Академический Документы
Профессиональный Документы
Культура Документы
PRODUCT ANALYSIS
Sourcefire 3D8260
4.10
2012 NSS Labs, Inc. All rights reserved. No part of this publication may be reproduced,
photocopied, stored on a retrieval system, or transmitted without the express written consent of the
authors.
Please note that access to or use of this report is conditioned on the following:
1.
The information in this report is subject to change by NSS Labs without notice.
2.
The information in this report is believed by NSS Labs to be accurate and reliable at the time of
publication, but is not guaranteed. All use of and reliance on this report are at the readers sole
risk. NSS Labs is not liable or responsible for any damages, losses, or expenses arising from any
error or omission in this report.
3.
NO WARRANTIES, EXPRESS OR IMPLIED ARE GIVEN BY NSS LABS. ALL IMPLIED WARRANTIES,
INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
PURPOSE, AND NON-INFRINGEMENT ARE DISCLAIMED AND EXCLUDED BY NSS LABS. IN NO
EVENT SHALL NSS LABS BE LIABLE FOR ANY CONSEQUENTIAL, INCIDENTAL OR INDIRECT
DAMAGES, OR FOR ANY LOSS OF PROFIT, REVENUE, DATA, COMPUTER PROGRAMS, OR OTHER
ASSETS, EVEN IF ADVISED OF THE POSSIBILITY THEREOF.
4.
This report does not constitute an endorsement, recommendation, or guarantee of any of the
products (hardware or software) tested or the hardware and software used in testing the products.
The testing does not guarantee that there are no errors or defects in the products or that the
products will meet the readers expectations, requirements, needs, or specifications, or that they
will operate without interruption.
5.
This report does not imply any endorsement, sponsorship, affiliation, or verification by or with any
organizations mentioned in this report.
6.
All trademarks, service marks, and trade names used in this report are the trademarks, service
marks, and trade names of their respective owners.
CONTACT INFORMATION
NSS Labs, Inc.
6207 Bee Caves Road, Suite 350
Austin, TX 78746 USA
+1 (512) 961-5300
info@nsslabs.com
www.nsslabs.com
TABLE OF CONTENTS
1
3.1
3.2
Performance .......................................................................................................7
4.1
Connection Dynamics Concurrency and Connection Rates .............................................. 7
4.2
HTTP Connections per Second and Capacity .................................................................... 8
4.3
Application Average Response Time - HTTP (at 90% Max Load) ......................................... 9
4.4
HTTP Connections per Second and Capacity (With Delays) ................................................ 9
4.5
UDP Throughput ....................................................................................................... 10
4.6
Latency UDP .......................................................................................................... 10
4.7
Real-World Traffic Mixes............................................................................................. 11
6.1
6.2
6.3
6.4
7.1
7.2
7.3
TABLE OF FIGURES
Figure
Figure
Figure
Figure
Figure
Figure
Figure
Figure
Figure
1:
2:
3:
4:
5:
6:
7:
8:
9:
1 SUMMARY RESULTS
NSS Labs performed an independent test of the Sourcefire 3D8260 4.10 IPS. The product was
subjected to thorough testing at the NSS Labs facility in Austin, Texas, based on the Network
Intrusion Prevention methodology v6.2 available on www.nsslabs.com. This test was conducted free of
charge and NSS Labs did not receive any compensation in return for Sourcefires participation.
While the upcoming Network Intrusion Prevention Group Test Reports on Security, Performance,
Management, TCO, and Value will provide comparative information about all tested products, this indepth Product Analysis provides detailed information not available elsewhere.
NSS research indicates that the majority of enterprises tune their Intrusion Prevention Systems.
Therefore, NSS Labs evaluation of IPS products are configured with vendor pre-defined or default,
out-of-the-box settings, and then again as optimally tuned by the vendor prior to testing, in order to
provide readers with a range of information on key IPS security effectiveness and performance
dimensions based upon their expected usage.
As part of this test, Sourcefire submitted the 3D8260 4.10.
