Seculert gateway performance report 2015
- 1. The Seculert Attack Detection & Analytics Platform, delivered as a service, identifies attacks that have defeated perimeter prevention systems based on the evidence the attacker inevitably leaves behind as they execute their malicious activities. In the course of protecting more than 1.5 million enterprise users, Seculert researchers observe the performance of all of the leading web gateway solutions. This report summarizes how well these solutions did in blocking malicious communications generated by attacks that succeeded in penetrating our customer’s networks during the first 10 months of 2015. United States 2880 Lakeside Drive, #228 Santa Clara, CA 95054 Tel: +1 408 560 3400 Israel 6 Efal Street, P.O. Box 3970 Petach Tikvah, IL 4952801 Tel: +972 3 919 3366 www.seculert.com Toll Free (US/Canada): +1 855 732 8537 Tel (UK): +44 203 6444 Fax: +972 3 919 3636 Copyright 2015 Web Gateway Performance Report Fast Facts ! One million client devices ! 200 Billion communications ! 8 Web Gateways - Barracuda, BlueCoat, Fortigate, Ironport, McAfee Web Gateway, Palo Alto Networks, Websense, Zscaler ! 10 Months PERCENTAGE OF DEVICES ALLOWED TO COMMUNICATE OUT Market Leading Gateway Vendors Key Findings ! More than half the gateways studied allowed more than 40% of the attempted malicious communications to succeed in reaching their associated C&C servers. ! 40% of all attempted malicious communication succeeded in defeating their associated web gateway. ! Nearly all of the leading web gateways allowed significant outbound communications attributable to Dyre and Trojan.Agent.145 ! Nearly 2% of all examined devices were infected and all domains included in the research exhibited evidence of infection. ! The average number of successful outbound communications per incident (or infected device) was more than 100. ! Measured over time, nearly all of the gateways observed exhibited uneven performance. While most performed well for weeks or months, eventually all showed evidence of being “defeated” by the adversary. 0%# 10%# 20%# 30%# 40%# 50%# 60%# 70%# 80%# 90%# 100%# A# B# C# D# E# F# G# H# !"!!!! !50!! !100!! !150!! !200!! !250!! !300!! !350!! !400!! E! D! H! A! B! C! F! COMMUNICATIONS ALLOWED PER INCIDENT SAMPLE GATEWAY PERFORMANCE COMMUNICATIONSALLOWEDOUT 0%# 20%# 40%# 60%# 80%# 100%# 120%# Jan# Feb# Mar# Apr# May# Jun# Jul# Sept# Oct#