1. 2008 The Tolly Group Document # 208326 The Web Security Challenge: A Competitive Guide to Selecting Secure Web Gateways A white papercommissioned byWebsense, Inc.White PaperDecember 2008

2. WHITE PAPER: The Web Security Challenge: A Competitive Guide to Selecting Web Security GatewaysTable of Contents _======~=====~K q==~====~=~KExecutive Summary4Web 2.0 Effectiveness7 Manageability and Scalability9 Policy Interface 11 Reporting Capabilities 13 URL Filtering15 Malware Filtering16 Application Control18 Data Loss Protection 20 Network Implementation 22 Integration with Other Solutions 24 Service and support26Test Methodology 28Alexa 100,000 URL Filtering/Classication Test 28=OMMU=q=q=dI=fK= ============O 3. WHITE PAPER: The Web Security Challenge: A Competitive Guide to Selecting Web Security GatewaysTable of Contents _======~=====~K q==~====~=~KLong Tail or Extended URL Classication Test 28 Phishing and/or Proxy Avoidance URL Detection Accuracy Test29 Binary Exploits and Compromises Detection Accuracy Test29 Malware-infected URL Detection Accuracy Test 30 Web 2.0-Based Malicious URL Detection Accuracy Test30 Criteria Evaluation by UI Inspection 31 Interaction with Competing Vendors 32 Appendix: Product List 33 =OMMU=q=q=dI=fK= ============P 4. T T H H E E WHITE PAPER: The Web Security Challenge: a Competitive Guide to Selecting TOLLY Secure Web Gateways GROU PExecutive Summary The World Wide Web has changed dramatically in the past decade. The use of the Web as an application platform, a communication medium, and a business tool, combined with the migration of attackers onto the Web, demands new solutions to help manage business and mitigate security threats. Enterprise IT managers should carefully evaluate both the ease of management, as well as the effective- ness, of gateway-based Web security solutions against a constantly evolving threat landscape.tI=fK==q=q=d==~~==t=pJ =d~~=~~==~~~=~~==K=q=J ===W=_=`~=p=mpd=ONM=~= m^s=RNM=~~I=`=p=fK=fm=pSRM=t=p= ^~I=q=jI=fK=fp~=t=p=p=EftppFI=~= p=`=`~=p=t=Et~F=~~K=Note: All products under test shall be referenced by their manufacturer s name hereafter in the document.Websense Web Security Gateway combines powerful and easy-to-manage software with the ability to mitigate dynamic Web-based threats, exceeding other vendors tested in meeting Gartners criteria* for buying Secure Web Gateways. Ga~Wq=d~== ^=_=d==p=t=d~~==m=c=~= i~=l~=Ed~=o^p=`=o~=k=dMMNRVSSVX=NR=^=OMMUF=~= ==~=~=====~~K=eI=~=~=~==~= =~=~=~~=====q=d=~===~=== ====d~K^=~====~~==d~==tI=fK=~J ==~~I=~=====~=~==~=~== ==d~I=fKI=~=~=====d~K=b~=d~=~= ~=~===~=~=~=E~==~===~===FK=q=J ===d~=~=~==~==~I=~=~=== ~==Kf===d~===~==~=~~=~===d~=`J =~=n=mI=d~==~==~===~~=~=~J ~K=`===~=~~~=====~=d~=sJ =o~=~=K~]~KK=OMMU=q=q=dI=fK= = ===========Q 5. T T H H E EWHITE PAPER: The Web Security Challenge: a Competitive Guide to Selecting TOLLYSecure Web Gateways GROU Pq=d==~~=====~= tI= =~===~=d~==~==J~~=~J fK =~====~~=~~=~===~==t=~~K=q====l= p=t=OMMUK d~~c=~=J=I==d~=ptd=== `= ~=~===roi=I==I=~=~JL b~~==t=p=~J~=I=~=~=~~===t=~J c~ ~=~===K=q=q=d=~J=~~=====~===~======~==~~I==t=t=pJ =d~~====~==~J=~~= ~=~==~=~~=~==~K=q=d==~=~====~==== =~=~~=~=~=~====~=K= t=~===OMNI=t=p=d~~=~==== ~====~=K=Ep=c=NI=~=RKFjI==~==~~=roi==~=~~=~~=J =~==~~~==~==t=~~I=t==== =~==q=q=d====~==~= aim=I=~==~===~===~~=== ~=~==~==K=q=p=t=d~~=J =~==~=~~=~I=~~=~~I=~= ===~=~==Kq~=~=~=I=====~===~~=J =~==~=t=t=p=d~~==== ~J====I=~=W===~=~==~=~~== ~=~===t=OKM===fJ~=~=~=~=====~===~=====~==~=~====OMMU=q=q=dI=fK= ============R 6. T T H H E EWHITE PAPER: The Web Security Challenge: a Competitive Guide to Selecting TOLLYSecure Web Gateways GROU PComposite Scores of Products Tested Across Evaluation Areas All criteria listed were rated subjectively either by examining publicly available documentation from the vendors; or by launching the management interface, conguring the desired behavior and observing the results. The subjective usability, layout and overall effectiveness of each function by vendor has been assigned a value ranging from 1 (least effective) to 4 (most effective) to indicate the Tolly engineers' im- pression of each of the units tested. Detailed breakdown of scores in each area of evaluation can be seen in Figures 4. through 12.Source: The Tolly Group, November 2008Figure 1 =OMMU=q=q=dI=fK= = ===========S 7. T T H H E EWHITE PAPER: The Web Security Challenge: a Competitive Guide to Selecting TOLLYSecure Web Gateways GROU P q==~=====~===~~=~== =~=~=~=~=K=f=I=t=t=p=d~~===== ====~==~==~==~~I=~= I===~~=====~~=~= ~=~=~~==~~=~=~=~~==tJ ~=~~K Web 2.0 Effectiveness t=OKM==~=~=========t== ==fK=q=~=====~=~=~= ==t=OKM===~=~~==~~= ~=~=~=~===~=t=OKM== =_=EWLLKFI=tm=EWLLKFI== =~==~=~==K=q=~==~=t=J =~~===~==~~==~=t== =t=OKM==~==~J=~~==I=~==== =~===t=Kq==VSR==roi==~=t=OKM===K= ~=K=~===~==~== ~=t==~J==~~=~~K=tJ ==~=VVB===~=roi==== ===~=OB==~=QMBK=Ep=c=OKF=q==~======t=o~== ~=~~=roi=~~~==~=~===roi== ~======I===~=== =====JI=~J==~~I=J I=Kq=~==~=t=~===roi=~=== =t=====I=~====== =^~=NMMIMMM=roi=~~=K=q===~==tJ =~=VTKNB====NMMIMMM===t==== f=E~====^~=NMMIMMM=roi=FI==== ~==VOB==VQBK=Ep=c=PKF= =OMMU=q=q=dI=fK= ============T 8. T T H H E EWHITE PAPER: The Web Security Challenge: a Competitive Guide to Selecting TOLLYSecure Web Gateways GROU P Web 2.0 Detection Accuracy Effectiveness 98.9 Percent of detection accuracy (%)NMMTRRM 40.2OR 11.1 11 1.8 MWebsenseBlueCoat Cisco Secure TrendComputing Micro Note: All URLs tested were sourced from the Websense ThreatSeeker network, withinsix to 24 hours of the testing window.Source: The Tolly Group, November 2008Figure 2 q=~==t==~==~===t=E==~==i=q~===fF=~===I=~==~=t=I======t==~==~K=m====t=~J~=~~==~~=roi=~~~=~=~~=====~==~=t====i=q~===fK=t=~====~J=~~==t===~=VVKVB===NUIRUM==roi====i=q~K=f=~I==J==~==PSB=~=TMBK f=====~==roi=~==m=~L=m=~~=t=I=t==~~==VUKPB===OIPMO==roiI=======TMB=~=UUBK=p~I====PTV=roi=~=~===J=I=t==VVB==roiI=======RPB==VNBK=^I====USR=roi==j~J =OMMU=q=q=dI=fK= ============U 9. T T H H E EWHITE PAPER: The Web Security Challenge: a Competitive Guide to Selecting TOLLYSecure Web Gateways GROU P ~I=t==VUKQB======SRB= ~=~=VSBK=Ep=c=PKFWeb 2.0 Accuracy and Coverage Test ResultsSource: The Tolly Group, November 2008 Figure 3Manageability and Scalability o=~~=~========= ~~K=q==~==~==~==~J =~~==~=EdrfF=~==~~= ~===~===Kq=d=~J===~=t==~=~= == Q======~~=~=~=== K=l====~== Q===~~=J ~K=l=~~==~=t=~J==~~== ~~=~==~=~==~=~=~=J =OMMU=q=q=dI=fK= ============V 10. T T H H E EWHITE PAPER: The Web Security Challenge: a Competitive Guide to Selecting TOLLYSecure Web Gateways GROU P =K=t=~=~=~=~= Q===~= ~~=K=t=~=~= Q==~~=J~=Management and Scalability Scoring Source: The Tolly Group, November 2008Figure 4=OMMU=q=q=dI=fK= ============NM 11. T T H H E EWHITE PAPER: The Web Security Challenge: a Competitive Guide to Selecting TOLLYSecure Web Gateways GROU P ~~I=~~=~I=~~=I=~=~~J ===~~=~=~=~=~~L~=K=f= ~I==~=QM=I==PN===~=K=Ep=c= QKF= Policy Interface ^==~===~==I===J~=J =~=JK=eI=I=t== Q===== =~==~=~====~~==== ==~====~Kt====~===~===~==~= ===~I=~==I==~===J ==~=====I===~==J =~==~=K=l~I=t=~=~===OOI= ===~=~==~===NQK=Ep=c=RKF =OMMU=q=q=dI=fK= ============NN 12. T T H H E E WHITE PAPER: The Web Security Challenge: a Competitive Guide to Selecting TOLLY Secure Web Gateways GROU PPolicy Interface ScoringSource: The Tolly Group, November 2008 Figure 5 =OMMU=q=q=dI=fK=============NO 13. T T H H E EWHITE PAPER: The Web Security Challenge: a Competitive Guide to Selecting TOLLYSecure Web Gateways GROU PReporting Capabilities o=~~=~==~=~=~===p= t=~~=~====~===== ===~K=_===~===~=== =~=~~I==~=~=~==~=~== =~=~===~K=t===~=== Q=====~~~= ~I==~===~=N==O===~Kt=~=~===PRI====== =~=OOK=t===~====== ==I===~==~~~===~=~~K=^J ~I=~J==~===~=~~~=Ep=c= SKF =OMMU=q=q=dI=fK= ============NP 14. T T H H E E WHITE PAPER: The Web Security Challenge: a Competitive Guide to Selecting TOLLY Secure Web Gateways GROU P Reporting Scores Source: The Tolly Group, November 2008 Figure 6 =OMMU=q=q=dI=fK== ===========NQ 15. T T H H E EWHITE PAPER: The Web Security Challenge: a Competitive Guide to Selecting TOLLYSecure Web Gateways GROU PURL Filtering q=~===~==t=~=====~= ==~K=q=~===~==== ===~==I==~==J== ~~=~==~==~=Kt==~~===~====~~=J ==t=~=====~===X=~==~= ~==NO==~==~~=~~K=Ep=c=TKF= q======~=V=====Q=~KURL Filtering Feature ScoringSource: The Tolly Group, November 2008 Figure 7 =OMMU=q=q=dI=fK= ============NR 16. T T H H E EWHITE PAPER: The Web Security Challenge: a Competitive Guide to Selecting TOLLYSecure Web Gateways GROU PMalware Filtering t=roi===~=~==~==t=~~I=~~== =~=~==~=~=~=K=s==~= ~==~~==~=~==~~===~=t=J ==~======~==== =~K=eI=q=q=d===~=~J===~=~J I==~======~=~= =~=~~Kt=~=~=VUKQB====~~==~~== USR===~=K=l==~==SRB==VSB= ~~==~~K=Ep=c=UKFt=~=~==~==~=~==~= ==VUKPB===I==TMB==UUB====K= ^=t=~==VVB====~==~=~= ==~===J==~K=l=== ==RQB==VNB===Kt=~=~=======~=== Q= ===~=====~K=q==~== d~======~= =~=~== ===~~=~=~===== =~~==~~=~=~=~K =OMMU=q=q=dI=fK= ============NS 17. T T H H E EWHITE PAPER: The Web Security Challenge: a Competitive Guide to Selecting TOLLYSecure Web Gateways GROU P Malware Detection Scores Source: The Tolly Group, November 2008 Figure 8 =OMMU=q=q=dI=fK= ============NT 18. T T H H E EWHITE PAPER: The Web Security Challenge: a Competitive Guide to Selecting TOLLYSecure Web Gateways GROU PApplication Control b=~~J==~==~~==J ==~=~=~==tJ~=~~==~=fjI=pI= mOmI=~=K=q=d==~~==~=== Q= ==t=======^~=`=~= ~K=Ep=c=VKF=t=~=NV===~==OM=I===J~= ====~===NNK=t=~==~== =~==~=~~I==~==~=~=~J ~==K=f=~=~=~=~===== =~I====~=~====K=^= t=~=~=~===~=mOm=~=~==J =~~=~=I=====~=====~J K= =OMMU=q=q=dI=fK= ============NU 19. T T H H E EWHITE PAPER: The Web Security Challenge: a Competitive Guide to Selecting TOLLYSecure Web Gateways GROU PApplication Control Scores Source: The Tolly Group, November 2008Figure 9 =OMMU=q=q=dI=fK= ============NV 20. T T H H E EWHITE PAPER: The Web Security Challenge: a Competitive Guide to Selecting TOLLYSecure Web Gateways GROU PData Loss Protection t==~======~=~=~=== =~==~~==I==~=~==PO=K=q== ~==~=NQ=K=Ep=c=NMKF^==t===~==~I=~~=~=J =~========~~K=p=t=~~= ~=====~===J~==~= ~=~=K=t==~===t=a~~=pJ =p=I=t=~======~=J ===~==~=~~=J~I=== =~==~==~==K==t=~=~== ===~===I====== ~==~~==~=~=~=Ke~J=~~=====~==I==~= _`~=m=pdONM=~=q=j=f~=t=p=p== ==~=~~===~==~=K =OMMU=q=q=dI=fK= ============OM 21. T T H H E E WHITE PAPER: The Web Security Challenge: a Competitive Guide to Selecting TOLLY Secure Web Gateways GROU PData Loss Prevention ScoresSource: The Tolly Group, November 2008Figure 10 =OMMU=q=q=dI=fK=============ON 22. T T H H E EWHITE PAPER: The Web Security Challenge: a Competitive Guide to Selecting TOLLYSecure Web Gateways GROU PNetwork Implementation t==NN===~==OM=I==p=t= =p=`===NQI=~=fp~=t=p= p==q=j===NOK=Ep=c=NNKFq~=~~==~===~=~=~=== =~======K=t=== J=~===t====== ====~==K=p==~=~= ~==~~=~=~=~=~=~=~== ==K=e~~=~~=~====~= ~~=~=~==~=~I==~=== ====~====K =OMMU=q=q=dI=fK= ============OO 23. T T H H E EWHITE PAPER: The Web Security Challenge: a Competitive Guide to Selecting TOLLYSecure Web Gateways GROU PDelivery and Network Implementation Feature Scores Source: The Tolly Group, November 2008Figure 11 =OMMU=q=q=dI=fK= ============OP 24. T T H H E EWHITE PAPER: The Web Security Challenge: a Competitive Guide to Selecting TOLLYSecure Web Gateways GROU PIntegration with Other Solutions f~===I==~=~=~~I=I=bJ~=~= ==~===~I==~=====~~= =~K=t====~====~J I=t====~~==~I=~=~=aim=J K=Ep=c=NOKF =OMMU=q=q=dI=fK= ============OQ 25. T T H H E E WHITE PAPER: The Web Security Challenge: a Competitive Guide to Selecting TOLLY Secure Web Gateways GROU PIntegration Scores Source: The Tolly Group, November 2008Figure 12 =OMMU=q=q=dI=fK=============OR 26. T T H H E E WHITE PAPER: The Web Security Challenge: a Competitive Guide to Selecting TOLLYSecure Web Gateways GROU PService and support p=~===~=~=~=~====J =~=K=q=~====~=~==~= K=_~======I====== ====~==I==~=~~=~=== ==~===K=q===~== ~==~==~========J =~I==~===~=~=~=~==I== =~=~==K=Ep=c=NPKF =OMMU=q=q=dI=fK= ============OS 27. T T H H E E WHITE PAPER: The Web Security Challenge: a Competitive Guide to Selecting TOLLYSecure Web Gateways GROU P Service and Support ScoresSource: The Tolly Group, November 2008Figure 13 =OMMU=q=q=dI=fK= ============OT 28. T T H H E EWHITE PAPER: The Web Security Challenge: a Competitive Guide to Selecting TOLLYSecure Web Gateways GROU PTest Methodology Alexa 100,000 URL Filtering/ Classification Test q=~=roi==~~==~==~==== ~~=~==~=~=~===NMMIMMM=roi=== ^~=q=NMMIMMM===t======K= ^=~~~=roi=~==~~==~===~= ~====~==~=roi=~=====J =~K=f=~=roi=~=~==~=~=~~~== =I==roi=~=K=f==roi====~== ~=~~~=~I=====~===~= ~=~K=q===~====~===~== =~=~===K=^==~=~=roi=~=~==~= =~==~~===I===~== ~K=q===~===~==~==roi= =~===~~==~=K=q==J ~====~~=~===~~K= Long Tail or Extended URL Classification Test c==I===~===NUIRUM=roi=~===tJ =q~p=K=q=roi====~===roi= ===q~p===~~==J= ~==K=q=roi=========OQ= ====I===~==roi===== ==fK=l=~~I==~=~=~~~=roi=~~J =~=~~~====I=~===== ~===~====~=~====roiK= = f=~=roi=~=~=====~=~===I= =roi=~=K=f==roi====~==~=~= ~I=====~===~=~=~K=bJ ==~~===~~====~==~== ~=roi==~====~=roi=K=q== =OMMU=q=q=dI=fK= ============OU 29. T T H H E E WHITE PAPER: The Web Security Challenge: a Competitive Guide to Selecting TOLLYSecure Web Gateways GROU P =~===~==~==~==J =~~==~=K=q==~====~J ~=~===~~K Phishing and/or Proxy Avoidance URL Detection Accuracy Test c==I===~===OIPMO=roi=~===tJ =q~p=K=q=roi====~===roi= ===q~p==~===~=roi==t= =~=m===~~=m=^~K=q=roi============J I===~==roi=======fK=l= ~~I==~=~=roi=~~=~=~==mJ =~=m=^~=~=~~~====I=~= ====~===~====~=~=J ===roiK=f=~=roi=~=~=====~= ~===I==roi=~=K=f==roi==== ~==~=~=~I=====~=J ==~=~=~K=b==~~===~~= ~==~==roi==~====== ~=K=q==~====~~=~==J =~~K Binary Exploits and Compromises Detection Accuracy Test c==I===~===PTV=roi=~===tJ =q~p=K=q=roi====~===roi= ===q~p==~===~=roi==t= =~=_~===K=q=roi============J I===~==roi=======fK=l= ~~I==~=~=roi=~~=~=~==_~= =~==~=~~~====K=f=~= roi=~=~=====~=~===I===OMMU=q=q=dI=fK= ============OV 30. T T H H E E WHITE PAPER: The Web Security Challenge: a Competitive Guide to Selecting TOLLYSecure Web Gateways GROU P roi=~=K=f==roi====~==~=~= ~I=====~===~=~=~K=bJ ==~~===~~====~==J ~==~======~=K=q== ~====~~=~===~~K= Malware-infected URL Detection Accuracy Test c==I===~===USR=roi=~===tJ =q~p=K=q=roi====~===roi= ===q~p==~===~=roi==t= =~=~~=E~===~~FK=q=roi============J I===~==roi=======fK=l= ~~I==~=~=roi=~~=~=~==~J ~=_~==~==~=~~~=== =K=f=~=roi=~=~=====~=~== =I==roi=~=K=f==roi====~== ~=~=~I=====~===~= ~=~K=b==~~===~~====~= =~==~======~=K= q==~====~~=~===~~K= Web 2.0-Based Malicious URL Detection Accuracy Test c==I===~===VSR=roi==~=t=OKM== =K=~=K=~=~=I==J ~=~~I=~===t=q~p=K=q= roi====~===roi====q~p=J ===~=~===~=~~K=q=roi= ========OQ=====I== =~==roi=======fK=b=~=~=~~~=roi=~~=~=== =I=~==~L~=~I==~=K==OMMU=q=q=dI=fK= ============PM 31. T T H H E E WHITE PAPER: The Web Security Challenge: a Competitive Guide to Selecting TOLLYSecure Web Gateways GROU P q===roi=~==~=~====K=f=~=roi= ~=~=====~=~===I==roi= ~=K=f==roi====~==~=~=~J I========~=~=~K=bJ ==~~===~~====~==J ~==~======~=K=q== ~====~~=~===~~K Criteria Evaluation by UI Inspection b====~~======= =====~=~====~J ~=~K=q=~~=~=====~~J =~==~===I=~=~===== ~~~=~======K=c=~=~I= q=q=d===~=~====~=~==N= E~=F==Q=E=KF=a~===~=~= ~=====Kr~=~====~==~~=~=~= ==~~==~=K=q==~I=~= ~=~===~=~=~==~=~=~=~J ==NI=~===QI====~==q== ==~====K= =OMMU=q=q=dI=fK= ============PN 32. T T H H E EWHITE PAPER: The Web Security Challenge: a Competitive Guide to Selecting TOLLY Secure Web Gateways GROU PInteraction with Competing Vendors Fair Testing Charter ~=f~==`In accordance with The Tolly Groups process, competitors were contacted and invited to participate in the test - to review the test plans, the product levels and congurations of their prod- ucts and to review and comment on their results.For more information on this process, please see: http://www.Tolly.com/FTC.aspx.Cisco Systems Inc., and Blue Coat Systems did not respond to the invitation. Trend Micro, Inc. and Secure Computing Corporation agreed to par- ticipate in the test, and were provided with a test plan. At