Product
Overall Protection
Evasion
Throughput
98.9%
100%
34,000 Mbps
Client Protection
Server Protection
Excellent
99%
98%
Using the tuned policy, the 3D8260 blocked 99.0% of attacks against client applications and 98.9%
overall. Sourcefire 3D8260 4.10 correctly identified 100% of our evasion attempts without error.
The product successfully passed 34.0 Gbps of inspected traffic, and in a typical network this could be
considered an accurate rating, given the headroom available. NSS Labs rates throughput based upon
an average of the results from tests: Real World Protocol Mix (Perimeter), Real World Protocol Mix
(Core), and 21 KB HTTP Response respectively.
Sourcefires management interface was well designed and intuitive. The Defense Center management
console was simple and fast, with well thought out modularity and capability for expansion. Its
policies and configuration pages loaded quickly and correctly on several different test systems using a
variety of OS/browser combinations. For users of Sourcefire IPS, there will not be much of a learning
curve. Tuning and maintenance is simple and well-thought out, keeping with the overall clean and
minimalist look and feel, while still providing powerful and easy-to-use functionality.
For multi-gigabit environments looking to upgrade defenses from their current version of Sourcefire
IPS, the Sourcefire 3D8260 4.10 provides excellent protection.
p. 1
Product
Total Number of
Exploits Run
Total Number
Blocked
Block Percentage
1,486
1,469
98.9%
120%
100%
760
740
80%
720
60%
700
40%
680
660
20%
640
620
Attempted
Coverage %
Exploits Attempted/Caught
780
Attacker Initiated
Target Initiated
700
786
Caught
687
782
Coverage
98%
99%
0%
p. 2
1400
90%
1200
80%
1000
70%
60%
Exploits
800
50%
600
40%
30%
400
20%
200
0
10%
System Exposure
Service Exposure
System-Service Fault
Run
1236
114
136
Blocked
1226
112
131
Percentage
99%
98%
96%
0%
p. 3
100%
90%
80%
70%
60%
50%
40%
30%
20%
10%
0%
100%
98%
99%
99%
98%
99%
99%
100%
2004
2005
2006
2007
2008
2009
2010
2011
100%
90%
80%
70%
60%
50%
40%
30%
20%
10%
0%
98%
99%
100%
99%
100%
Adobe
Apple
IBM
Microso
Oracle
p. 4
TEST PROCEDURE
RESULT
3.1.1
IP PACKET FRAGMENTATION
100%
3.1.2
100%
3.1.3
RPC FRAGMENTATION
100%
3.1.4
100%
3.1.5
URL OBFUSCATION
100%
3.1.6
HTML OBFUSCATION
100%
3.1.7
PAYLOAD ENCODING
100%
3.1.8
FTP EVASION
100%
3.1.9
100%
3.1.10
100%
3.1.11
100%
3.1.12
100%
Resistance to known evasion techniques was perfect, with the Sourcefire 3D8260 4.10 achieving a
100% score across the board in all related tests. IP fragmentation, TCP stream segmentation, RPC
fragmentation, URL obfuscation, HTML Evasion and FTP evasion all failed to trick the product into
ignoring valid attacks. Not only were the fragmented and obfuscated attacks blocked successfully, but
all of them were also decoded accurately.
p. 5
TEST PROCEDURE
RESULTS
PASS
PASS
PASS
PASS
p. 6
4 PERFORMANCE
There is frequently a trade-off between security effectiveness and performance. Because of this tradeoff, it is important to judge a products security effectiveness within the context of its performance
(and vice versa). This ensures that new security protections do not adversely impact performance and
security shortcuts are not taken to maintain or improve performance.
*The Sourcefire 3D8260 achieved the maximum rate of 60,000,000 Concurrent connections allowed
by NSS Labs test equipment.
