Report: Web gateways fail to stop malicious outbound communications
The report, released in mid-February by Seculert, showed that 40 percent of attempted malicious communications were able to make it out past the gateways, though some gateways allowed only 5 percent to get through while others failed to stop more than 90 percent.
"This isn't just the gateway failing in a short-term fashion," said Richard Greene, CEO at Seculert. "This is a consistent hole in the back end of people's organizations. We're dealing with some awful results."
The research was conducted based on the communication logs of Seculert's Fortune 1000 enterprise customers base and showed that every single company had been compromised, with nearly 2 percent of all devices showing evidence of infection.
Richard Greene, CEO at Seculert
The client companies typically used gateways from Barracuda, BlueCoat, Fortigate, Ironport, McAfee Web Gateway, Palo Alto Networks, Websense and Zscaler but Seculert declined to provide information about which gateways did better than others.
"We don't want to make everyone mad," said Greene. "We're not accusing one company of being better than another one."
According to Greene, there are a lot of factors that go into how much malicious communication can get out past a gateway, including configuration errors and new malware varieties designed to evade gateways.
"They change the bad locations so fast and so often that it's impossible for the gateway to keep up with," he said.
The malware will also break files up into chunks and encrypt them in order to avoid being spotted.
The gateways showed uneven performance over time, added Greene. Some performed well for weeks or months, for example, then were defeated by the attackers.
In the summer, for example, there was a spike in malicious communications due to the Dyre and Trojan.Agent.145 malware.
In addition to the gateways, companies typically also had next generation firewalls, intrusion prevention systems, security information and event management systems, and endpoint protection.
The companies where 92 percent of malicious communications got through typically lost a great deal of data to exfiltration.
"Stuff goes on for months before it gets caught," said Greene. "One customer lost 271 gigabytes of information over the course of 10 months."
He said that Seculert looked for signs of data theft in the log data, looking at payloads, their sizes and content, where they came from and where they were going, and the specific communication styles used by malware.
This year's report did show improvement over the previous year's, where half of the leading gateway vendors studied allowed more 80 percent of infected devices to communicate out. This year, only two out of eight did.