Lab Testing Detailed Report DR January Competitive Testing of Web Security Devices

Transcription

1 Lab Testing Detailed Report DR January 2014 Competitive Testing of Web Security Devices Websense TRITON Web Security Gateway Anywhere Blue Coat ProxySG Secure Web Gateway, Proxy Edition Check Point Appliance Next-Generation Threat Protection McAfee WG-5500-B Web Gateway Palo Alto Networks PA-2020 Next-Generation Firewall Miercom

2 Contents 1.0 Executive Summary Products Tested Websense TRITON Web Security Gateway Anywhere (WSGA) Blue Coat ProxySG Secure Web Gateway, Proxy Edition Check Point Appliance Next-Generation Threat Protection McAfee WG-5500-B Web Gateway Palo Alto Networks PA-2020 Next-Generation Firewall Hardware and Software Used in Testing Overall Results Web Security Effectiveness Testing Web Security Effectiveness by Individual Categories Drive-By Installers Exploits Phishing Malicious Redirects Risk Web Filtering Testing Risk Web Filtering Testing, Results of Individual Categories Adult Gambling Hacking Proxy Avoidance Conclusion Copyright 2014 Miercom Page 2 DR131118

3 1.0 Executive Summary Miercom conducted an independent third-party validation of the Websense TRITON Web Security Gateway Anywhere (WSGA) and four competing web security products: the Blue Coat ProxySG Secure Web Gateway, the Check Point Appliance Next-Generation Threat Protection, the McAfee WG-5500-B Web Gateway and the Palo Alto Networks PA-2020 Next-Generation Firewall. Two types of testing were conducted to evaluate the ability of the appliances to block threats and certain types of risky web content using a URL sample set sourced independently by Miercom that was unknown to any of the vendors. Web Security Effectiveness testing verified the detection, classification and blocking of multiple web threats: drive-by-installers, complex exploits, phishing and malicious redirects. Risk Web Filtering testing verified the ability to detect and block various types of risky web content, such as sexual material, gambling, proxy avoidance and hacking. Blocking these types of web content is an important aspect of controlling online access to minimize loss of user productivity, manage bandwidth costs, prevent potentially malicious content from entering the enterprise network and meet compliance requirements. In both portions of testing, products that employ real-time dynamic content analysis tended to outperform those that rely on static database lookups for URL matching and/or threat signatures. We were pleased with the overall performance of the Websense TRITON WSGA solution, particularly its malware blocking and its real-time defense effectiveness. The Advanced Classification Engine (ACE) is a key component of Websense TRITON, employing advanced machine learning to quickly and accurately classify pages in real time based on contextual assessment of content including images, multimedia and links. The Websense TRITON WSGA solution demonstrated its ability to protect against both known and emerging threats. Key results validated that it had: The highest overall blocking rate, 98.1% (15,991 of 16,307 samples in eight categories) The highest blocking rate in both portions of testing, 98.2% in web security effectiveness and 98.0% in risk web filtering The highest blocking rate in all eight categories A blocking rate of more than 94% in seven of the eight categories The Websense TRITON WSGA solution demonstrated the ability to provide some of the most advanced real-time threat protection and content classification we have observed in testing to date. Therefore, it has earned the Miercom Performance Verified Certification. Rob Smithers CEO Miercom Copyright 2014 Miercom Page 3 DR131118

