* ConSentry Secure LAN Controller
To thwart the efforts of those who would do our networks harm, we’ve implemented all kinds of hardware and software perimeter solutions. But increased employee mobility means that the bounds of the perimeter are constantly changing. When it comes to network security, perimeter detection may not be enough today.
Applying a solution client-by-client is time consuming and can be woefully inadequate if only a single endpoint is missed. A better approach would be to protect the network as well as the endpoints. After all, the network is the transport mechanism used by malicious code, Trojans and viruses. That’s precisely the mindset of start-up ConSentry Networks https://www.consentry.com/, formerly Tidal Networks, and the company’s upcoming Secure LAN Controller.
ConSentry has a patent-pending, custom ASIC CPU architecture that monitors the network, not the individual client devices, for aberrant behavior. For instance, rather than looking for a signature as many anti-virus appliances and software packages do, ConSentry’s solution looks for abnormal behavior.
Here’s an example of the type of abnormal behavior detected by ConSentry’s Secure LAN Controller. A mobile user comes into the office and connects his laptop to the network. He has unknowingly picked up a brand new scanning worm over the weekend. In fact, it’s so new that there is no signature yet available for it. But that doesn’t mean the malware is unstoppable because it does follow certain identifiable behavioral rules common to scanning worms. For example, a scanning worm generates more connection failures than typical applications as it looks for potential paths of propagation. This behavior can be observed and acted upon.
The Secure LAN Controller operates in one of three modes set by the IT department: monitor, log or enforce. When running in the most secure mode, enforce, suspect packets are actually dropped, thereby never being allowed to reach their target. The other two modes would be used for active and passive monitoring of network traffic.
The ConSentry Secure LAN Controller appliance performs abnormal behavior detection along with deep packet scanning at a rate demanded by modern high-speed networks. Since it’s an in-line device, all network traffic goes through its multi-threaded, custom ASIC chipset and subsequently gets inspected without introducing lagtime.
You needn’t worry about bogging down your network, even if you’re running VoIP. Since most VoIP systems can deal with up to 150 milliseconds of total latency, you won’t be putting your network in a bind by adding the ConSentry solution. In fact, ConSentry claims its appliance is so efficient that on average you would experience a mere 30 microseconds of latency, and its worst case latency is only 500 microseconds even in the heaviest network traffic.
You may have recently read that ConSentry has attracted $31.1 million in venture capital (http://www.networkworld.com/news/2005/071805-consentry.html?rl), which in and of itself implies that there is a sound confidence in the company’s product and approach. With ConSentry’s funding secured, look for a late third-quarter launch of the Secure LAN Controller.
Perimeter protection is good to have and you can complement it and strengthen your overall security by adding a network-based security solution to monitor traffic from the inside out.
