ellen_messmer
Senior Editor, Network World

IPS gets bigger role in spyware defense

News
Jan 17, 20052 mins

Users looking to get a handle on the spyware scourge are getting help from traditional intrusion-prevention system vendors that are starting to add features that block spyware, worms and other security threats.

McAfee this week will announce it has added a spyware-blocking capability to its IntruShield network IPS, and TippingPoint Technologies, which 3Com acquired last month, is expected to ship a high-speed IPS with spyware protection later this quarter.

So far, a handful of vendors, including Blue Coat Systems, have introduced gateway-based anti-spyware products. Spyware protection – a growing area of interest of corporations plagued by the wide variety of adware and Trojans – is more available, as desktop software products from anti-spyware start-ups, some anti-virus vendors, and now Microsoft, with its acquisition of Giant Company Software last month, are added.

McAfee – which refers to spyware as any “potentially unwanted programs” – will make its first set of anti-spyware signatures for its IntruShield IPS product line available to customers for free.

The release, available this week, will focus on about 30 types of adware and Trojans considered the most prevalent or dangerous, including Gator and ByteVerify. The company plans to add anti-spyware updates, just as it might issue updates for virus or worm signatures.

McAfee also this week will also announce the beta version of desktop software called McAfee Anti-Spyware Enterprise Edition Module.

The software scans to identity, alert, block and eliminate spyware, adware, dialers, key-loggers, Trojans and remote-access tools. According to John Bedrick, group marketing manager, the module detects about 4,000 types of spyware. Based on volume, the module will cost $4.95 to approximately $20. McAfee Anti-Spyware Enterprise Edition will ship later this quarter.

Meanwhile, TippingPoint also wants to handle spyware prevention via its IPS.

In an announcement expected next month, TippingPoint will unveil the high-speed UnityOne-5000E IPS which can reach 5G bit/sec. It, too, will not only detect denial-of-service attacks and block attacks, but it also will block several types of spyware.

The UnityOne-5000E appliance, expected to ship during the first quarter, will have eight gigabit Ethernet ports to protect four network segments. A source at TippingPoint, which confirmed plans for the UnityOne-5000E appliance, said that price has not yet been set.