|

(click here to view actual article)
September 4, 2006 - Privacyware going corporate:
Host-based intrusion-detection software gains management
platform.
By Tim Greene
Privacyware next month is
scheduled to unveil a management platform for its
personal firewall that will make the desktop- and
laptop-based software suitable for deployment in
corporate networks.
Called Endpoint Security
Console, the platform lets administrators control
Privatefirewall, a desktop security application that
blocks suspicious behavior in individual machines that
may be the sign of infection by viruses, worms or other
malware.
With the console,
businesses will be able to set policies about what
processes and applications are allowed to run on their
PCs and white-list them. They can black-list others or
have alerts sent about them.
The upside of this type of
protection is that it doesn't rely on virus signatures,
which can be ineffective if the signature for a new
virus has not been added to the virus-signature library.
Instead, Privatefirewall is installed in learning mode
for a number of days and determines a behavior baseline
that becomes the norm for activity on each machine.
Deviations from the norm trigger alerts to the user and
the console. An administrator then has to allow or
disallow the flagged behavior, and that becomes the
software's default response to that behavior whenever it
comes up again.
The downside is that the
software relies on an administrator to make a judgment
about whether to allow a flagged behavior, though if the
administrator has stepped away from the console, the
software can be set to allow or disallow flagged
processes.
Privacyware says
administrators can set a default for a process that is
sometimes allowable and sometimes not that depends on
how often it is legitimate behavior. So, if a behavior
is legitimate 95% of the time, an administrator might
set the default to approve that behavior if there is no
administrator response to an alert within 10 seconds.
Monitoring a PC with Privatefirewall eats up about 15MB
of RAM when it is fully engaged, the company says.
Until next month's expected
release of Endpoint Security Console, Privatefirewall
will be a desktop application that only the user can
control. Privatefirewall has been around since 1999,
when it was a standard stateful-inspection firewall with
some proprietary features, but its functionality has
expanded since then. The product competes with McAfee's
Host Intrusion Prevention and Sana Security's Primary
Response.
With the release of
Privatefirewall 5.0 last week, Privacyware announced a
sales agreement with CA that integrates CA's antivirus
and antispyware software into Privatefirewall for an
extra fee.
Privatefirewall costs $30
per seat, with discounts for the purchase of sufficient
quantities. Adding CA's antivirus and antispyware
software costs an additional $10 per seat. Endpoint
Security Console comes at no extra cost when customers
buy multiple licenses for Privatefirewall
|