Story image

Conspiracy looms: NSS Labs takes CrowdStrike, ESET, Symantec & AMTSO to court

27 Sep 18

Cybersecurity testing organisation NSS Labs is accusing three major security firms and an industry body of boycotting independent security tests of their products.

NSS Labs filed an antitrust suit against CrowdStrike, ESET, Symantec, and the Anti-Malware Testing Standards Organization (AMTSO) earlier this month. It claims that the defendants boycott NSS Labs’ apparently unbiased and independent product testing to prevent criticism and imperfections in security products.

NSS Labs also accuses CrowdStrike and its CTO Dimitri Alperovitch of arranging a meeting at the RSA conference earlier this year. 

The meeting was “with the express intent, purpose and effect of obtaining agreement among the competitors to refuse to do business with companies, including specifically NSS Labs, who attempt to perform public tests of their products using testing methodologies other than those agreed to by the EPP Vendor Conspirators and embodied in the AMTSO Testing Standard”.

NSS Labs CEO Vikram Phatak wrote in a recent blog that his company’s mission is to help the cybersecurity industry become more transparent and accountable – but some security vendors don’t live up to those standards, and they know it.

“If you are in the cybersecurity industry, it won’t surprise you to hear that vendors often know about their products’ deficiencies yet don’t reveal them to consumers. What should shock you is that they are actively conspiring to prevent independent testing that uncovers those product deficiencies to prevent consumers from finding out about them,” he writes.

This has a flow-on effect for customers, who have almost everything to lose, including financial loss and in some cases, physical safety. 

He says that some vendors address flaws; others try to avoid testing. If one vendors avoids testing they are singled out, but apparently there’s safety in numbers.

“If a group of vendors agree ahead of time to boycott an independent test lab – say a lab they cannot get to do their bidding – then each is insulated from criticism by being one among many."

NSS Labs claim that the AMTSO and participating organisations including CrowdStrike, ESET, and Symantec, have conspired to claim fair and useful testing that sets their agendas – not fair and unbiased testing.

Phatak adds that CrowdStrike has included clauses in its end user licensing agreements saying that product testing is subject to their permission – something he believes is unethical and deceptive.

“NSS Labs is informed and believes and thereon alleges that CrowdStrike is attempting to conceal its EPP Security Defects in part because of the negative publicity that resulted from the Russian hacking of the Democratic National Committee (DNC),” legal documents state.

CrowdStrike has responded to NSS Labs statements, saying NSS Labs is a 'pay-to-play' testing business that uses fraud to obtain products.

"NSS is a for-profit, pay-to-play testing organisation that obtains products through fraudulent means and is desperate to defend its business model from open and transparent testing. We believe their lawsuit is baseless."

"CrowdStrike supports independent and standards-based testing—including public testing—for our products and for the industry. We have undergone independent testing with AV-Comparatives, SE Labs, and MITRE. We applaud AMTSO’s efforts to promote clear, consistent, and transparent testing standards."

However Phatak claims vendors are "openly exerting control and collectively boycotting testing organisations that don’t comply with their AMTSO standards – even going so far as to block the independent purchase and testing of their products".

“AMTSO and its Board of Directors largely comprise, and are controlled by, EPP product vendors,” legal documents state.

He says that NSS Labs knows consumers trust security vendors to protect them, but there is often no way to know if a company is really trustworthy. If it’s good enough to sell, it’s good enough to test, he adds.

NSS Labs is also seeking damages according to proof, an injunction against the defendants for wrongful acts, attorney fees and lawsuit fees.

“Many of you reading this have relied on NSS Labs tests and insights to guide your decisions. We strive to earn your trust every day and do not take your trust for granted. It is our hope that our actions today mark an important step forward in advancing transparency and accountability in the cybersecurity industry,” Phatak concludes.

Lenovo DCG moves Knight into A/NZ general manager role
Knight will now relocate to Sydney where he will be tasked with managing and growing the company’s data centre business across A/NZ.
Proofpoint launches feature to identify most targeted users
“One of the largest security industry misconceptions is that most cyberattacks target top executives and management.”
McAfee named Leader in Magic Quadrant an eighth time
The company has been once again named as a Leader in the Gartner Magic Quadrant for Security Information and Event Management.
Symantec and Fortinet partner for integration
The partnership will deliver essential security controls across endpoint, network, and cloud environments.
Review: Blue Mic’s Satellite headphones are good but...
Blue Mic’s newest wireless headphones deliver on sound, aesthetic, and comfort - but there is a more insidious issue at hand.
Is Supermicro innocent? 3rd party test finds no malicious hardware
One of the larger scandals within IT circles took place this year with Bloomberg firing shots at Supermicro - now Supermicro is firing back.
IDC: Smartphone shipments ready to stabilise in 2019
IDC expects year-over-year shipment growth of 2.6% in 2019, while the world's largest market is still forecast to be down 8.8% in 2018.
Microsoft NZ bids Goldie a “fond farewell”
Microsoft New Zealand director of commercial and partner business takes new role across the Tasman. The search for his replacement has begun.