Sana Security Debuts Attack Shield

Viruses, Trojans, worms and malware: small business owners who rely on computers and the Internet are all too familiar with the damage any one of those digital vermin can cause. It often seems impossible for the anti-virus software companies to keep up with the hackers who crank out viruses at an alarming rate.

Sana Security, a four-year-old intrusion prevention software (IPS) company based in San Mateo, Calif., offers a different way to protect against these types of digital assault. Today the company announced Attack Shield, a family of products that uses adaptive learning rather than signature-based scanning to detect security threats. According to the company, once you install the software, your systems are protected from both known and unknown threats &#151 you don’t need to configure, maintain or update anything.

The company designed Attack Shield as a modular family of products. The first product &#151 Attack Shield Worm Suppression (WS) &#151 focuses exclusively on Internet worms, a category of threat that wreaks havoc with a company’s IT infrastructure. Matthew Kovar, vice president, security solutions and services at The Yankee Group said, “It is critical that Internet-connected PCs are protected from PC network worms, the largest class of attacks.”

How It Works
First, a bit of back ground on how traditional anti-virus and security threat software relies on recognizing the signatures of known viruses. But when new viruses come out, they must be analyzed and a new signature must be developed, which takes time. “Typically,” said Steven Hofmeyer, founder and chief scientist at Sana Securities, “it takes anti-virus companies between 20 to 30 hours to get a new signature out to the general public. A worm can do a lot of damage in that amount of time.”

Attack Shield uses what Hofmeyer calls adaptive learning, a process by which the software learns the proper way applications behave and then looks for deviations that indicate attacks. “The advantage,” says Hofmeyer, “is that the software doesn’t need to know what a worm looks like. It doesn’t need any human input. It can detect worms that have never been seen before and act on them in order to protect the computer system.”

Hofmeyer acknowledges one disadvantage. “The software requires a learning period to learn the application behavior,” he said. “During the learning period, a system is potentially vulnerable to a worm attack. Generally it takes between one day and a week, depending how busy the system is. The busier the system, the faster it learns.”

Sana Technologies designed Attack Shield WS to work in conjunction with anti-virus programs such as those from Symantec or McAfee. A code injection protection system, Attack Shield WS prevents hackers from injecting code into your applications. A buffer overflow is one example of this type of attack. All Internet worms use code injection. Hofmeyer says that Internet worms make up 80 percent of security attacks.

Real World Use
Paul Picciani, partner and vice-president of sales at The FruitGuys, a 10-employee company also based in San Mateo, Calif., has been using Attack Shield WS on his company systems for the past few weeks. “We just installed eight brand new Dell PCs with Windows XP Pro, and we decided it was a good time to add the extra protection,” said Picciani.

The FruitGuys lost a PC a year a go to a virus and wanted to prevent any other incidents. One of the company’s three partners handles the company’s PC maintenance. “We don’t want to spend a lot of time on IT,” said Picciani. “We wanted a program that was low impact and low risk. One that wouldn’t slow down our applications or worse, interfere with them. All we had to do was install the program &#151 that’s it. No problems. It just does its thing.”

It was Attack Shield’s low price that convinced Picciani to try the program, “If we’d had to spend a lot of money on this, I’m not sure we would have taken a chance,” he said. “But it cost us like $100 to cover all of our PCs, so how far wrong could we go? That’s a pretty cheap insurance policy. I’d recommend this software to any small business owner.”

Pricing and Availability
You can buy Attack Shield WS online. The software sells for $9.95 per PC, with volume pricing available for 100 seats ($7.96 each) and 500 seats ($6.97 each).

Lauren Simonds is the managing editor of SmallBusinessComputing.com