The company delivers its products as a "purpose-built appliance," meaning it contains some custom processors to assist the firm's software in scaling up to handle network volumes of up to 2 Gb/sec. The firm offers the 2600, which is perimeter-based and scales to 600 Mb/sec, and the 4000, which sales to 2 Gb/sec and is deployed at the core of the network.
Version 1.5 updates the software, which contains the intellectual property of patented algorithms that provide much of the functionality.
"Security administrators need help in isolating the attacks that are relevant," says Raj Dhingra, vice president of product management and marketing for IntruVert.
The new version adds intrusion intelligence usefully in identifying whether an attack was successful, blocked or needs further investigation. The direction of the attack, incoming or outgoing, can be identified and addressed with separate policies. An Intelligent Intrusion View provides a visual representation and analysis of intrusion events. Intrusion Relevancy rankings reduce false positive. Reporting features offer a macroscopic view of a company's security posture. Event correlation can collapse thousands of events related to a single intrusion into one report.
Intrusion prevention can be implemented by installing the appliance inline, as opposed to on the network perimeter, so that it is in a position to performance session blocking on a selective basis.
"No one is going to buy a system and deploy it inline on day one. It has to be built on trust," Dhingra says. "We recommend a multi-phase approach."
The first phase is to use the product in detection only, for filtering and not blocking. Then upgrade to inline deployment, but still perform detection only, to test the behavior of the device on the network and to gain experience. Finally, implement broader prevention policies. The process can take from two to six months.
The 2600 is priced at $35,000; the 4000 is priced at $100,000. IntruVert's deal sizes range form $90,000 to $300,000.
Loading Comments...