1. 14,698 High & Critical Vulnerabilities since 2005 Source: CVE Details http://www.cvedetails.com/cvss-score-graphics.php?fromform=1&vendor_id=&product_id=&startdate=2005-01-01&enddate=2010-07-01

2. Testability Gap

3. Testing “Defense in Depth” Windows Clients Data Center Apps Oracle, EMC, Veritas, HP, Microsoft Microsoft (Windows, IE, Office), Adobe, Mozilla, etc. Firewall & Network IPS Gap Analysis Protected & Exposed Vulnerabilities HIPS, AV, etc. NSS Labs - Live Test™ Framework Attacks

4. Network Intrusion Prevention (IPS) Varies widely IPS products have significant gaps in coverage Default configs not sufficient  Tune Product Block Rate: Default vs. Tuned Policies Source: Q4 2009 NIPS Test, n=1159

5. Host Intrusion Prevention (HIPS) varies widely Attackers will try multiple exploits and variants Quality of signatures matters Source: Q2 2010 EPP HIPS Test, n = 123

6. Evasion: Every AV product can be circumvented Hundreds of options, thousands of combinations Old attacks can be made new again VendorHTML ObfuscasionPayload EncodingFile CompressionExe Compressors A43%40%80%40% B100%40%80%100% C 40%80% D100%80% E100%60% 80% F43%20%80%40% G43%40%60%40% H57%60%80% I100%40%60% J100% 60%80%

7. What’s Needed… “Gloves off” Security Testing –If you’re not testing like the bad guys, what’s the point. Real-world malware & phishing tests Vulnerability-focused exploit testing & protection Stopping variants Properly handling evasion techniques Good default, recommended and tuned policies