4 2.0 Products Tested 2.1 Websense TRITON Web Security Gateway Anywhere (WSGA) Part of the TRITON unified security platform, Websense TRITON Web Security Gateway Anywhere (WSGA) provides content analysis of web and SSL traffic in real time, ensuring safe use of the Internet. The Websense TRITON WSGA solution can analyze new sites and dynamic content in real time while proactively discovering security risks and blocking unsafe malware. Its Advanced Classification Engine (ACE) detects, blocks or strips malicious code before it enters the network. The WSGA dashboards offer feedback on network security, threat detection, traffic loads and user activity for both inbound and outbound traffic. The primary defense of all Websense TRITON solutions, ACE provides real-time, inline, contextual defense for web, , data and mobile security by using composite risk scoring and predictive analysis on inbound and outbound web traffic. ACE works in conjunction with a proprietary cloud-based threat intelligence security network, the Websense ThreatSeeker Intelligence Cloud, which collects data from more than 900 million endpoints and analyzes up to 5 billion web requests every day. The Websense TRITON management console can be used to configure web security, data loss prevention (DLP) and security on a single, easy-to-manage appliance. It offers both on-premise and unified hybrid cloud security that protects remote and mobile end users or entire offices. The hardware portion of the Websense TRITON WSGA solution tested was the 1U Websense V10000 appliance. Designed for headquarters locations and large branch offices, the V10000 has 24GB RAM and 6 1GB Base-T network interface ports and supports up to 7,500 users. 2.2 Blue Coat ProxySG Secure Web Gateway, Proxy Edition A 1U web control product, the Blue Coat ProxySG , Proxy Edition enables branch users to have the same security coverage as those in a main office or headquarters location. URL filtering is part of the functionality that provides protection and control of web traffic. ProxySG appliances deployed with Blue Coat WebFilter automatically include Web Pulse and Blue Coat Proxy Client for remote user protection, filtering and acceleration. The ProxySG is intended to serve up to 6,000 employees. Built-in ports are as follows: two 10000Base-T with bypass and two 1000-BaseT (no bypass), onboard SSL. It also has two 1TB SAS hard drives. 2.3 Check Point Appliance Next-Generation Threat Protection There are four possible security configurations for the Check Point appliance depending on the software modules used. In addition to Next-Generation Threat Protection, the others are Next-Generation Firewall, Next-Generation Data Protection and Secure Web Gateway. The tested had the URL Filtering software module as part of the Next-Generation Threat Protection configuration, which provides multi-layer protection against web-borne malware. The Next-Generation Threat Protection is the most robust of the four since it has 11 of a possible 12 software modules as standard. In addition to URL filtering, the other modules active in the Next-Generation Threat Protection configuration are Firewall, Identity Awareness, IPsec VPN, Advanced Networking & Clustering, Application Control, Mobile Access, IPS, Antivirus, Anti-Spam and Security, and Anti-Bot. The firmware utilized was R76. Copyright 2014 Miercom Page 4 DR131118

5 The basic hardware configuration of the appliance includes 8 10/100/1000Base-T ports, one network card expansion slot, 4 GB memory and a 500GB hard drive. 2.4 McAfee WG-5500-B Web Gateway McAfee Web Gateways protect the enterprise network from inbound and outbound Web-borne threats. The WG-5500-B is the high-end model in the McAfee family of medium- and enterprisecapacity appliances. Specifications include 12GB of memory, four copper 10/100/1000 network interface ports and RAID-10. The URL filtering functionality of McAfee Web Gateways is McAfee Global Threat Intelligence (GTI), which filters on reputation and category. The following is from the McAfee data sheet: McAfee GTI creates a profile of all Internet entities websites, , and IP addresses based on hundreds of different attributes gathered from the massive global data collection capabilities of McAfee Labs. It then assigns a reputation score based on the security risk posed, enabling administrators to apply very granular rules about what to permit or deny. 2.5 Palo Alto Networks PA-2020 Next-Generation Firewall The PA-2020 Next-Generation Firewall from Palo Alto Networks is designed for use as a highspeed Internet gateway, providing network security and threat prevention in large branch offices and medium-sized enterprises. URL filtering functionality for the PA-2020 is available via subscription. The functionality is based on an on-box customizable database that can include up to 76 categories and 20 million URLs. The user can customize categories, allowable content, block lists and block pages. The maximum number of policies that can be created is 2,500. Specifications include a 180-watt power supply, a 160GB hard drive and 12 10/100/1000, 2 gigabit SFP. The SFP transceivers are sold separately. Copyright 2014 Miercom Page 5 DR131118

6 3.0 Hardware and Software Used in Testing Source: Miercom, January 2014 Product Name Function Software Version Websense TRITON WSGA Secure web gateway TRITON Blue Coat ProxySG Secure web gateway SGOS Proxy Edition Check Point Next-Generation Threat Protection R76 firmware McAfee WG-5500-B Web gateway Web Gateway 7 ( ) Palo Alto Networks PA-2020 Next-generation firewall Mu Dynamics Mu-8000 Spirent Studio Security Ixia XM12 BreakingPoint FireStorm Security testing appliance Security testing software Primary traffic generator Alternate traffic generator and security test system Apache JMeter Load testing tool Miercom client URL Filtering Client Ubuntu Linux 12.04LTS The Ixia XM12 was the primary traffic generator. Ixia ( is an industry leader in performance testing of networking equipment. Real-world traffic was generated by the test platform and test applications, principally IxAutomate for Layer 2-3 switching and routing traffic. The BreakingPoint FireStorm was the alternate traffic generator. Copyright 2014 Miercom Page 6 DR131118

