Risk
3/30/2009
06:01 PM
Keith Ferrell
Keith Ferrell
Commentary
50%
50%

BorderWare: Dynamic Inspection Tackles Bad Site Explosion

URL filters, however robust, wall off only a small per centage of malware sites and inappropriate content. How do you keep your employees -- and your business -- from being tagged by the larger universe of dangerous sites? Filtering on the fly is BorderWare's solution.

URL filters, however robust, wall off only a small per centage of malware sites and inappropriate content. How do you keep your employees -- and your business -- from being tagged by the larger universe of dangerous sites? Filtering on the fly is BorderWare's solution.Security vendor BorderWare has introduced a new feature, Dynamic Inspection, that the company says addresses the vast number of unrecognized and unfiltered sites on the Web.

While the Websense URL database, for instance, categorizes several million known sites, there are over a trillion (with a "t") sites on the Net, and the number is growing larger by the second.

BorderWare's latest feature-add to its subscription-based e-mail and Web security platform approaches unknown Web sites your employees seek to surf to, and analyzes them for both malware infections as well as for appropriate (or, more accurately, inappropriate) categories and content, measured against the standards and restrictions established in your security/usage policy.

According to Shawn Eldridge, BorderWare vp of products and marketing, with whom I spoke recently, the real-time scanning and content analysis process is usually quick and essentially unnoticed by the user. "Large sites with lots of content take longer, of course," he says.

What's the advantage of on-the-fly inspection over traditional URL filtering?

"Both are important," Eldridge said. "But the Web is growing so rapidly that no database of URLs can keep up. Dynamic Inspection was designed to bridge that gap between known sites and the far larger number of unknown ones."

As an additional feature for the company's e-mail and Web filtering and security products, Dynamic Inspection offers an effective solution both to inadvertent encounters with risky URLs and the larger, I think, general problem of exuberantly surfing employees.

The feature is an add-on, which brings us back to a question we've looked at here before: Can your business justify the investment of thousands of dollars for filtering and Web monitoring?(BorderWare is sold through resellers, so I don't have specific per seat costs.)

Eldridge's answer was not dissimilar from others I've received:

"It depends on the nature of your IT resources," he said. "Take a look at the amount of time, personnel and money you spend on help desks and IT staff, and measure that against the cost of the service you're considering."

Fair enough: like any other business investment, you have to look at both your resources and your needs.

On the needs front, the question comes down to the volume of unwanted and potentially dangerous e-mail you're receiving throughout your organization. Get that number, then determine how much time and effort your IT staff is spending dealing with the stuff, and you'll have made a good start toward understanding the level of challenge you face, and the level of investment that challenge justifies.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-2977
Published: 2015-07-29
Webservice-DIC yoyaku_v41 allows remote attackers to create arbitrary files, and consequently execute arbitrary code, via unspecified vectors.

CVE-2015-2978
Published: 2015-07-29
Webservice-DIC yoyaku_v41 allows remote attackers to bypass authentication and complete a conference-room reservation via unspecified vectors, as demonstrated by an "unintentional reservation."

CVE-2015-2979
Published: 2015-07-29
Webservice-DIC yoyaku_v41 allows remote attackers to execute arbitrary OS commands via unspecified vectors.

CVE-2015-4286
Published: 2015-07-29
The web framework in Cisco UCS Central Software 1.3(0.99) allows remote attackers to read arbitrary files via a crafted HTTP request, aka Bug ID CSCuu41377.

CVE-2015-4290
Published: 2015-07-29
The kernel extension in Cisco AnyConnect Secure Mobility Client 4.0(2049) on OS X allows local users to cause a denial of service (panic) via vectors involving contiguous memory locations, aka Bug ID CSCut12255.

Dark Reading Radio
Archived Dark Reading Radio
What’s the future of the venerable firewall? We’ve invited two security industry leaders to make their case: Join us and bring your questions and opinions!