested, none demonstrated full resilience against tested attack variants. With the expanded use of secure sockets layer (SSL)/transport layer security (TLS) in the traffic traversing the modern network, an NGFW must be able to inspect encrypted content. NSS Labs also expanded test with the inclusion secure sockets layer (SSL)/transport layer security (TLS) testing.

In conjunction with the 2018 NGFW Group Test, NSS Labs conducted an investigation of attacks using JavaScript and attacks using code obfuscation on NGFW products. Code obfuscation is an effective evasion tactic against many NGFWs. None of the products tested properly decoded JavaScript and instead appeared to simply rely on signatures to detect common obfuscation tools. This NSS Labs investigation shows that code obfuscation reduces the average effectiveness of detecting malicious activity by as much as 34% with some products missing as much as 60% of the attacks obfuscated with common JavaScript tools. In addition, benign content transformed with common JavaScript tools can more than double false positive rates for some products. Since these mechanisms are used during everyday browsing, they represent potentially high operational costs for the enterprise security teams that manage NGFWs.

Key Findings from the test:

• Overall Security Effectiveness ranged from 25.0% to 99.7%, with 60% of the tested products achieving a rating greater than 90.3%.
• The average Security Effectiveness rating was 66.1%; 7 of the products tested received a recommended rating.
• TCO per Protected Mbps ranged from US$2 to US$57, with most tested products costing less than US$10 per protected Mbps.
• The average TCO per Protected Mbps was US$20.86; 70% of the products tested were rated as having above-average value, and 30% of the products tested were rated as having below-average value.
• 40% of the products tested missed at least one evasion.
• Of the products tested, none demonstrated full resilience against tested attack variants.

“NGFW is a mature market with significant room for growth,” said Jason Brvenik, Chief Technology Officer at NSS Labs. “Newer entrants in the market are demonstrating strong capabilities and challenging established players. NSS Labs recommends enterprises exercise diligence in evaluating NGFW products to ensure both enterprises and end users are protected.”

The following products were tested:

• Barracuda Networks CloudGen Firewall F800.CCE v7.2.0
• Check Point 15600 Next Generation Threat Prevention (NGTP) Appliance vR80.20
• Cisco Firepower 4120 Security Appliance v6.2.2
• Forcepoint NGFW 2105 Appliance v6.3.3 build 19153 (Update Package: 1056)
• Fortinet FortiGate 500E V5.6.3GA build 7858
• Palo Alto Networks PA-5220 PAN-OS 8.1.1
• SonicWall NS a 2650 SonicOS Enhanced 6.5.0.10-73n
• Sophos XG Firewall 750 SFO v17 MR7
• Versa Networks FlexVNF 16.1R1-S6
• WatchGuard M670 v12.0.1.B562953

NSS Labs is committed to providing empirical data and objective group test results that enable organizations to make educated decisions about purchasing and optimizing security infrastructure products and services. As with all  NSS Labs group tests , there is  no fee for participation , and the test methodology is available in the public domain  to provide transparency and to help enterprises understand the factors behind test results. Click  here  for more information about our group test policies.

Click here  for more information on this test and the test methodology used or to purchase the individual test reports.  Click here to download the Security Value Map ^™ , which provides a graphic comparison of  Security Effectiveness  and TCO across the tested products.

Additional Resources: 

• Purchase the NSS Labs 2018 NGFW Group Test Reports
• View the 2018 NGFW Group Test Methodology
• Download our infographic titled “Next Generation Firewall: Holding Its Own After More Than a Decade”
• Read our white paper titled “Evolution of Next Generation Firewall”
• Read our blog titled “Firewall Testing Through the Years”
• Read our blog titled “Don’t Stop at Catch Rate: Why Evasion Handling is Crucial”
• Read our blog titled “Next Generation Firewall – A look at Deployments in 2017”
• Learn more about NSS Labs’  Security Product Testing
• Learn more about NSS Labs’  Test Policies
• Learn more about NSS Labs’ Cloud Platform for Continuous Security Validation
• Follow NSS Labs on  Twitter
• Follow NSS Labs on  LinkedIn
• Browse the NSS Labs  Research Library

1. NSS Labs “Security Controls in the US Enterprise: Next Generation Firewalls,” August 2017
2. Markets and Markets “Next Generation Market by Delivery Type, Service, Organization Size, Vertical, and Region – Global Forecast to 2022,” June 2017

About NSS Labs, Inc. NSS Labs, Inc. is recognized globally as the most trusted source for independent, fact-based cybersecurity guidance. Our mission is to advance transparency and accountability within the cybersecurity industry. Our unmatched   foundation in security testing, along with our extensive research and global threat analysis capabilities, provide the basis for NSS Labs’ Cloud Platform for Continuous Security Validation. This cloud platform empowers enterprises with objective, empirical data and allows them to gain continuous visibility, gather actionable insights, and rationalize investments in their cyber programs. The cloud platform lets enterprises know where they stand by continuously validating the effectiveness of their security products and assessing the impact of unmitigated risks to the enterprise stack. This gives business leaders the relevant information they need to substantiate their security investments. CISOs, Chief Security Architects, SOC and Threat Analysts, and information security professionals from many of the world's largest and most demanding enterprises rely on trusted information from NSS Labs. For more information, visit  www.nsslabs.com .

Contact: Jessica Johannes Phone: +1 512-498-7076 jjohannes@nsslabs.com