Risk
3/30/2009
06:01 PM
Keith Ferrell
Keith Ferrell
Commentary
50%
50%

BorderWare: Dynamic Inspection Tackles Bad Site Explosion

URL filters, however robust, wall off only a small per centage of malware sites and inappropriate content. How do you keep your employees -- and your business -- from being tagged by the larger universe of dangerous sites? Filtering on the fly is BorderWare's solution.

URL filters, however robust, wall off only a small per centage of malware sites and inappropriate content. How do you keep your employees -- and your business -- from being tagged by the larger universe of dangerous sites? Filtering on the fly is BorderWare's solution.Security vendor BorderWare has introduced a new feature, Dynamic Inspection, that the company says addresses the vast number of unrecognized and unfiltered sites on the Web.

While the Websense URL database, for instance, categorizes several million known sites, there are over a trillion (with a "t") sites on the Net, and the number is growing larger by the second.

BorderWare's latest feature-add to its subscription-based e-mail and Web security platform approaches unknown Web sites your employees seek to surf to, and analyzes them for both malware infections as well as for appropriate (or, more accurately, inappropriate) categories and content, measured against the standards and restrictions established in your security/usage policy.

According to Shawn Eldridge, BorderWare vp of products and marketing, with whom I spoke recently, the real-time scanning and content analysis process is usually quick and essentially unnoticed by the user. "Large sites with lots of content take longer, of course," he says.

What's the advantage of on-the-fly inspection over traditional URL filtering?

"Both are important," Eldridge said. "But the Web is growing so rapidly that no database of URLs can keep up. Dynamic Inspection was designed to bridge that gap between known sites and the far larger number of unknown ones."

As an additional feature for the company's e-mail and Web filtering and security products, Dynamic Inspection offers an effective solution both to inadvertent encounters with risky URLs and the larger, I think, general problem of exuberantly surfing employees.

The feature is an add-on, which brings us back to a question we've looked at here before: Can your business justify the investment of thousands of dollars for filtering and Web monitoring?(BorderWare is sold through resellers, so I don't have specific per seat costs.)

Eldridge's answer was not dissimilar from others I've received:

"It depends on the nature of your IT resources," he said. "Take a look at the amount of time, personnel and money you spend on help desks and IT staff, and measure that against the cost of the service you're considering."

Fair enough: like any other business investment, you have to look at both your resources and your needs.

On the needs front, the question comes down to the volume of unwanted and potentially dangerous e-mail you're receiving throughout your organization. Get that number, then determine how much time and effort your IT staff is spending dealing with the stuff, and you'll have made a good start toward understanding the level of challenge you face, and the level of investment that challenge justifies.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Latest Comment: yup
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-6628
Published: 2015-05-28
Aruba Networks ClearPass Policy Manager (CPPM) before 6.5.0 allows remote administrators to execute arbitrary code via unspecified vectors.

CVE-2015-1389
Published: 2015-05-28
Cross-site scripting (XSS) vulnerability in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.5 allows remote attackers to inject arbitrary web script or HTML via the username parameter to tips/tipsLoginSubmit.action.

CVE-2015-1392
Published: 2015-05-28
Multiple SQL injection vulnerabilities in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.5 allow remote administrators to execute arbitrary SQL commands via unspecified vectors.

CVE-2015-1550
Published: 2015-05-28
Directory traversal vulnerability in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.5 allows remote administrators to execute arbitrary files via unspecified vectors.

CVE-2015-1551
Published: 2015-05-28
Directory traversal vulnerability in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.4 allows remote administrators to read arbitrary files via unspecified vectors.

Dark Reading Radio
Archived Dark Reading Radio
After a serious cybersecurity incident, everyone will be looking to you for answers -- but you’ll never have complete information and you’ll never have enough time. So in those heated moments, when a business is on the brink of collapse, how will you and the rest of the board room executives respond?