Product
Sourcefire 3D8260 4.10
TCP
Connections
per Second
Concurrent TCP
Connections
Vendor
Claimed
Throughput
Rated
Throughput
633,000
60,000,000*
20,000 Mbps
34,000 Mbps
70,000,000
60,000,000
60,000,000
1,800,000
1,600,000
60,000,000
1,400,000
1,567,000
50,000,000
1,200,000
40,000,000
1,000,000
30,000,000
800,000
20,000,000
10,000,000
0
600,000
633,000
400,000
200,000
292,000
without data
TCP Connections/Sec
633,000
HTTP Connections/Sec
292,000
HTTP Transactions/Sec
1,567,000
60,000,000
with data
Connections / Second
Concurrent Connections
60,000,000
p. 7
35,000
34,000
250,000
34,000
200,000
30,000
25,000
150,000
18,200
20,000
100,000
11,700
15,000
10,000
4,900
5,000
0
44 KB
Response
21 KB
Response
10 KB
Response
4.5 KB
Response
1.7 KB
Response
CPS
85,000
170,000
182,000
234,000
196,000
Mbps
34,000
34,000
18,200
11,700
4,900
50,000
Connections / Sec
40,000
There is frequently a trade-off between security effectiveness and performance. Because of this tradeoff, it is important to judge a products security effectiveness within the context of its performance
(and vice versa). This ensures that new security protections do not adversely impact performance and
security shortcuts are not taken to maintain or improve performance.
Maximum throughput degrades significantly with smaller response sizes. Those users with a typical
traffic mix that includes a significant percentage of smaller responses may find a performance impact
with this device as a result.
p. 8
4.3 APPLICATION AVERAGE RESPONSE TIME - HTTP (AT 90% MAX LOAD)
TEST ID
MILLISECONDS
1.38
1.02
0.99
0.81
0.70
190,000
34,000
34,000
185,000
180,000
25,000
18,400
18,200
20,000
15,000
175,000
170,000
10,000
165,000
5,000
0
CPS
Mbps
21 KB Response
21 KB Response
w/Delay
10 KB Response
10 KB Response
w/Delay
170,000
170,000
182,000
184,000
34,000
34,000
18,200
18,400
160,000
p. 9
Connections / Sec
30,000
35,000
101
30,000
34,000
25,000
0
Mbps
Latency (s)
100
97
94
15,000
5,000
102
34,000
98
25,000
20,000
10,000
104
102
96
94
17,200
94
10,400
Latency (s)
40,000
92
128 Byte
Packets
256 Byte
Packets
512 Byte
Packets
1024 Byte
Packets
1514 Byte
Packets
10,400
17,200
25,000
34,000
34,000
94
94
97
101
102
90
TEST ID
MICROSECONDS
94
94
97
101
102
p. 10
38,000
30,000
30,000
Mbps
25,000
20,000
15,000
10,000
5,000
0
Mbps
38,000
30,000
p. 11
TEST PROCEDURE
RESULT
5.1
PASS
5.2
PASS
5.3
PASS
5.4
PASS
5.5
PASS
5.6
POWER FAIL
PASS
5.7
REDUNDANCY
5.8
PERSISTENCE OF DATA
YES
PASS
p. 12
Answer
Yes
Yes
Yes
Yes
Yes
p. 13
Yes
Yes
6.2 POLICY
Question
Device Configuration - Does management system provide the
means to configure one or more sensors from a central location,
assigning signatures, sensor settings, etc.
Policy Definition - Does management system provide the means to
define and save multiple security policies, consisting of: general
sensor
configuration,
system-wide
parameters,
signatures
enabled/disabled, actions to take when malicious traffic discovered.
Recommended Settings - Does vendor provide a default policy or
suite of recommended IPS settings which comprises the optimum
configuration for a typical network (including which signatures are
enabled/disabled, which are enabled in blocking mode, required
actions, etc.)
Custom Attack Signatures Is it possible for the administrator to
define custom IPS signatures for use in standard policies? If so, what
for do these take (Snort compatible, etc.)
Bulk Operations Is it possible to search quickly and easily for
individual signatures or groups/classes of signatures, and
subsequently to apply one or more operations to an entire group in a
single operation (for example, to enable or disable a group of
signatures, or to switch a group from block mode to log mode, etc.)
