Feeds

Sourcefire jumps into anti-malware market

Cyber-outbreak defence tech to shore up big biz

Internet Security Threat Report 2014

Sourcefire, the security biz behind the commercial versions of the open-source Snort intrusion-detection software, is bowling itself at enterprises and touting tech designed to quickly detect and block malware outbreaks.

FireAMP offers a malware discovery and analysis tool that offers visibility of threats and outbreak control. The technology offers a means to limit the damage from virus infections, which Sourcefire argues are more or less inevitable, especially in the face of ever more sophisticated and numerous threats.

Oliver Friedrichs, senior vice president of Sourcefire’s Cloud Technology Group, told El Reg that "threats are getting by existing defences". Sourcefire has positioned FireAMP to cover for the shortcomings of endpoint protection technology, rather than offering a replacement, at least with the first iteration of the technology.

"We're not necessarily interested in replacing anti-virus or building better mousetraps," explained Friedrichs, an ex-staffer at both Symantec and McAfe. "FireAmp could replace anti-virus, but it's not going to replace it immediately, especially because firms have invested in conventional security software. We're offering FireAMP as a way to shore up defences."

"We don't pretend our tool can detect 100 per cent of malware - nothing can," he added.

FireAMP uses data analytics to analyse and block malware. Security analysts can write their own signatures for digital nasties in much the same way that they create Snort attack signatures, albeit in a slightly different context. Sourcefire claims the cloud-based approach the technology uses is capable of identifying and scoring threats missed by other security layers.

Whitelisting

The technology can be used to block particular strains of malware without running system scans. It can equally be used to whitelist benign apps, an approach that helps to reduce the possibility of false positives.

Deploying the technology involves deploying a "flight-recorder"-like client agent on PCs, which allows firms to quickly figure out which process introduced malware into their environment and how malicious files subsequently spread on their network. This agent communicates with a cloud-based analysis engine and is designed to co-exist with any anti-virus or security software running on computers (so it unlike running two anti-virus clients on the same PC, a set-up that would always ends in tears).

Sourcefire's technology allows the "patient zero" of outbreaks that get missed to be later identified, Friedrichs explained, adding that this saves time on computer forensics. File trajectory technology bundled within FireAmp shows how malware spread across a firm, he said. Once problems are identified, remedial actions can be carried out from the FireAMP console.

FireAMP, which is based on technology Sourcefire acquired from Immunet last year, comes only a month after it released a next-generation application-aware firewall, twin moves designed to allow it to sell kit outside its traditional IDS niche.

FireAMP is been positioned against gateway technology designed to thwart botnets from the likes of FireEye or Damballa as well as malware/based analysis and forensics tools from HB Gary and Guidance Software. All these technologies aim to cover for the security shortcomings of anti-malware suites in one way or another. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Home Office: Fancy flogging us some SECRET SPY GEAR?
If you do, tell NOBODY what it's for or how it works
Syrian Electronic Army in news site 'hack' POP-UP MAYHEM
Gigya redirect exploit blamed for pop-rageous ploy
prev story

Whitepapers

Go beyond APM with real-time IT operations analytics
How IT operations teams can harness the wealth of wire data already flowing through their environment for real-time operational intelligence.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Why CIOs should rethink endpoint data protection in the age of mobility
Assessing trends in data protection, specifically with respect to mobile devices, BYOD, and remote employees.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Seattle children’s accelerates Citrix login times by 500% with cross-tier insight
Seattle Children’s is a leading research hospital with a large and growing Citrix XenDesktop deployment. See how they used ExtraHop to accelerate launch times.