7 4.0 Overall Results The Websense TRITON WSGA made the best overall performance of the five web security products tested. Its 98.1% blocking rate, shown in Table 1 and Figure 1 is the result of blocking 15,991 of 16,307 in the eight categories. Also, Websense TRITON WGSA had the highest blocking rate in all eight categories and in both portions of testing, 98.2% in web security effectiveness and 98.0% in web risk filtering. Table 1: Overall Blocking Rate, URLs in Eight Categories Vendor Product Sample Size Retrieved Percentage Websense TRITON WSGA 16, , % Check Point NGTP 16,307 1,176 15, % Blue Coat SG ,307 3,638 12, % McAfee WG-5500-B 16,307 3,696 12, % Palo Alto Networks PA ,307 5,242 11, % Average 16,307 2, , % Figure 1: Overall Blocking Rate, URLs in Eight Categories Percentage (%) Websense TRITON WSGA Check Point NGTP Blue Coat SG Source: Miercom Web Security Industry Assessment, January 2014 McAfee WG-5500-B Palo Alto Networks PA-2020 Copyright 2014 Miercom Page 7 DR131118

8 5.0 Web Security Effectiveness Testing Description This series of tests assessed the ability of each security appliance to analyze and block realworld threats sourced by Miercom from an unbiased sample set of live Internet targets. The threats were drive-by installers, complex exploits, phishing and malicious redirects. Configuration and Procedure A sample set of thousands of live malicious web targets was used. A generic diagram of the test bed, direct path, is below. Figure 2: Direct Path Testing Each security appliance had the latest software and database(s) as well as access to the latest cloud lookup services. Default security policies, including anti-malware engines, as well as settings required to filter URLs in a specific category were enabled. The Miercom client, Apache JMeter, sent an HTTP GET request to the target web server via the web gateway, the router and the Internet. The client was configured to wait up to 20 seconds for the web gateway to render a decision, block or pass. The 20 seconds was intended to remove the possibility of a temporary Internet issue from interfering with a block or pass decision. The composition of the sample set is shown in Table 2. Table 2: Sample URLs in Each Web Security Effectiveness Category Category of URLs Drive-by Installers 37 Exploits 108 Phishing 3,536 Redirects 44 Total 3,725 Copyright 2014 Miercom Page 8 DR131118

9 Expected Results The expectation was that each web security product would detect and filter or block drive-by installers, exploits, phishing and malicious redirect URLs. Overall Results The Websense TRITON WSGA made the best overall performance, finishing first in all four categories and recording a blocking rate of 98.2% (3,657 of 3,725 samples) as shown in Table 3 and Figure 3 below. Table 3: Overall Blocking Rate Web Security Effectiveness in Four Categories Vendor Product Sample Size Retrieved Percentage Websense TRITON WSGA 3, , % McAfee WG-5500-B 3, , % Check Point NGTP 3, , % Blue Coat SG ,725 1,916 1, % Palo Alto Networks PA ,725 3, % Average 3,725 1, , % Figure 3: Overall Blocking Rate Web Security Effectiveness, URLs in Four Categories Percentage (%) Websense TRITON WSGA McAfee WG-5500-B Check Point NGTP Source: Miercom Web Security Industry Assessment, January 2014 Blue Coat SG Palo Alto Networks PA-2020 Copyright 2014 Miercom Page 9 DR131118

10 6.0 Web Security Effectiveness by Individual Categories 6.1 Drive-By Installers Configuration Websense TRITON WSGA was configured to block all available security categories. Blue Coat ProxySG , Proxy Edition was configured to block all available security categories. Check Point NGTP was configured to block all available security categories as well as high risk and critical risk categories. McAfee WB-5500-B was configured to block all available security categories. Palo Alto Networks PA-2020 was configured to block all available security categories. Each product was configured with the latest versions of software/firmware and databases. All were also configured to utilize their AV engine(s) as well as cloud lookup services. The log information from the management interface was used to see all categories assigned per sample blocked. This log was compared to the Miercom scripts log for better accuracy. Results The Websense WSGA had the highest blocking rate, 94.6%, as shown in Table 4 below and Figure 4 on the following page. Table 4: Blocking Rate, Drive-by Installer URLs Vendor Product Sample Size Retrieved Percentage Websense TRITON WSGA % McAfee WG-5500-B % Blue Coat SG % Check Point NGTP % Palo Alto Networks PA % Average % Copyright 2014 Miercom Page 10 DR131118

