Startup Devises New Way to Squash Worms

While the large anti-virus vendors continue to spend millions of dollars and thousands of man-hours churning out updated signature files, a Utah-based startup this week plans to unveil an entirely new e-mail security solution that needs no signatures and is capable of trapping malicious messages before they reach users desktops.

Avinti Inc.s iSolation Server takes a unique approach to the challenge of stopping virus-infected messages and other malicious e-mail from reaching desktops. The solution relies on virtual machine technology to tell which messages should be blocked and which can be safely forwarded.

Users and analysts say the technology holds promise for reining in the chaos that viruses visit upon corporate e-mail message systems.

“The first thing I thought was, Why has no one done this before?” said David Cassee, director of IT at InteliTarget Inc., of Herndon, Va., which has been using iSolation Server for about four months. “One of the Bagle variants came through on Saturday, and I didnt know it until I checked the logs on Monday and nothing had gotten through. It doesnt miss anything.”

/zimages/4/28571.gifIs the next great worm on its way?Read about it here.

The tool, which is a software package loaded on a dedicated Windows server, typically sits behind the gateway anti-virus scanner and the mail server. As e-mail traffic arrives, iSolation Server inspects each message to determine whether it is capable of carrying a threat. Harmless e-mail such as plain text and nonactive HTML messages are forwarded to the recipient. Any message that could potentially contain malicious code is sent to a virtual machine that is a replica of the recipients desktop.

iSolation Server opens each potentially dangerous message—including Zip files—on the virtual desktop and observes its behavior. Actual virus-infected e-mail messages are quarantined for cleanup or deletion.

Because iSolation Server is capable of opening every suspicious message, it is able to identify new and unknown viruses the first time it notices them.

/zimages/4/28571.gifFor insights on security coverage around the Web, check out eWEEK.com Security Center Editor Larry Seltzers Weblog.

Avinti plans to launch iSolation Server at the end of this month. Pricing will start at $20 per user.

/zimages/4/28571.gifCheck out eWEEK.coms Security Center for the latest security news, reviews and analysis.

/zimages/4/77042.gif

Be sure to add our eWEEK.com developer and Web services news feed to your RSS newsreader or My Yahoo page