Story image

Conspiracy looms: NSS Labs takes CrowdStrike, ESET, Symantec & AMTSO to court

27 Sep 2018

Cybersecurity testing organisation NSS Labs is accusing three major security firms and an industry body of boycotting independent security tests of their products.

NSS Labs filed an antitrust suit against CrowdStrike, ESET, Symantec, and the Anti-Malware Testing Standards Organization (AMTSO) earlier this month. It claims that the defendants boycott NSS Labs’ apparently unbiased and independent product testing to prevent criticism and imperfections in security products.

NSS Labs also accuses CrowdStrike and its CTO Dimitri Alperovitch of arranging a meeting at the RSA conference earlier this year. 

The meeting was “with the express intent, purpose and effect of obtaining agreement among the competitors to refuse to do business with companies, including specifically NSS Labs, who attempt to perform public tests of their products using testing methodologies other than those agreed to by the EPP Vendor Conspirators and embodied in the AMTSO Testing Standard”.

NSS Labs CEO Vikram Phatak wrote in a recent blog that his company’s mission is to help the cybersecurity industry become more transparent and accountable – but some security vendors don’t live up to those standards, and they know it.

“If you are in the cybersecurity industry, it won’t surprise you to hear that vendors often know about their products’ deficiencies yet don’t reveal them to consumers. What should shock you is that they are actively conspiring to prevent independent testing that uncovers those product deficiencies to prevent consumers from finding out about them,” he writes.

This has a flow-on effect for customers, who have almost everything to lose, including financial loss and in some cases, physical safety. 

He says that some vendors address flaws; others try to avoid testing. If one vendors avoids testing they are singled out, but apparently there’s safety in numbers.

“If a group of vendors agree ahead of time to boycott an independent test lab – say a lab they cannot get to do their bidding – then each is insulated from criticism by being one among many."

NSS Labs claim that the AMTSO and participating organisations including CrowdStrike, ESET, and Symantec, have conspired to claim fair and useful testing that sets their agendas – not fair and unbiased testing.

Phatak adds that CrowdStrike has included clauses in its end user licensing agreements saying that product testing is subject to their permission – something he believes is unethical and deceptive.

“NSS Labs is informed and believes and thereon alleges that CrowdStrike is attempting to conceal its EPP Security Defects in part because of the negative publicity that resulted from the Russian hacking of the Democratic National Committee (DNC),” legal documents state.

CrowdStrike has responded to NSS Labs statements, saying NSS Labs is a 'pay-to-play' testing business that uses fraud to obtain products.

"NSS is a for-profit, pay-to-play testing organisation that obtains products through fraudulent means and is desperate to defend its business model from open and transparent testing. We believe their lawsuit is baseless."

"CrowdStrike supports independent and standards-based testing—including public testing—for our products and for the industry. We have undergone independent testing with AV-Comparatives, SE Labs, and MITRE. We applaud AMTSO’s efforts to promote clear, consistent, and transparent testing standards."

However Phatak claims vendors are "openly exerting control and collectively boycotting testing organisations that don’t comply with their AMTSO standards – even going so far as to block the independent purchase and testing of their products".

“AMTSO and its Board of Directors largely comprise, and are controlled by, EPP product vendors,” legal documents state.

He says that NSS Labs knows consumers trust security vendors to protect them, but there is often no way to know if a company is really trustworthy. If it’s good enough to sell, it’s good enough to test, he adds.

NSS Labs is also seeking damages according to proof, an injunction against the defendants for wrongful acts, attorney fees and lawsuit fees.

“Many of you reading this have relied on NSS Labs tests and insights to guide your decisions. We strive to earn your trust every day and do not take your trust for granted. It is our hope that our actions today mark an important step forward in advancing transparency and accountability in the cybersecurity industry,” Phatak concludes.

Server Technology beats out competition at DCS Awards
Server Technology has taken out the top spot for the Data Centre PDU Innovation of the Year at the DCS Awards.
LogRhythm releases cloud-based SIEM solution
LogRhythm Cloud provides the same feature set and user experience as its on-prem experience.
IGEL & ControlUp bring analytics to endpoints everywhere
The strategic partnership allows IGEL to integrate with ControlUp’s real-time monitoring and analytics capabilities via the IGEL Universal Management Suite (UMS).
Nutanix evolves multicloud offerings
Nutanix has expanded its multicloud solutions portfolio to further evolve its offerings across public and private cloud.
Bluzelle launches data delivery network to futureproof the edge
“Currently applications are limited to data caching technologies that require complex configuration and management of 10+ year old technology constrained to a few data centers."
Exploring the different needs for cloud services across Europe
Although digital transformation is happening across Europe, each country continues to have its own IT needs and the different cloud markets highlight this.
Trend Micro introduces cloud and container workload security offering
Container security capabilities added to Trend Micro Deep Security have elevated protection across the DevOps lifecycle and runtime stack.
Veeam joins the ranks of $1bil-revenue software companies
It’s also marked a milestone of 350,000 customers and outlined how it will begin the next stage of its growth.