Granularity Is the DUT capable of blocking or creating exceptions
based on IP address, application, user/group ID, protocol, VLAN tag,
etc. (i.e. never block HTTP traffic between two specific IP addresses,
always block FTP traffic to one specific IP address, etc.).
Policy Association - Once policies have been defined, is it possible
to associate them with specific devices or groups of devices.
Inheritance Is it possible to create groups and sub-groups of
devices such that sub-groups can inherit certain aspects of
configuration and policy definition from parent groups.
Virtualization - Once policies have been defined, is it possible to
associate them with specific virtual devices or groups of devices,
comprising an entire DUT, individual ports, port groups, IP address
range, subnet or VLAN.
Answer
Yes Sensor grouping in Defense
Center (DC)
Yes DC provides ability for grouping of
policies and sensors individually
Yes
Yes - Snort
Yes Drill down into events and rightclick blocking of events in near real
time
Yes
Yes through grouping in the DC,
sensors can inherit configuration and
policy from parent lists
Yes - as above
p. 14
Yes
Yes
Answer
Yes
Yes
All
p. 15
Yes
Yes
Yes
Yes
6.4 REPORTING
Question
Centralized Reports Is the system capable of reporting on all
alerts from a single, central, management console. From that
console, is it possible to report all alerts globally, or to report on
alerts from individual devices (logical or physical).
Built In Reports - Does system provide built in reports covering
typical
requirements
such
as
list
of
top
attacks,
top
source/destination IP addresses, top targets, etc.
Custom Reports Does the system offer a report generator
providing the ability to construct complex data filters in a search
form and summarize alerts on the specified search criteria.
Saved Reports - Having defined a custom report filter, is it possible
to save it for subsequent recall.
Scheduled Reports Is it possible to schedule saved reports for
regular unattended runs. If so, how is the output saved (as HTML or
PDF, for example). Is it possible to publish reports to a central
FTP/Web server, and/or e-mail reports to specified recipients.
Answer
Yes
Yes
Yes, configurable
p. 16
Yes
p. 17
Product Maintenance the fees paid to the vendor (including software and hardware
support, maintenance, and signature updates.)
Installation the time required to take the device out of the box, configure it, put it into the
network, apply updates and patches, initial tuning, and set up desired logging and reporting.
Upkeep the time required to apply periodic updates and patches from vendors, including
hardware, software, and protection (signature/filter/rules) updates.
Tuning the time required to configure the policy such that the best possible protection is
applied while reducing or eliminating false alarms and false positives.
Installation (Hrs)
24
24
3D8260
Purchase
Maintenance / year
1 Year TCO
2 Year TCO
3 Year TCO
$371,985
$42,929
$419,114
$465,644
$512,173
Year One TCO was determined by multiplying the Labor Rate ($75 per hour fully loaded) x
(Installation + Upkeep + Tuning) and then adding the Purchase Price + Maintenance.
Year Two TCO was determined by multiplying the Labor Rate ($75 per hour fully loaded) x
(Upkeep + Tuning) and then adding Year One TCO.
Year Three TCO was determined by multiplying the Labor Rate ($75per hour fully loaded x
(Upkeep + Tuning) and then adding Year Two TCO.
p. 18
3D8260
Protection
Throughput
3 Year TCO
Price / Mbps-Protected
98.9%
34,000
$512,173
$15
Price per Protected Mbps was calculated by taking the Three-Year TCO and dividing it by the product
of Protection x Throughput. Three-Year TCO/(Protection x Throughput) = Price/Mbps-Protected.