the completion of testing, The Tolly Group provided Trend Micro and Secure Computing with the results of their products, and requested to provide comments. Secure Computing did not provide ofcial comments on their results.Trend Micro representatives provided the following comments:Trend Micro's most current secure web gateway product, InterScan Web Security Virtual Appliance v3.1 (IWSVA), was not used in this test. The IWSVA product has improved functionality over the tested product (IWSS) in the following areas: 1. Implementation Model: IWSVA supports bi-direction transparent bridging sothat no client or network re-conguration is needed. 2. Malware Detection: additional capabilities have been added to the IWSVAproduct to ensure the highest possible content-based malware detection rates,further enhancing the URL reputation-based malware detection already in theproduct. 3. Performance and Throughput: IWSVA running on a standard off-the-shelf 8-core server can support up to 10,000 users with full scanning and no notice-able latency. =OMMU=q=q=dI=fK== ===========PO 33. T T H H E EWHITE PAPER: The Web Security Challenge: a Competitive Guide to Selecting TOLLY Secure Web Gateways GROU PAppendix: Product ListSource: The Tolly Group, November 2008Figure 14=OMMU=q=q=dI=fK=============PP 34. Terms of UsageUSE THIS DOCUMENT ONLY IF YOU AGREE TO THE TERMS LISTED HEREIN.=This document is provided, free-of-charge, to help you understand whether a given product, technology or service merits addi-tional investigation for your particular needs. Any decision to purchase must be based on your own assessment of suitability.This evaluation was focused on illustrating specific features and/or performance of the product(s) and was conducted under con-trolled, laboratory conditions and certain tests may have been tailored to reflect performance under ideal conditions; performancemay vary under real-world conditions. Users should run tests based on their own real-world scenarios to validate performance fortheir own networks. Commercially reasonable efforts were made to ensure the accuracy of the data contained herein but errorsand/or oversights can occur. In no event shall The Tolly Group be liable for damages of any kind including direct, indirect, special,incidental and consequential damages which may result from the use of information contained in this documentThe test/audit documented herein may also rely on various test tools the accuracy of which is beyond our control. Furthermore,the document relies on certain representations by the sponsor that are beyond our control to verify. Among these is that thesoftware/hardware tested is production or production track and is, or will be, available in equivalent or better form to commercialcustomers.When foreign translations exist, the English document is considered authoritative. To assure accuracy, only use documentsdownloaded directly from The Tolly Groups Web site.All trademarks are the property of their respective owners.q=q=d==~=~=~===J~=~~=====fq=I==~=K q=~==~==_~=o~I=ci=~=~==~===~==ERSNF=PVNJRSNMI==~==fJ=~WLLKKI=~]K= b=`=`=OMMU== q=q=dI=fK^ii=ofdeqp=obpbosba OMUPOSJNJJMOaMU =OMMU=q=q=dI=fK= ============PQ