11 Figure 4: Blocking Rate, Drive-by Installer URLs Percentage (%) Websense TRITON WSGA McAfee WG-5500-B Blue Coat SG Source: Miercom Web Security Industry Assessment, January 2014 Check Point NGTP 0.0 Palo Alto Networks PA-2020 The category, Drive-by Installers, had the smallest sample set in the test. The Websense TRITON WSGA was the winner by a large margin, blocking 35 of the 37 URLs for a blocking rate of 94.6%. The runner-up failed to block 16 URLs. Copyright 2014 Miercom Page 11 DR131118

12 6.2 Exploits Configuration Websense TRITON WSGA was configured to block all available security categories. Blue Coat ProxySG , Proxy Edition was configured to block all available security categories. Check Point NGTP was configured to block all available security categories as well as high risk and critical risk categories. McAfee WB-5500-B was configured to block all available security categories. Palo Alto Networks PA-2020 was configured to block all available security categories. Each product was configured with the latest versions of software/firmware and databases. All were also configured to utilize their AV engine(s) as well as cloud lookup services. The log information from the management interface was used to see all categories assigned per sample blocked. This log was compared to the Miercom scripts log for better accuracy. Results The Websense WSGA had the highest blocking rate, 99.1, as shown in Table 5 below and Figure 5 on the following page. The blocking rate of the runner-up was more than 30% adrift. Table 5: Blocking Rate, Exploit URLs Vendor Product Sample Size Retrieved Percentage Websense TRITON WSGA % Blue Coat SG % McAfee WG-5500-B % Check Point NGTP % Palo Alto Networks PA % Average % Copyright 2014 Miercom Page 12 DR131118

13 Figure 5: Blocking Rate, Exploit URLs Percentage (%) Websense TRITON WSGA Blue Coat SG McAfee WG-5500-B Check Point NGTP 7.4 Palo Alto Networks PA-2020 Source: Miercom Web Security Industry Assessment, January 2014 In terms of blocking percentage, the performance of the Websense TRITON WSGA in the Exploits Category was the best in the entire test. The Websense solution blocked all but one of the 108 samples, earning a blocking rate of 99.1%. Copyright 2014 Miercom Page 13 DR131118

14 6.3 Phishing Configuration Websense TRITON WSGA was configured to block phishing and all available security categories. Blue Coat ProxySG , Proxy Edition was configured to block phishing and all available security categories. Check Point NGTP was configured to block phishing, as well as all available security, high risk and critical risk categories. McAfee WB-5500-B was configured to block phishing and all available security categories. Palo Alto Networks PA-2020 was configured to block phishing and all available security categories. Each product was configured with the latest versions of software/firmware and databases. All were also configured to utilize their AV engine(s) as well as cloud lookup services. The log information from the management interface was used to see all categories assigned per sample blocked. This log was compared to the Miercom scripts log for better accuracy. Results The Websense WSGA had the highest blocking rate, 98.2%, as shown in Table 6 and Figure 6 on the following page. Table 6: Blocking Rate, Phishing URLs Vendor Websense Product TRITON WSGA Sample Size Retrieved Percentage 3, , % McAfee WG-5500-B 3, , % Check Point , , % Blue Coat SG ,536 1,832 1, % Palo Alto Networks PA ,536 3, % Average 3,536 1, , % Copyright 2014 Miercom Page 14 DR131118

15 Figure 6: Blocking Rate, Phishing URLs Percentage (%) Websense TRITON WSGA McAfee WG-5500-B Check Point NGTP Blue Coat SG Palo Alto Networks PA-2020 Source: Miercom Web Security Industry Assessment, January 2014 Phishing was the category with the largest gap between the blocking rate of the leader and the last-place finisher. The leader, the Websense TRITON WSGA, had a blocking rate of 98.2%, 95.3% clear of the Palo Alto Networks PA Copyright 2014 Miercom Page 15 DR131118