p. 19
Description
Result
2
2.1
2.1.1
2.1.2
2.1.3
2.2
2.2.1
2.2.2
2.2.3
2.3
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.3.6
2.3.7
2.3.8
2.4
2.5
2.6
3
3.1
3.1.1
3.1.1.1
3.1.1.2
3.1.1.3
3.1.1.4
3.1.1.5
3.1.1.6
3.1.1.7
3.1.1.8
3.1.1.9
3.1.1.10
3.1.1.11
100%
3.1.1.12
100%
3.1.1.13
100%
3.1.1.14
100%
3.1.1.15
100%
3.1.2.1
100%
3.1.2.2
100%
3.1.2
98%
99%
98.9%
99%
98%
96%
100%
98%
99%
99%
98%
99%
99%
100%
Contact NSS
Contact NSS
Contact NSS
100%
100%
100%
100%
100%
100%
100%
100%
100%
100%
100%
100%
100%
p. 20
Test ID
Description
Result
100%
Ordered 1 byte segments, interleaved duplicate segments with out-ofwindow sequence numbers
Out of order 1 byte segments
100%
100%
100%
3.1.2.19
Reverse Ordered 256 byte segments, segment overlap (favor new) with
random data
100%
3.1.2.20
Reverse Ordered 512 byte segments, segment overlap (favor new) with
random data
100%
3.1.2.21
100%
3.1.2.22
100%
3.1.2.3
3.1.2.4
3.1.2.5
3.1.2.6
3.1.2.7
3.1.2.8
3.1.2.9
3.1.2.10
3.1.2.11
3.1.2.12
3.1.2.13
3.1.2.14
3.1.2.15
3.1.2.16
3.1.2.17
3.1.2.18
3.1.2.23
3.1.2.24
3.1.2.25
3.1.3
3.1.3.1
3.1.3.2
3.1.3.3
3.1.3.4
3.1.3.5
3.1.3.6
3.1.3.7
3.1.3.8
3.1.3.9
3.1.3.10
3.1.3.11
3.1.3.12
3.1.3.13
100%
100%
100%
100%
100%
100%
100%
100%
100%
100%
100%
100%
N/A
100%
100%
100%
100%
100%
100%
All frags except Last Fragment (LF) will be sent in one TCP segment. LF
will be sent in separate TCP seg (ONC)
One RPC fragment will be sent per TCP segment (ONC)
100%
One LF split over more than one TCP segment. In this case no RPC
fragmentation is performed (ONC)
Canvas Reference Implementation Level 1 (MS)
Canvas Reference Implementation Level 2 (MS)
Canvas Reference Implementation Level 3 (MS)
Canvas Reference Implementation Level 4 (MS)
Canvas Reference Implementation Level 5 (MS)
Canvas Reference Implementation Level 6 (MS)
Canvas Reference Implementation Level 7 (MS)
100%
100%
100%
100%
100%
100%
100%
100%
100%
p. 21
Test ID
3.1.3.14
3.1.3.15
3.1.3.16
Description
Canvas Reference Implementation Level 8 (MS)
Canvas Reference Implementation Level 9 (MS)
Canvas Reference Implementation Level 10 (MS)
Result
100%
100%
100%
3.1.3.17
MSRPC messages are sent in the big endian byte order, 16 MSRPC
fragments are sent in the same lower layer message, MSRPC requests
are fragmented to contain at most 2048 bytes of payload
100%
3.1.3.18
MSRPC messages are sent in the big endian byte order, 32 MSRPC
fragments are sent in the same lower layer message, MSRPC requests
are fragmented to contain at most 2048 bytes of payload
100%
3.1.3.19
MSRPC messages are sent in the big endian byte order, 64 MSRPC
fragments are sent in the same lower layer message, MSRPC requests
are fragmented to contain at most 2048 bytes of payload
100%
3.1.3.20
MSRPC messages are sent in the big endian byte order, 128 MSRPC
fragments are sent in the same lower layer message, MSRPC requests
are fragmented to contain at most 2048 bytes of payload
100%
3.1.3.21
MSRPC messages are sent in the big endian byte order, 256 MSRPC
fragments are sent in the same lower layer message, MSRPC requests
