30 Minute Interview

IronPort’s next-gen proxy

Andy Norton, Director – Product Management & Marketing, IronPort Systems, talks to Nivedan Prakash, about issues in Web security and IronPort’s plans to counter the same.

Andy Norton

What are the latest industry trends in Web security?

The latest industry trends in Web security are that malware is being created by well-funded, well-resourced, and extremely clever criminals for their financial gains by infecting devices or stealing data or someone’s identity. So the old days of students in Philippines writing viruses for fun is pretty much done and dusted. Today the professional black economy is supporting the criminals.

What is IronPort doing to address emerging security issues?

Essentially, what IronPort is bringing uniquely within security to address these issues is that we are providing organizations with the ability to protect themselves with the concepts of reputation. As the malware gets cleverer, it becomes encrypted and increasingly difficult to detect and comes up with hundreds of variants instead of one or two and that makes the ability to detect based on content almost impossible. So what we do is the ability to protect based on reputation. As the payloads becoming smarter, the networks, the resources, and the methods by which the bad guys are using to deliver the payloads all carry a reputation and it’s that reputation that we apply at the gateway.

What according to you is the behavior of hackers? How have they commercialized the scenario?

The single point goes towards criminals who employ hackers and these hackers form companies to support criminal activities. They have come out with many different ways to make money from this crime like sending spam, phishing or identity thefts, and through online advertisements. Today it has become international, anonymous crime wherein you don’t have to physically break-in somewhere. From the criminals’ point of view, it is an attractive business.

Tell us about your Web Security Appliances?

Our Web Security Appliances are the next-generation of Web gateway. What we have done is that we have taken requirements of Web gateway, which normally is about six or seven different boxes, and consolidated them into a single box. So it’s basically the next-generation proxy that comes with on-board anti-virus, anti-malware, internal audit tools, bot net detection and prevention tool, and the ability to provide security based on reputation.

Why is a fresh approach needed to tackle emerging Web threats?

The main reason is that security has been content dependent and security companies in the past have looked for specific URLs and stamped them as ‘bad’. Or they get a particular malware sample and write a signature to detect it in the future. So having security being heavily content based, it means that if someone changes the ability to recognize that content, rotate the URL every single time, or a malware sample is encrypted or encoded in some way, in such a case content based security becomes close to obsolete. The reason behind the industry moving forward is that the concept of reputation holds true. It doesn’t matter what type of content it is, where the URL is coming from—all of these things indicate that it carries a negative reputation.

Do you think Web 2.0 is affecting the Web security scenario?

No, I don’t think that Web 2.0 is affecting the Web security scenario. For me Web 2.0 is a just a marketing term. What is affecting the security landscape is the adoption of more Web applications. Whether it is class 2.0, 3.0 or 4.0 applications, there will be attempts to exploit them.

How is India positioned in the overall Web threat market?

I think India is a strong country. In Asia, India is one of the early adopters for new types of technologies. Certainly we see India high on our list of countries that are attacked, especially in the banking space. We see a lot of phishing attacks on Indian banks more so than you would expect in comparison to other countries in Asia. ICICI Bank is probably on the top of the list in India, it is most attacked bank as can be seen simply by the quantity of IP addresses claiming to be ICICI Bank. See, India is always well-positioned because there is a level of willingness and understanding that new technology does bring competitive advantage and India will keep its position in the near future.

How important a market is India for IronPort and what are your strategies for the India companies?

India is a Tier 1 market for us which means it’s up there with the US, Germany, Japan or Australia. We have just put our development center in Bangalore. It’s not only a market because of the parity or understanding we have with the Indian enterprise community but also as a company we have invested in the Indian talent for the bright future of IronPort.