Start-up Avinti is putting a virtual server twist on a well-known concept – quashing viruses that use e-mail as their delivery vehicle.
The company this week will unveil its iSolation Server, a virus-blocking technology that uses a virtual server to open e-mail attachments and observe their behavior to judge whether the mail is safe to pass onto the LAN.
Users need not wait for updated anti-virus signatures, such as last week’s JPEG of Death vulnerability, to catch the newest viruses because the virtual server doesn’t use signatures.
Instead, it executes e-mail attachments to expose unexpected activity or malicious intent such as file system access, self-replication, address book lookup, modifications and access of the system registry, or disk access. If any of that activity is detected, the e-mail is dropped.
The iSolation Server sits at the edge of the network and intercepts e-mail coming from any SMTP relay. The virtual server filters out the e-mail with attachments or active hyperlinks and lets all other e-mail pass through to the corporate e-mail server. The filter can be configured to weed out and test only those attachments most likely to carry viruses.
“This is a great first line of defense that is much better than giving everything to your anti-virus software and mail server to choke on,” says David Cassee, director of IT for IntelliTarget, an outsourcer of temporary help for corporate sales departments in Coshocton, Ohio. “This is more flexible than traditional anti-virus software because I can detect a virus before the virus definition is out.”
Cassee and other early adopters say they were initially skeptical but that has faded away along with concerns about latency.
“My biggest concern was that it would disrupt operations but we haven’t had a single bump in the road,” says Darren Massey, a systems integrator working with the Utah branch of the Make-A-Wish Foundation. Massey says another plus is a reduction in help desk calls from users trying to figure out dialog boxes presented by desktop anti-virus software. The software also can buy companies time as patches are tested and rolled out, a process that can take weeks or months.
“If we can block viruses based on what they do instead of using signatures, that is powerful,” Massey says.
“It’s a unique idea and a great complement to anti-virus and spam filters,” says Teney Takahashi, an analyst with Radicati Group. He says performance will be an area of concern for large companies, but if virus attacks continue like they have – with exploits coming nearly at the same time vulnerabilities are discovered – “the need and value of this product will be apparent.”
Avinti officials say iSolation Server can handle 5,000 to 6,000 mailboxes per processor and plan to release a version next year that ties multiple iSolation Servers to one console for large corporate deployments.
The virtual server uses what Avinti calls a black box, a simulated client that has a generic version of Windows 2000, the Microsoft Office suite, WinZip and Adobe Acrobat. Users can modify the black box with other applications for dealing with specific attachment types. Avinti then adds a management layer that can observe behavior within the black box.
The virtual machine technology is based on open source technology.
“We wanted to be a virtual machine management company so we used off-the-shelf plumbing,” says Terry Dickson, CEO of Avinti. “But we have designed this so we can run our virtual machine management technology to run on top of multiple virtual machines, such as those from Microsoft or VMware.”
The iSolation Server prices start at $35 per user for installations with hundreds of mailboxes, and $20 per user for those with thousands of mailboxes.