are fragmented to contain at most 2048 bytes of payload
100%
3.1.3.22
MSRPC messages are sent in the big endian byte order, 512 MSRPC
fragments are sent in the same lower layer message, MSRPC requests
are fragmented to contain at most 2048 bytes of payload
100%
3.1.3.23
3.1.4
MSRPC messages are sent in the big endian byte order, 1024 MSRPC
fragments are sent in the same lower layer message, MSRPC requests
are fragmented to contain at most 2048 bytes of payload
SMB & NetBIOS Evasions
100%
100%
3.1.4.1
100%
3.1.4.2
100%
3.1.4.3
3.1.5
3.1.5.1
3.1.5.2
3.1.5.3
3.1.5.4
3.1.5.5
3.1.5.6
3.1.5.7
3.1.5.8
3.1.5.9
3.1.5.10
3.1.5.11
3.1.5.12
3.1.5.13
3.1.5.14
3.1.5.15
3.1.5.16
3.1.6
3.1.6.1
3.1.6.2
3.1.6.3
100%
100%
100%
100%
100%
100%
100%
100%
100%
100%
100%
100%
100%
100%
100%
100%
100%
100%
100%
100%
100%
100%
p. 22
Test ID
3.1.6.4
3.1.6.5
3.1.6.6
3.1.6.7
3.1.6.8
3.1.6.9
3.1.6.10
3.1.6.11
3.1.6.12
3.1.6.13
3.1.6.14
3.1.6.15
3.1.7
3.1.7.1
3.1.7.2
3.1.7.3
3.1.7.4
3.1.8
3.1.8.1
3.1.8.2
3.1.8.3
3.1.8.4
3.1.8.5
3.1.8.6
3.1.8.7
3.1.8.8
3.1.8.9
3.1.9
Description
UTF-32 character set encoding (little-endian)
UTF-7 character set encoding
Chunked encoding (random chunk size)
Chunked encoding (fixed chunk size)
Chunked encoding (chaffing)
Compression (Deflate)
Compression (Gzip)
Base-64 Encoding
Base-64 Encoding (shifting 1 bit)
Base-64 Encoding (shifting 2 bits)
Base-64 Encoding (chaffing)
Combination UTF-7 + Gzip
Payload Encoding
x86/call4_dword_xor
x86/fnstenv_mov
x86/jmp_call_additive
x86/shikata_ga_nai
FTP Evasion
Inserting spaces in FTP command lines
Inserting non-text Telnet opcodes - Level 1 (minimal)
Inserting non-text Telnet opcodes - Level 2
Inserting non-text Telnet opcodes - Level 3
Inserting non-text Telnet opcodes - Level 4
Inserting non-text Telnet opcodes - Level 5
Inserting non-text Telnet opcodes - Level 6
Inserting non-text Telnet opcodes - Level 7
Inserting non-text Telnet opcodes - Level 8 (extreme)
IP Fragmentation + TCP Segmentation
Result
100%
100%
100%
100%
100%
100%
100%
100%
100%
100%
100%
100%
100%
100%
100%
100%
100%
100%
100%
100%
100%
100%
100%
100%
100%
100%
100%
100%
3.1.9.1
Ordered 8 byte fragments + Ordered TCP segments except that the last
segment comes first
100%
3.1.9.3
100%
3.1.9.4
100%
3.1.9.5
3.1.9.6
3.1.9.7
3.1.9.8
3.1.9.9
100%
100%
100%
100%
100%
p. 23
Test ID
3.1.9.10
3.1.9.12
3.1.9.13
3.1.9.14
3.1.9.15
3.1.9.16
3.1.10
Description
Result
100%
100%
100%
100%
100%
100%
100%
3.1.10.1
100%
3.1.10.2
100%
3.1.10.3
100%
3.1.10.4
100%
3.1.10.5
100%
3.1.10.6
100%
p. 24
Test ID
3.1.10.7
3.1.10.8
3.1.11
3.1.11.1
3.1.11.2
3.1.11.3
3.1.12
3.1.12.1
3.2
3.2.1
3.2.2
3.2.3
3.2.4
4
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.4
4.4.1
Description
Result
100%
100%
100%
100%
100%
100%
100%
100%
PASS
PASS
PASS
PASS
60,000,000
60,000,000
633,000
292,000
1,567,000
CPS
85,000
170,000
182,000
234,000
196,000
Milliseconds
1.38
1.02
0.99
0.81
0.70
CPS
170,000
p. 25
Test ID
4.4.2
4.5
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.6
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.7
4.7.1
4.7.2
5
5.1
5.2
5.3