16 6.4 Malicious Redirects Configuration Websense TRITON WSGA was configured to block malicious redirects and all available security categories. Blue Coat ProxySG , Proxy Edition was configured to block all available security categories. Check Point NGTP was configured to block all available security categories as well as high risk and critical risk categories. McAfee WB-5500-B was configured to block all available security categories. Palo Alto Networks PA-2020 was also configured to block all available security categories. Each product was configured with the latest versions of software/firmware and databases. All were also configured to utilize their AV engine(s) as well as cloud lookup services. The log information from the management interface was used to see all categories assigned per sample blocked. This log was compared to the Miercom scripts log for better accuracy. Results The Websense WSGA had the highest blocking rate, 98.2%, as shown in Table 7 and Figure 7 on the following page. Table 7: Blocking Rate, Malicious Redirects Vendor Product Sample Size Retrieved Percentage Websense TRITON WSGA % McAfee WG-5500-B % Blue Coat SG % Check Point NGTP % Palo Alto Networks PA % Average % Copyright 2014 Miercom Page 16 DR131118

17 Figure 7: Blocking Rate, Redirects Percentage (%) Websense TRITON WSGA McAfee WG-5500-B Blue Coat SG Check Point NGTP Palo Alto Networks PA-2020 Source: Miercom Web Security Industry Assessment, January 2014 The Websense solution blocked all but one of the 44 malicious redirects, earning a blocking rate of 97.7%. The McAfee WG-5500-B took second place by blocking less than half of the sample set, reaching a 45.4% blocking rate. Copyright 2014 Miercom Page 17 DR131118

18 7.0 Risk Web Filtering Testing This series of tests assessed the ability of each security appliance to analyze and block web content in four risk categories. The URLs were sourced by Miercom from an unbiased sample set of live Internet targets. The four risk categories were adult, gambling, hacking and proxy avoidance. These web targets often compromise employee productivity, are required to be filtered to meet compliance requirements, harbor malicious threats, or provide mechanisms by which to bypass web security controls and are therefore a critical aspect of any web security solution testing. Configuration and Procedure A sample set of thousands of live web targets was used. A generic diagram of the test bed, direct path, is below. Figure 8: Direct Path Testing Each security appliance had the latest software and database(s) as well as access to the latest cloud lookup services. Default security policies, including anti-malware engines, as well as settings required to filter URLs in a specific category were enabled. All available security related filter categories were also configured. The Miercom client, Apache JMeter, sent an HTTP GET request to the target web server via the web gateway, the router and the Internet. The client was configured to wait up to 20 seconds for the web gateway to render a decision, block or pass. The 20 seconds was intended to remove the possibility of a temporary Internet issue from interfering with a block or pass decision. The composition of the sample set is shown in Table 8. Table 8: Sample URLs in Each Risk Web Filtering Category Category of URLs Adult 6,919 Gambling 5,418 Hacking 196 Proxy Avoidance 49 Total 12,582 Copyright 2014 Miercom Page 18 DR131118

19 Expected Results The expectation was that each web security product would detect and filter or block adult, gambling, hacking and proxy avoidance URLs. Overall Results The Websense TRITON WSGA made the best overall performance, finishing first in all four categories and recording a blocking rate of 98.0% (12,334 of 12,582 samples) as shown in Table 9 and Figure 9. Table 9: Overall Blocking Rate Risk Web Filtering in Four Categories Vendor Product Sample Size Retrieved Percentage Websense TRITON WSGA 12, , % Check Point NGTP 12, , % Palo Alto Networks PA ,582 1,630 10, % Blue Coat SG ,582 1,722 10, % McAfee WG-5500-B 12,582 3,279 9, % Average 12,582 1, , % Figure 9: Overall Blocking Rate Risk Web Filtering in Four Categories Percentage (%) Websense TRITON WSGA Check Point NGTP Palo Alto Networks PA-2020 Source: Miercom Web Security Industry Assessment, January 2014 Blue Coat SG McAfee WG-5500-B Copyright 2014 Miercom Page 19 DR131118

20 8.0 Risk Web Filtering Testing, Results of Individual Categories 8.1 Adult Configuration Websense TRITON WSGA was configured to block adult content, lingerie and swimsuit, nudity, sex and sex education under the adult material menu. Blue Coat ProxySG , Proxy Edition was configured to block child pornography, nudity, pornography and sex education. Check Point NGTP was configured to block nudity, pornography, sex, sex education, and high risk and critical risk categories. McAfee WB-5500-B was configured to block incidental nudity, nudity, pornography and sexual materials. Palo Alto Networks PA-2020 was configured to block adult and nudity. Each product was configured with the latest versions of software/firmware and databases. All were also configured to utilize their AV engine(s) as well as cloud lookup services. In addition to the specific risk categories, all security categories were also enabled. The log information from the management interface was used to see all categories assigned per sample blocked. This log was compared to the Miercom scripts log for better accuracy. Results The Websense WSGA had the highest blocking rate, 97.8%, as shown in Table 10 and Figure 10. Table 10: Blocking Rate, Adult URLs Vendor Product Sample Size Retrieved Percentage Websense TRITON WSGA 6, , % Check Point NGTP 6, , % Blue Coat SG , , % Palo Alto Networks PA , , % McAfee WG-5500-B 6,919 1,041 5, % Average 6, , % Copyright 2014 Miercom Page 20 DR131118

