How effective is your IDS or IPS really?
If you believe the hype your IDS or IPS solution is protecting you against 100% of threats. But should you believe this hype? We don't think so, and we'll prove it to you. The NSS research report* below shows that the average block-rate of IPS solutions tested was only 57% which is a long way from what vendors promise. Added to this, many IPS solutions end up being deployed in "passive-only" mode - which makes them effectively IDS solutions. So how good is your system really?.
* Endace did not participate in the Q4 2009 test, but looks forward to participating in an NSS Labs test in August 2010.
Our free testing offer
If you are concerned that your IPS or IDS is missing threats then we can help. Talk to us about our performance testing service. For a limited time we are offering complementary testing to organisations with complex, high-speed networks. The only way to find out how protected you really are is to test your security with real-world data.
Results from NSS Labs IPS testing
In Q4 2009, NSS Labs evaluated 15 different IPS solutions from 7 different vendors, testing their block-rate and throughput. The graph shows the results of the testing after the vendors had tuned their rules. Each system was tested against the same set of attacks. The test results make interesting reading, and from our perspective show:
- There is a mismatch between marketing claims and actual performance.
- Plugging in an IPS and assuming you’re protected is simply no longer an acceptable or defensible strategy.
- The best performer in the test used an open-source engine.
If you are currently running an IPS or planning to purchase one, talk to us about our performance testing service. We can help you ascertain the performance of your current or proposed installation. For a limited time we are giving away a number of tests to qualifying organisations.
NSS Labs extends a special offer to friends of Endace
This NSS labs report is available to purchase at a special 20% discount rate for visitors to the Endace website. Please Contact us for a discount code
Capture/Replay performance testing
Using Traffic Replay, we can capture your real network traffic and play it back to you, through your existing appliances, at any speed you like. And not just a few minutes of traffic - days of real network traffic.
We can quickly identify where existing IDS or IPS solutions are failing, and show you how they perform under various network loads and against a variety of threats.
Who is Endace?
We are world leaders in high speed, network traffic capture and analysis. We provide high speed network traffic capture and analysis technology to global Telecommunications Providers, Government Agencies and Fortune 5000 enterprises. Our customers trust us to secure, monitor and protect some of the largest, fastest and most complex networks in the world. Learn more about us.
Our high-speed, network traffic capture hardware provides 100% Packet Capture on any network at any speed up to 40Gpbs and beyond. Our multi-function Endace 3000 and Endace 7000 high-speed, high-density Probes provide a network traffic capture fabric that powers multiple network applications including Network Security, Network Analytics and Latency Measurement.