McAfee pumps up security gateway

Plus: CipherTrust, others roll out new wares to combat viruses and spam.

Network Associates’ McAfee Security division last week introduced a version of its antivirus and content-filtering appliance that can process twice the number of messages as the company’s previous high-end offering at just a fifth more of the price.

McAfee says the WebShield e1000 , which starts at $20,500, can scan 160,000 Simple Mail Transfer Protocol messages per hour for worms, viruses and unauthorized content. McAfee plans to add antispam technology obtained through its recent acquisition of a company called DeerSoft.

The appliance, which has 10/100M bit/sec and Gigabit Ethernet interfaces, typically sits between a firewall and a corporate LAN.

McAfee competes with Symantec and others that are packing more capabilities into their security gateway products that provide an alternative to installing and managing separate antivirus, spam-filtering and content-filtering products.

“There can be performance advantages in having the varied security functions done on one box instead of forcing the traffic through four or five separate boxes,” says Eric Hemmendinger, research director for security and privacy at Aberdeen Group. “One box also takes up a lot less space.”

Also in this market is Blue Coat Systems , which this week will introduce the SG-400 Web Security Appliance for antivirus, instant messaging and content filtering at remote offices with up to 100 end users. The $3,500 device is designed to be managed through a corporate central office, and can control caching and bandwidth allocation in addition to security. Unlike the McAfee product, the Blue Coat offering does not handle SMTP traffic filtering.

Another player in the market is CipherTrust, which is taking the next step in the cat-and-mouse game played by spammers and those looking to stop them with the Enterprise Spam Profiler (ESP ) option for its IronMail gateway appliance. The device, which starts at $27,000 when configured with ESP software, also can handle antivirus protection and act as a firewall for e-mail servers.

ESP uses five spam-detection techniques to score an incoming message and determine an overall “spam confidence value.” Depending on the value, a message can be discarded immediately or quarantined for review. Previously, IronMail had a gamut of spam filters that a message passed through, with any one filter being able to raise a red flag and block a message.

“It’s like France on the United Nations’ Security Council: They can veto a whole measure,” says Matt Anthony, director of marketing at CipherTrust. “Instead, we’re looking at all filters as data points that paint an overall picture.”

An automatic whitelisting feature has been added to IronMail that allows certain e-mail addresses a free pass after a specified number of correspondences. For example, a newsletter from a user group that could be identified as spam but is not could be added to the whitelist to let it pass to the intended recipients without being quarantined.

“The auto whitelisting will be a boon to us,” says Carl Howell, systems engineer at the University of West Florida in Pensacola, which is snagging about 60,000 spams at the 100,000 e-mails the university receives daily. “As people get auto whitelisted, it should help shrink the number of false positives.”

In other security news:

• RSA Security will introduce PKZIP-based encryption and data-compression software designed in partnership with PKWare. The product, RSA SureFile, can be used as a stand-alone application for file compression, encryption based on the Advanced Encryption Standard and signing with X.509 digital certificates, or with RSA’s public-key infrastructure product, RSA Keon. Pricing starts at $80 per seat.

• Sophos has announced Web-based software designed to send antivirus software updates to remote or mobile workers’ computers. The Remote Update package runs on Microsoft Internet Information Server or Apache Web servers. It costs $30 per seat for a 100-seat license.