21 Figure 10: Blocking Rate, Adult URLs Percentage (%) Websense TRITON WSGA Check Point NGTP Blue Coat SG Palo Alto Networks PA-2020 McAfee WG-5500-B Source: Miercom Web Security Industry Assessment, January 2014 Adult was the category with the smallest gap between the blocking rate of the leader and the last-place finisher. The leader, the Websense TRITON WSGA, had a blocking rate of 97.8%, 12.7% clear of the McAfee WG-5500-B. Copyright 2014 Miercom Page 21 DR131118

22 8.2 Gambling Configuration Websense TRITON WSGA with Web Security Gateway Anywhere was configured to block gambling under the Extended Protection Menu. Blue Coat ProxySG , Proxy Edition was configured to block gambling. Check Point NGTP was configured to block gambling, high risk and critical risk. McAfee WB-5500-B was configured to block gambling and gambling related. Palo Alto Networks PA-2020 was configured to block gambling. Each product was configured with the latest versions of software/firmware and databases. All were also configured to utilize their AV engine(s) as well as cloud lookup services. In addition to the specific risk categories, all security categories were also enabled. The log information from the management interface was used to see all categories assigned per sample blocked. This log was compared to the Miercom scripts log for better accuracy. Results The Websense WSGA had the highest blocking rate, 98.6%, as shown in Table 11 and Figure 11. Table 11: Blocking Rate, Gambling URLs Vendor Product Sample Size Retrieved Percentage Websense TRITON WSGA 5, , % Check Point NGTP 5, , % Palo Alto Networks PA , , % Blue Coat SG , , % McAfee WG-5500-B 5,418 2,091 3, % Average 5, , % Copyright 2014 Miercom Page 22 DR131118

23 Figure 11: Blocking Rate, Gambling URLs Percentage (%) Websense TRITON WSGA Check Point NGTP Palo Alto Networks PA-2020 Blue Coat SG McAfee WG-5500-B Source: Miercom Web Security Industry Assessment, January 2014 Gambling was one of two categories in which a competing web security product came closest in terms of percentage to the Websense TRITON WSGA in first place. As in Adult, just 0.1% separated the performance of the Websense solution and the runner-up, the Check Point NGTP, in determining whether to block or pass 5,418 gambling URLs. Copyright 2014 Miercom Page 23 DR131118

24 8.3 Hacking Configuration Websense TRITON WSGA was configured to block hacking. Blue Coat ProxySG , Proxy Edition was configured to block hacking. Check Point NGTP was configured to block hacking, high risk and critical risk. McAfee WB-5500-B was configured to block potential hacking/computer crime. Palo Alto Networks PA-2020 was configured to block hacking. Each product was configured with the latest versions of software/firmware and databases. All were also configured to utilize their AV engine(s) as well as cloud lookup service. In addition to the specific risk categories, all security categories were also enabled. The log information from the management interface was used to see all categories assigned per sample blocked. This log was compared to the Miercom scripts log for better accuracy. Results The Websense WSGA had the highest blocking rate, 96.9%, as shown in Table 12 and Figure 12. Table 12: Blocking Rate, Hacking URLs Vendor Product Sample Size Retrieved Percentage Websense TRITON WSGA % Check Point NGTP % Palo Alto Networks PA % Blue Coat SG % McAfee WG-5500-B % Average % Copyright 2014 Miercom Page 24 DR131118

25 Figure 12: Blocking Rate, Hacking URLs Percentage (%) Websense TRITON WSGA Check Point NGTP Palo Alto Networks PA-2020 Blue Coat SG McAfee WG-5500-B Source: Miercom Web Security Industry Assessment, January 2014 The results in the hacking category revealed a three-tiered pecking order. The Websense TRITON WSGA was a clear winner with a blocking rate of 96.9%, preventing retrieval of 190 of the 196 samples. The Check Point NGTP was alone as the runner-up at 73.5%. The other web security products were in a group below 50%. Copyright 2014 Miercom Page 25 DR131118

