IT Jobs
TippingPoint launches new IPS despite iffy test
Responds to security criticism.
By John E. Dunn | Techworld
Published: 16:34 GMT, 16 September 09
Intrusion prevention specialist TippingPoint Technologies has announced two new IPS models for smaller and remote offices only days after a testing company found fault with the entry-level model in the same family.
The TippingPoint 110 and 330 differ from the criticised model, the TippingPoint 10, in their inline throughput capability and number of ports, but use the same Digital Vaccine security updating technology that NSS Labs criticised in its tests.
The 110 and 330 are rated to 100Mbit/s and 300Mbit/s respectively, a packet-moving capability that if the NSS Labs report is anything to go by, is likely to be more than met by the new boxes under real-world loads. The models are also the latest to feature the 3Com-owned company's Zero Power High Availability bypass system which stops the box bringing the network down if the unit fails.
The contentious element of the TippingPoint 10's performance was its ability to spot a chosen group of 622 exploits, with the NSS Labs showing a detection rate of around 40 percent in default mode.
TippingPoint has since defended its products in a blog that took issue with the way products such as these are tested. One test methodology was ‘iterative', that is the vendor was allowed to adjust or tweak the performance of a product under test until it ‘passed' a pre-defined standard, while the other (including the NSS Labs' test of the TippingPoint 10) simply presented a result after the fact without the possibility of such adjustment.
"The danger here is that customers can sometimes view these two testing approaches as the same, mistakenly considering the results apples to apples," says the blog.
The company spokesman, Rohit Dhamankar goes on to suggest that the TippingPoint's detection conservatism in default settings as being necessary to avoid false positives, which could cause commercial damage to any company deploying such a configuration in an online commerce business.
TippingPoint also goes on to state that the company's controversial Zero Day Initiative (ZDI) program, under which independent researchers are paid to report vulnerabilities, has expanded from 600 registered researchers in 2008 to "well over 1,000" in 2009. Given that this reporting is exclusively through TippingPoint, this should in theory improve not hinder the company's security performance compared to rivals.
NSS Labs said it it was in the process of planning a follow-up test of the TippingPoint 10.
Pricing and availability for the 110 and 330 models has not been confirmed.
.gif)
Add your commentComments
Eirik Iverson | Published: 21:42 GMT, 17 September 2009
If the vendor must tune and re-tune their powerful guessing machine to stop malware created in the last month, it stands to reason that customers would have to do so also. With cyber criminals changing their malware code every 48 hours to avoid detection, the most sensible enterprise protection must be endpoint-centric. Even then, focus on end-user and administrator usability. http://blueridgenetworks.com/securitynowblog/
Paul Snowden | Published: 09:18 GMT, 17 September 2009
Also, I see that Tippingfail was happy to wave their NSS awards in all their publicity for years, but now NSS has raised the bar to the point that only the decent IPS can pass, Tippingpoint starts whining that the tests are unfair? How fair can you get? All vendors are tested using same methods and everything is documented on the NSS site. Tippingpoint just hasn't kept up since 3Com bought them-simple fact (and now all the original Tippingpoint guys have gone elsewhere too!)
Paul Snowden | Published: 09:14 GMT, 17 September 2009
That Tippingfail blog is ridiculous. So they want to run the test over and over again til they get it right and pass? Looking through NSS tests I can see that they changed things to stop that YEARS ago-probably that was last time Tippingfail passed a test? However, I see that other vendors can pass OK - IBM and McAfee for example. Tippingpoint needs to get real and catch up and stop blaming test labs for their failure to keep up with the competition