Verizon: 80% of Security Products Do Not Perform as Intended

Nearly 80 percent of security products fail to perform as intended when first tested, according to ICSA Labs, an independent division of Verizon Business. Across seven product categories, core product functionality accounted for 78 percent of initial test failures -- for example, an anti-virus product failing to prevent infection or an IPS (intrusion prevention system) product failing to filter malicious traffic. ICSA Labs, which offers vendor-neutral testing and certification of security products, said failure of a product to completely and accurately log data was the second most common reason security products do not perform as intended. Incomplete or inaccurate logging of who did what and when accounted for 58 percent of initial failures.


The report findings suggest that some vendors and enterprise users consider logging a nuisance and merely a "box to check." According to the report, logging is a particular challenge for firewalls. Almost every network firewall (97 percent) or Web application firewall (80 percent) tested experienced at least one logging problem.


The third most significant reason for product failure is the finding that 44 percent of security products had inherent security problems, including vulnerabilities that compromise the confidentiality or integrity of the system and random behavior that affects product availability. http://http://www.icsalabs.com.
http://www.icsalabs.com/whitepaper/report