Information Security - What to Look for in an Endpoint Intrusion Prevention Solution @ VIRTUALIZATION JOURNAL

Information Security - What to Look for in an Endpoint Intrusion Prevention Solution

Even in the best of times, security products that aim to thwart worms are playing catch-up. Anti-virus and anti-malware products are populated with signatures created for attack specific signatures, which are created and distributed only after an attack is underway. Internet worms propagate too quickly for such reactive solutions to be effective. This is a major problem in maintaining information security as well as providing business continuity for many organizations.

Reader Feedback : Page 1 of 1

#5	Juergen Brendel commented on the 31 Jul 2005 The ability to help against zero-day anomalies, such as DDoS attacks or worms, is of course an important one, as outlined in the article. The problem is that most so-called behavioral anomaly detection solutions may be able to detect the presence of an anomaly even without prior signature knowledge (zero-day). They might then be able to tell you the ports and protocols used, and maybe also the machines that are involved. However, more often than not, there are no fine-grained signatures forth-coming from those solutions. When you then try to use this information to stop the worm or DDoS attack or other zero-day anomaly you are likely to cut out innocent traffic as well. The signature is too broad. Therefore, it is necessaary to have the ability to generate truly fine-grained signatures of the anomaly/worm/attack, which can then be used to surgically filter out the attack traffic. I wrote about the need for fine-grained signatures here: [visit link] For information on how to use those fine-grained signatures with your already existing network infrastructure, take a look here: [visit link] Juergen Brendel CTO Esphion Ltd. Url: [visit link] Blog: [visit link]
#4	Kalevi Nyman commented on the 31 Jul 2005 Why is Linux NOT afected by all you mention above?
#3	PBDJ News Desk commented on the 30 Jul 2005 Information Security - What to Look for in an Endpoint Intrusion Prevention Solution Even in the best of times, security products that aim to thwart worms are playing catch-up. Anti-virus and anti-malware products are populated with signatures created for attack specific signatures, which are created and distributed only after an attack is underway. Internet worms propagate too quickly for such reactive solutions to be effective. This is a major problem in maintaining information security as well as providing business continuity for many organizations.
#2	.NET News Desk commented on the 28 Jul 2005 Information Security - What to Look for in an Endpoint Intrusion Prevention Solution Even in the best of times, security products that aim to thwart worms are playing catch-up. Anti-virus and anti-malware products are populated with signatures created for attack specific signatures, which are created and distributed only after an attack is underway. Internet worms propagate too quickly for such reactive solutions to be effective. This is a major problem in maintaining information security as well as providing business continuity for many organizations.
#1	ISSJ News Desk commented on the 28 Jul 2005 Information Security - What to Look for in an Endpoint Intrusion Prevention Solution Even in the best of times, security products that aim to thwart worms are playing catch-up. Anti-virus and anti-malware products are populated with signatures created for attack specific signatures, which are created and distributed only after an attack is underway. Internet worms propagate too quickly for such reactive solutions to be effective. This is a major problem in maintaining information security as well as providing business continuity for many organizations.