ICSA Labs — 25 Years of Product Assurance
ICSA Labs’ mission is to provide credible, independent, third-party assurance to end users through rigorous security product testing and certification. For the last 25 years, ICSA Labs has tested hundreds of the world’s commercial computers and network security products against measureable sets of industry-vetted requirements. Products that successfully attain ICSA Labs Certification serve as the foundation for enterprise security product selection and provide a necessary level of integrity to an organization’s security risk management program.
“Huawei and ICSA Labs have shared a mutually beneficial, long-term collaboration that has served the joint vision of delivering secure and reliable products,” said Ajay Gupta, Director, Global Product Marketing for Huawei’s Enterprise Business Unit. “As an independent certification laboratory, ICSA provides the extra level of trust and confidence that is required to meet the expectations of our customers.”
ICSA Labs’ ISO accredited certification testing can substantially reduce an enterprise’s risk by verifying that products meet objective criteria, thereby increasing security, trust, and usability. ICSA Labs tests security solutions in the following technologies:
- Anti-Virus (AV) for Desktops/Servers/Gateways
- IPSec Gateways
- Network Firewalls
- Network Intrusion Prevention Systems (IPS)
- SSL-TLS Virtual Private Networks
- Web Application Firewalls (WAF)
Enterprises rely on these security technologies to protect their networks, assets, and critical data from the persistent threat of cyber breaches.
One of the mandatory requirements of ICSA Labs’ certification programs is that products must remain continuously deployed in the test lab in order to maintain the certification. The continuous deployment of products allows ICSA Labs to perform recurring testing and conduct ‘fire drills’ when new threats affect much of the Internet or a particular class of security products. Ongoing surveillance of certified products helps keep the certification meaningful.
ICSA Labs earned ISO/IEC 17025:2005 accreditation in 2009 and was the first commercial information security test lab to be awarded this designation. ICSA Labs is also ISO 9001:2015 certified for its quality management system, which includes a commitment to continual improvement and stakeholder satisfaction. These accreditations demonstrate the quality and proficiency of the organization and differentiate ICSA Labs from other testing labs and the services that they provide. Much the same as the certification requirements we place on products that we test, ICSA Labs undergoes mandatory internal and external audits.
ICSA Labs continues to grow its current certification programs to keep pace with new technology and the ever-present threats that enterprises face. Testing was recently expanded to include technologies in mobile, advanced threats, health IT, and the Internet of Things (IoT).
Huawei and ICSA: 10+ Years
Huawei has participated in ICSA Labs testing since 2004. Its commitment is evident in the quality of their products and ultimately to the satisfaction of their customers. Obtaining certification requires significant dedication, discipline, and resources to not only navigate through ICSA Labs’ rigorous security testing to attain certification but also to continue the efforts required to maintain it.
Over the last decade, Huawei products have been successfully tested and certified in ICSA’s Network Firewall, Network Intrusion Prevention (IPS), and SSL-TLS. Huawei currently has an AV solution under test in ICSA Labs’ Anti-Virus program.
In March 2015, Huawei became China’s first IPS-certified security vendor by passing the ICSA Labs Network IPS testing, with Huawei’s entire NGFW series receiving the ICSA Labs firewall certification. That same year, Huawei received an Excellence in Information Security Testing (EIST) Award issued by ICSA Labs for 10 years of continuous testing, demonstrating Huawei’s dedication to maintaining the quality of their security products year after year.
Huawei solutions that are currently ICSA Labs certified include:
- IPSec: Huawei USG Series, Eudemon Series, and NIP Series
- SSL-TLS VPN: Huawei USG Series, Eudemon Series, and NIP Series
- Network IPS: Huawei USG Series, Eudemon-N Series, and NIP Series
- Network Firewalls: USG Series and Eudemon-N/X Series
Significance of ICSA Labs Certification
Evidence suggests that when enterprises demand features from security product vendors, those same vendors may struggle to provide high-quality security protection. However, security products that are consistently held to a high standard, such as Huawei’s ICSA Labs Certified solutions, are shown to be more reliable than products that are not tested. While many vendors may implement a software development lifecycle process and go through the series of alpha, beta, and internal quality assurance testing, there is a lot of variability in these processes. In some cases, these processes may not be rigorously followed or mandated.
Huawei has committed to having its products undergo third-party certification through ICSA Labs to subject their products to rigorous testing against a set of standard requirements. ICSA Labs certified products can, in turn, be relied upon by those who look to a higher level of due diligence in the procurement process or as part of their ongoing cyber security risk management strategy.
Huawei’s ICSA Labs certified products exhibit an independent mark that signifies that the organization has successfully completed rigorous, ISO-accredited, third-party testing, which is proof of their commitment to due diligence.
Attaining ICSA Labs certification can serve as a competitive differentiator for Huawei by providing customers with proof of its commitment to security. Additionally, the continuous nature of ICSA Labs’ independent testing is an important validation step in the product development lifecycle of Huawei’s certified solutions.
Implementing and maintaining a robust security program across an enterprise is a critical task. Properly vetting the technology solutions is also important because it’s that underlying system that serves as the foundation for the technology. Unfortunately, many organizations don’t perform much due diligence beyond a product demonstration or a response to a Request for Proposal (RFP).
For vendors, ICSA Labs certified products provide a critical component to their selection process. Organizations and supply chain management look for products with the internationally recognized ICSA Labs certification mark for evidence to support relevant requirements when making sourcing or purchasing decisions. These vendors rely on and trust ICSA Labs certified solutions because they have attained specific levels of functionality and security and are continuously held to a high standard by a competent, third-party lab.
New Program Development
While ICSA Labs’ existing testing programs continue to serve enterprises and vendors, ICSA Labs develops testing programs in order to stay current with the latest threats and technologies. New technologies include mobile, advanced threats, and health IT. ICSA Labs has recently entered the IoT space with a new testing and certification program.
In the quickly escalating realm of the IoT, most devices are moving from hardwired closed systems to interconnected systems with communications through traditional IP networks, Wi-Fi, Bluetooth, and wireless connectivity.
Many devices are not designed to connect to the Internet. Device functionality and ease of access tend to be top priorities, whereas security and privacy are often overlooked. ICSA Labs’ IoT program tests and certifies IoT connected devices and sensors using the ICSA Labs Device Requirements Framework, which serves as the basis to formulate test requirements for any IoT device. Security and privacy-related tests are then mapped to those criteria requirements, helping reduce risks to the supply chain and customers — leading to better protected businesses and homes.
As technology continues to evolve, products tested and certified by ICSA Labs provide organizations that are not positioned to do the proper due diligence with a high level of assurance when building security into their networks.