Microsoft vows to improve security suite after failed evaluation

AV-Test.org failed the company again in another round of security software testing

Microsoft vowed on Wednesday to improve two of its security products after both failed to pass an evaluation by a Germany security software testing organization.

The company's Security Essentials and Forefront Endpoint Protection failed to earn a "certified" status in a latest round of testing by AV-Test to see how effective the products are against malicious software.

AV-Test, which conducts tests every two months at its laboratories in Magdeburg and Leipzig, also failed PC Tools' Internet Security 2012 and AhnLab's V3 Internet Security 8.0. In October, AV-Test failed to give Microsoft certified status for its Security Essentials versions 4.0 and 4.1.

Security software companies have often contested the conditions under which their products are examined by testing organizations following a poor rating, frequently arguing that testing parameters are flawed.

Joe Blackbird, a program manager in Microsoft's Malware Protection Center, softly contested AV-Test's methodology, which involves running the software security against a range of malware.

Blackbird wrote that Microsoft prioritizes how it provides protection based on the prevalence of threats. Many of the malware samples that AV-Test used were never encountered by millions of Microsoft systems, he wrote on a company blog.

In one example, Microsoft detected only 72 pieces of malware out of a sample of 100 pieces of zero-day malware, or attack code for which a detection signature has not been created yet.

But "we know from telemetry from hundreds of millions of systems around the world that 99.997 percent of our customers hit with any zero-day did not encounter the malware samples tested in this test," Blackbird wrote.

Microsoft did not detect about 9 percent of 216,000 pieces of "recent" malware in the AV-Test evaluation. But Blackbird wrote that 94 percent of missed samples were never encountered by the company's customers.

"When we explicitly looked for these files, we could not find them on our customers' machines," according to Blackbird.

Microsoft calculated that .0033 percent of its customers were impacted by malware that the company did not detect. But Blackbird noted that Microsoft had since added detection for some of those threats. Nonetheless, "we're committed to reducing our 0.0033 percent margin to zero," Blackbird wrote.

In December, Blackbird wrote that Microsoft processed 20 million new potentially malicious files. The company prioritizes how it blocks those threats, and added protection for four million of those.

"Those 4 million files could have been customer-impacting if we had not prioritized them appropriately," Blackbird wrote.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Join the CSO newsletter!

Error: Please check your email address.

Tags intrusionMicrosoftsecurityAV-TestExploits / vulnerabilities

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Jeremy Kirk

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts

Market Place