IronPort Appliance Uses E-Mail Analysis To Fight VirusesIronPort Appliance Uses E-Mail Analysis To Fight Viruses

IronPort Systems Inc., an E-mail infrastructure and services company, has introduced the latest version of its E-mail security appliance. Known for its anti-spam technology and Bonded Sender E-mail reputation service, the company's latest hardware may get more attention for its virus-fighting capabilities.

IronPort's C-Series appliance features what the company calls "virus-outbreak filters," technology it says detects viruses faster than methods employed by antivirus companies such as Sophos, Symantec, and TrendMicro.

Earlier this year, MyDoom knocked out a thousand PCs at one of EDS's customers, says Richard Parvin, senior engineer at leading IT applications and services with EDS. "The vendors didn't have [virus] definitions for four, six, eight hours," he says. "So these people were impacted--they were down. A thousand people lost anywhere from four to eight hours of productivity."

It can take an EDS team from two to four hours to clean up each desktop, which is where IronPort comes in. The company's virus-outbreak filters can detect and quarantine viruses within 15 minutes--much faster than virus-definition signatures are typically released by antivirus vendors for blocking--reducing the window of vulnerability.

IronPort is able to do that because it maintains the largest private E-mail-monitoring network, SenderBase.org. The company compiles data from more than 28,000 domains enrolled in its Bonded Sender E-mail reputation service, which it analyzes to determine the origin and volume of messages, information that helps detect viruses.

"It's an important step, and there's nothing comparable," says Peter Christy, co-founder of NetsEdge Research, an Internet infrastructure consulting firm. "Even though all the virus-definition companies work as diligently as possible to devise filters as soon as viruses are seen, there's a significant time lag between detection and the availability of a virus signature."

Other anti-spam companies such as MessageLabs are also using traffic-pattern data from customers' E-mail to block undesirable content more quickly. Alex Shipp, senior antivirus technologist with MessageLabs, says the time it takes to spot a virus varies, depending on how many copies of the bug get sent to customers. But MessageLabs is also able to reduce the window of vulnerability that exists from the time a virus first appears until antivirus vendors are able to prevent it.