Re: Anyone using anti-spyware net filters?

[Chris Allison <AllisoC () MUOHIO EDU>]

        We use an intrusion prevention appliance by TippingPoint.  It stops all
sorts of bad stuff from viruses and spyware to exploit signature traffic.
It does this without blocking normal traffic using the same protocols.

        Their product works on many different types of connections including
trunked GIG links in the core.  We use it in the core and at the Internet
boundary.

        We have had very good luck with it.  Several times it has saved us from
network meltdowns.

        It is not perfect, nothing is.

        I highly recommend the product and the company.  They have been very
responsive to service problems.  They update the signatures weekly or more
often as necessary.

        A lot of their signatures are exploit based, not specific to a virus, but
specific to the exploit used by multiple viruses.  They often have the
exploit blocked before the virus is even written.

        Chris Allison


At 12:15 PM 11/10/2004 -0500, you wrote:
> Is anyone using, or reviewing (or have opinions, concerns about) products
> similar to Intrusion, Inc's SpySnare(tm) as a border-based spyware reducer?
>
> It claims to be able to filter spyware from web traffic, including
> recognizing HTML code for known misdirecting popup messages, etc.
>
> Some questions which immediately come to mind:  How transparent can it
> really be to 'legitimate' traffic; effecting campus acceptance of border
> web filtering (even if beneficial); how to provide convenient bypass
> mechanisms for academics whose work may call for unfiltered web.
>
> http://www.intrusion.com/products/download/SpySnare_Brochure.pdf
>
> --
>
>   ------------------------------------------------------------
>   Gary Dobbins, CISSP -- Director, Information Security
>   University of Notre Dame, Office of Information Technologies
>
> **********
> Participation and subscription information for this EDUCAUSE Discussion
Group discussion list can be found at http://www.educause.edu/groups/.
>

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/groups/.