Risk
3/30/2009
06:01 PM
Keith Ferrell
Keith Ferrell
Commentary
Connect Directly
RSS
E-Mail
50%
50%

BorderWare: Dynamic Inspection Tackles Bad Site Explosion

URL filters, however robust, wall off only a small per centage of malware sites and inappropriate content. How do you keep your employees -- and your business -- from being tagged by the larger universe of dangerous sites? Filtering on the fly is BorderWare's solution.

URL filters, however robust, wall off only a small per centage of malware sites and inappropriate content. How do you keep your employees -- and your business -- from being tagged by the larger universe of dangerous sites? Filtering on the fly is BorderWare's solution.Security vendor BorderWare has introduced a new feature, Dynamic Inspection, that the company says addresses the vast number of unrecognized and unfiltered sites on the Web.

While the Websense URL database, for instance, categorizes several million known sites, there are over a trillion (with a "t") sites on the Net, and the number is growing larger by the second.

BorderWare's latest feature-add to its subscription-based e-mail and Web security platform approaches unknown Web sites your employees seek to surf to, and analyzes them for both malware infections as well as for appropriate (or, more accurately, inappropriate) categories and content, measured against the standards and restrictions established in your security/usage policy.

According to Shawn Eldridge, BorderWare vp of products and marketing, with whom I spoke recently, the real-time scanning and content analysis process is usually quick and essentially unnoticed by the user. "Large sites with lots of content take longer, of course," he says.

What's the advantage of on-the-fly inspection over traditional URL filtering?

"Both are important," Eldridge said. "But the Web is growing so rapidly that no database of URLs can keep up. Dynamic Inspection was designed to bridge that gap between known sites and the far larger number of unknown ones."

As an additional feature for the company's e-mail and Web filtering and security products, Dynamic Inspection offers an effective solution both to inadvertent encounters with risky URLs and the larger, I think, general problem of exuberantly surfing employees.

The feature is an add-on, which brings us back to a question we've looked at here before: Can your business justify the investment of thousands of dollars for filtering and Web monitoring?(BorderWare is sold through resellers, so I don't have specific per seat costs.)

Eldridge's answer was not dissimilar from others I've received:

"It depends on the nature of your IT resources," he said. "Take a look at the amount of time, personnel and money you spend on help desks and IT staff, and measure that against the cost of the service you're considering."

Fair enough: like any other business investment, you have to look at both your resources and your needs.

On the needs front, the question comes down to the volume of unwanted and potentially dangerous e-mail you're receiving throughout your organization. Get that number, then determine how much time and effort your IT staff is spending dealing with the stuff, and you'll have made a good start toward understanding the level of challenge you face, and the level of investment that challenge justifies.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-1544
Published: 2014-07-23
Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network Security Services (NSS) 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger cer...

CVE-2014-1547
Published: 2014-07-23
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVE-2014-1548
Published: 2014-07-23
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVE-2014-1549
Published: 2014-07-23
The mozilla::dom::AudioBufferSourceNodeEngine::CopyFromInputBuffer function in Mozilla Firefox before 31.0 and Thunderbird before 31.0 does not properly allocate Web Audio buffer memory, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and applica...

CVE-2014-1550
Published: 2014-07-23
Use-after-free vulnerability in the MediaInputPort class in Mozilla Firefox before 31.0 and Thunderbird before 31.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging incorrect Web Audio control-message ordering.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Where do information security startups come from? More important, how can I tell a good one from a flash in the pan? Learn how to separate ITSec wheat from chaff in this episode.