26 8.4 Proxy Avoidance Configuration Websense TRITON WSGA was configured to block proxy avoidance. Blue Coat ProxySG , Proxy Edition was configured to block proxy avoidance. Check Point NGTP was configured to block anonymizer, anonymizers/proxy avoidance sites, high risk and critical risk. McAfee WB-5500-B was configured to block anonymizers and anonymizing utilities. Palo Alto Networks PA-2020 was configured to block proxy avoidance. Each product was configured with the latest versions of software/firmware and databases. All were also configured to utilize their AV engine(s) as well as cloud lookup service. In addition to the specific risk categories, all security categories were enabled. The log information from the management interface was used to see all categories assigned per sample blocked. This log was compared to the Miercom scripts log for better accuracy. Results The Websense WSGA had the highest blocking rate, 69.4, shown in Table 13 and Figure 13. Table 13: Blocking Rate, Proxy Avoidance URLs Vendor Product Sample Size Retrieved Percentage Websense TRITON WSGA % Blue Coat SG % Check Point NGTP % McAfee WG-5500-B % Palo Alto Networks PA % Average % Copyright 2014 Miercom Page 26 DR131118

27 Figure 13: Blocking Rate, Proxy Avoidance URLs 100 Percentage (%) Websense TRITON WSGA Blue Coat SG Check Point NGTP McAfee WG-5500-B 12.2 Palo Alto Networks PA-2020 Source: Miercom Web Security Industry Assessment, January 2014 Proxy avoidance was the category in which the web control products had the lowest overall blocking rates. The Websense TRITON WSGA performed the best, blocking 34 of 49 proxy avoidance URLs for a blocking rate of 69.4%. Copyright 2014 Miercom Page 27 DR131118

28 9.0 Conclusion Of the five web security products tested, the Websense TRITON Web Security Gateway Anywhere (WSGA) finished first in web security effectiveness and risk web filtering tests. Of the 16,307 URLs in the eight categories, the Websense solution blocked 15,991 samples for an overall blocking rate of 98.1%. The blocking rate of the runner-up, Check Point, was 92.8%. All web security products tested utilized the latest software, database(s), anti-malware engines and cloud-based resources available at the time of testing. All products tested were subjected to the same URL sample set sourced independently by Miercom. Testing revealed that web security risks are best mitigated when performed by security appliances, which offer real-time security defenses and content classification. Devices tested such as the Websense TRITON WSGA surpassed point-based security technologies in both accuracy and coverage by correlating multiple analytic engines to identify threats that might otherwise bypass any single mechanism. The use of this layered security approach proved to provide the best protection as well as content classification accuracy. The Websense TRITON WSGA achieved the highest efficacy scores in tests for detecting and blocking of multiple types of malware threats and analyzing and classifying content. Overall, the Websense TRITON WSGA is a superior web security solution, providing advanced multi-layered threat protection from malicious attacks and employing sophisticated real-time content analysis engines and algorithms that do not rely on traditional static database lookups. Copyright 2014 Miercom Page 28 DR131118

29 Applicability of Test Results The tests in this report are intended to be reproducible for customers who wish to recreate them with the appropriate test and measurement equipment. Current or prospective customers interested in repeating these results may contact for further details on this testing. Miercom recommends that customers conduct their own needs analysis review with us or any other proven network consultancy and test specifically for the expected environment for deploying new equipment. This report was sponsored by Websense, Inc. Data was obtained completely and independently as part of the Miercom Web Security Industry Assessment in which all vendors have equal opportunity to participate and contribute to the test methodology. All vendors included in these tests were afforded the opportunity to represent their products, and continue to have the opportunity to participate in the ongoing Industry Assessment. About Miercom Miercom has had hundreds of product comparison analyses published in Network World, Business Communications Review, Communications News, xchange, Internet Telephony and other leading publications. Miercom s reputation as the leading, independent product test center is unquestioned. Miercom s private test services include competitive product analyses, as well as individual product evaluations. Miercom features comprehensive certification and test programs including: Certified Interoperable, Certified Reliable, Certified Secure and Certified Green. Products may also be evaluated under the Performance Verified program, the industry s most thorough and trusted assessment for product usability and performance. Copyright 2014 Miercom Page 29 DR131118