The legends say that you use silver to kill a werewolf. One company says that with iron, you can kill zombies (and spam and viruses).

by Alex Goldman ISP-Planet Managing Editor [December 8, 2005]

Praise one company, and you'll hear from several others. That's what happened when we wrote our article on IronPort and called it The Future of Messaging. We heard from Alpharetta, Ga.-based CipherTrust, a company that is also building a global network to track infections and zombies.

On Monday, CipherTrust reported that its network is now tracking a record 250,000 new zombie infections each day! That's using its network of 4,000 IronMail appliances.

The C-Class for D-Day
They say that every military operation happens on D-Day, at H-Hour. CipherTrust wants ISPs to use its C-Class appliance and is offering a free trial. Of course, every free trial costs the time and resources required to install a test product, so the free trial is, in fact, as elusive as that mythical free lunch.

Nevertheless, if you're looking for carrier class security, this is one appliance to look closely at. Alex Hernandez, CipherTrust director of advanced product development, says that the IronMail C 10000 is a 2U dual Xeon box. More specific details, such as per-box traffic limits and exact CPU speeds, were not disclosed.

The package
The software consists of several layers of security, like an onion, as every security system should.

A reputation-based system called TrustedSource analyzes data from the network of IronMail appliances and generates a list of trustworthy senders as well as a list of bad actors. "We spend time analyzing suspicious messages and allow trusted messages through," explains Hernandez.

The results are posted to TrustedSource.org.

TrustedSource also catches zombies before they activate. "Typically, we'll see activity that infects the PC, building a zombie network. We'll see spurts of network activity from the infected computers, experimental activity. Then thousands will do a dedicated virus or phishing attack. We see suspicious activity at the experiment stage and block it then."

The product also incorporates anti-virus, anti-spam, auditing, and compliance, all developed in house. "Our competitors resell other products," says Hernandez. "We build our own solution and are able to offer tight interoperability between all the parts."

Plans for the future
As threats evolve, CipherTrust must also evolve. A more thorough compliance engine will be released early next year. "We'll be looking for material that shouldn't go out—even VoIP. We'll be able to allow or block any application, such as Skype, that a network administrator might be concerned about."

CipherTrust plans to extend TrustedSource to protect instant messaging and VoIP. "We haven't seen specific targeted attacks against users yet, but we expect bad behavior. We know there are bad people trying to connect."

Security is all about planning ahead.

Pricing and availability
The IronMail appliance and other CipherTrust products are available now. Pricing was not disclosed. IM and VoIP features will be added to TrustedSource in early 2006.

—End