My boss tasked me with testing Cisco AMP AV against Symantec. I suggested doing the EICAR test but he said all AV's will detect EICAR. Does anyone have any ideas on how to thoroughly test AV so I can deliver a good solution?

  • 1
    It is unclear what you really should test for, i.e. integration into firewall or abilities to detect malware in archives (in which case EICAR is probably enough) or the performance and capabilities of the AV itself. As for the latter case: I very much doubt that you will have the expertise and time of AV testing labs like AV-Test so it might be better just to rely on external tests for this instead of doing some tests which are too much detached from reality. – Steffen Ullrich Jun 9 '17 at 13:50
  • You want to test their detection capabilities? That's all? The normal way is to throw a lot of viruses at them and see what each product catches. And for that, it's a lot better to see if a research company has done this for you. – schroeder Jun 9 '17 at 13:50
  • @SteffenUllrich We want to test detection capabilities as well as performance. we want to see if cisco amp is capable of fully replacing our Symantec AV – okhan Jun 9 '17 at 13:54
  • 1
    @okhan: I have to agree with schroeder that such tests are done by throwing a bunch a malware to the AV, preferable in lots of different formats and using a variety of malware hiding techniques. Given the kind of question you ask I very much doubt that you have the experience to do such a test in a meaningful way and you will not be able to get the necessary experience just from an answer here. You should instead rely on tests which are done by experts in this field, which is also cheaper. – Steffen Ullrich Jun 9 '17 at 14:01
  • 2
    I'm confused: "My boss wants this to be a learning experience for me" suggests that you should just learn something by playing with different AV and we might help you to get this started. But "we want to see if cisco amp is capable of fully replacing our Symantec AV" suggests that you want to do a serious evaluation with business impact. But you don't have the knowledge and experience for this and you will not get it from an answer here. Please clarify in your question (and not only a comment) what your real plan is. – Steffen Ullrich Jun 9 '17 at 14:39

First, most of the AVs today are already updated with the newest known viruses signatures.

Second, comparing between AVs is not always so deterministic. In my opinion, you can gain experience with both AVs, only through enough time using and exploring them. If you have time, research both AVs, understand their approach for protection, and decide if it fits your organization.

AVs cannot detect all the malwares all the time, therefore I would recommend to have an AV that offers some "forensics" features such as:

  • Kaspersky's AVs for example, are aware for any executable run and you can easily view it.
  • ESET SysInspector feature allows you to take a snapshot of extremely significant details about your computer (processes, loaded DLLs, registry, network connections and more). Needless to say how important this feature can be.
| improve this answer | |

Get many many virus samples.

Call that batch 1
  uuencode batch 1
That is batch 2
  zip no password batch 1
That is batch 3
  hex/utf 8 encode batch 1

Now you have 4 batches of test just to get you started.

score them.
1. Correct Positive  = awesome
2. Correct Negative  = good
3. False positive    = bad
4. False negative    = terrible
5. Hangs the firewall
6. Firewall is exploited, and you get access to firewall = armageddon

5's the firewall will have to be manually restarted!! (yuck) Also then you have 0 protection while its hung. The more 4's you have the more terrible the product. Score of 3 annoying but a low percentage of these will have to be tolerated.

1's and 2's are obviously what you want.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.