The problem with signature based security tools is you are vulnerable until the signature is released and distributed. Palo Alto Networks takes a different approach with Traps, so Network World Editor in Chief John Dix tracked down Palo Alto VP of Product Marketing Scott Gainey for an inside look at how Traps works.
You recently unveiled a new endpoint protection product called Traps. Tell us what that's about.
If I'm outside of my corporate network operating on an unsecured Wi-Fi network my system is at risk. A simple drive-by-download of embedded malicious content in, say, an iFrame could easily bypass existing anti-virus software, leaving nothing that could protect me from being infected. This is one of many examples that leave endpoints vulnerable. So a complete security architecture has to be able to protect its users regardless of where they may be working, whether they're on-network or off-network, and that's one use case that led us down this path of investing in endpoint protection.
Another one is that we see a lot of highly targeted attacks that are utilizing a threat that's never been seen before and has been designed in such a way that it's able to evade detection at the network security level. It could be based on a new zero-day vulnerability the attacker will use against a high-value target. Because this is based on an unknown vulnerability it's missed by IPS/IDS. Our approach is effective at learning from these new attacks and routing new defenses back to the infrastructure so if that type of threat is used again it will be blocked. But if the attacker only uses it once then other areas of defense must kick in to protect an organization.
So those use cases are why we made the investment in Cyvera, and the release of Traps is our first official release of this technology and includes some integration into WildFire, which is our sandboxing technology.
The classic endpoint protection companies that offer antivirus-based protection rely on signatures for defense, which requires prior knowledge of the threat in order to block it. So these vendors have large teams of people who are constantly churning out signatures based on new threats they observe in the wild.
The challenge we saw with that approach is you're always several steps behind the attacker community. There's literally millions of forms of new malware that get generated each year. On a daily basis we see an average of over 20,000 new forms of malware. So companies with AV-based solutions have to build signatures against all of those new forms, then distribute those signatures out to all the endpoints. It's an impossible situation to stay on top of.
Sign up for Computerworld eNewsletters.