My boss tasked me with testing Cisco AMP AV against Symantec. I suggested doing the EICAR test but he said all AV's will detect EICAR. Does anyone have any ideas on how to thoroughly test AV so I can deliver a good solution?
First, most of the AVs today are already updated with the newest known viruses signatures.
Second, comparing between AVs is not always so deterministic. In my opinion, you can gain experience with both AVs, only through enough time using and exploring them. If you have time, research both AVs, understand their approach for protection, and decide if it fits your organization.
AVs cannot detect all the malwares all the time, therefore I would recommend to have an AV that offers some "forensics" features such as:
- Kaspersky's AVs for example, are aware for any executable run and you can easily view it.
- ESET SysInspector feature allows you to take a snapshot of extremely significant details about your computer (processes, loaded DLLs, registry, network connections and more). Needless to say how important this feature can be.
Get many many virus samples.
Call that batch 1 uuencode batch 1 That is batch 2 zip no password batch 1 That is batch 3 hex/utf 8 encode batch 1
Now you have 4 batches of test just to get you started.
score them. 1. Correct Positive = awesome 2. Correct Negative = good 3. False positive = bad 4. False negative = terrible 5. Hangs the firewall 6. Firewall is exploited, and you get access to firewall = armageddon
5's the firewall will have to be manually restarted!! (yuck) Also then you have 0 protection while its hung. The more 4's you have the more terrible the product. Score of 3 annoying but a low percentage of these will have to be tolerated.
1's and 2's are obviously what you want.