5.4
5.5
5.6
5.7
5.8
6
6.1
6.1.1
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.1.10
6.1.11
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2.5
6.2.6
6.2.7
6.2.8
6.2.9
6.2.10
6.2.11
6.2.12
6.3
6.3.1
6.3.2
Description
10 Kbyte Response With Delay
Raw Packet Processing Performance (UDP Traffic)
128 Byte Packets
256 Byte Packets
512 Byte Packets
1024 Byte Packets
1514 Byte Packets
Latency - UDP
128 Byte Packets
256 Byte Packets
512 Byte Packets
1024 Byte Packets
1514 Byte Packets
Real World Traffic
Real World Protocol Mix (Perimeter)
Real World Protocol Mix (Core)
Stability & Reliability
Attack Detection/Blocking - Normal Load
Pass Legitimate Traffic - Normal Load
Blocking Under Extended Attack
Passing Legitimate Traffic Under Extended Attack
Protocol Fuzzing & Mutation
Power Fail
Redundancy
Persistence of Data
Management & Configuration
General
Transparent Mode
Routed Mode
Management Port
Management Protocol
Authentication
Enterprise Authentication
Direct Device Management
Centralized Device Management
Pass-Through Mode
IPS Signature Update
Secure Device Registration
Policy
Device Configuration
Policy Definition
Recommended Settings
Custom Attack Signatures
Bulk Operations
Granularity
Policy Association
Inheritance
Virtualization
Policy Deployment
Policy Auditing
Policy Version Control
Alert Handling
Generic Log Events
Log Location
Result
184,000
Mbps
10400
17200
25000
34000
34000
Latency (s)
94
94
97
101
102
Mbps
38,000
30,000
PASS
PASS
PASS
PASS
PASS
PASS
YES
PASS
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
p. 26
Test ID
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3.9
6.3.10
6.3.11
6.3.12
6.3.13
6.3.14
6.3.15
6.3.16
6.3.17
6.3.18
6.4
6.4.1
6.4.2
6.4.3
6.4.4
6.4.5
6.4.6
7
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2.5
7.2.6
7.2.7
7.2.8
7.3
7.3.1
Description
Communication Interruption
Log Flooding
Alerts
Alert Accuracy
Centralized Alerts
Alert Delivery Mechanism
Alert Actions
Forensic Analysis
Summarize Alerts
View Alert Detail
View Policy
View Packet Contents
Alert Suppression
Correlation (Automatic)
Correlation (Manual)
Incident Workflow
Reporting
Centralized Reports
Built In Reports
Custom Reports
Saved Reports
Scheduled Reports
Log File Maintenance
Total Cost of Ownership
Ease of Use
Initial Setup (Hours)
Time Required for Upkeep (Hours per Year)
Time Required to Tune (Hours per Year)
Expected Costs
Initial Purchase (hardware as tested)
Initial Purchase (enterprise management system)
Annual Cost of Maintenance & Support (hardware/software)
Annual Cost of Maintenance & Support (enterprise management
system)
Annual Cost of Updates (IPS/AV/etc.)
Installation Labor Cost (@$75/hr)
Management Labor Cost (per Year @$75/hr)
Tuning Labor Cost (per Year @$75/hr)
Total Cost of Ownership
Year 1
7.3.2
7.3.3
7.3.4
Year 2
Year 3
3 Year Total Cost of Ownership
7.2.4
Result
See Section 6.3
YES
YES
YES
YES
YES
See Section 6.3
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
8
24
24
$371,985
$14,995
$42,929
$0
$0
$600
$1,800
$1,800
$419,114
$46,529
$46,529
$512,173
p. 27
p. 28
p. 29