Vendors to take aim at network intruders

SAN JOSE - Vendors will use this week's RSA Security Conference to introduce a slew of products aimed at helping companies protect themselves from network intruders.

While it was unclear before the show whether RSA would announce anything significant, many companies previewed their plans, which include new intrusion-detection system (IDS) packages, security gateways and Web content protectors.

Recourse Technologies will announce the second version of its ManHunt IDS software, a Solaris-based offering designed to detect computer worms or other intruders on gigabit speed networks. New in Version 2.0 is the ability for multiple ManHunt systems to report trouble to a central console; previously, each IDS node could report only to its own console. In addition, ManHunt 2.0 customers can use their console software to process the threat-assessment output from other vendors' IDS products.

The distributed version of ManHunt is being installed at Sony Pictures Entertainment in Culver City, Calif., which supports 265,000 users across multiple networks, some operated jointly by different business groups.

"We're doing a major deployment of ManHunt here and at our business-to-business Web sites," says Jeff Uslan, director of information security and protection. "The ManHunt tool can tell us where an attack is coming from and you can track it back. It's important to have a distributed system due to the size of our network."

Symantec will use the show to launch an appliance for small and midsize offices that combines firewall, IP Security-based VPN, gateway-level antivirus protection, intrusion detection and content filtering. The Symantec Gateway Security Appliance will support up to 50 broadband connections, and up to eight of the devices can be clustered to balance traffic loads and provide failover protection. The product will be available next month starting at $11,800.

Competing against Symantec will be TippingPoint Technologies, a company led by entrepreneur John McHale that will announce its line of products for combining antivirus, firewall and intrusion-detection technologies. The company will charge $20,000 for its low-end UnityOne-600 box and $50,000 for its high-end UnityOne-2000.

For TippingPoint, the challenge will be gaining customer confidence as an antivirus and intrusion-detection software vendor because the company has not been targeting this market. TippingPoint broke onto the network scene last year with technology designed to help service providers roll out new offerings faster.

Also at the show:

l VeriSign is expected to lay out the road map for its Web services strategy, which so far has centered on a handful of emerging XML-based protocols including the XML Key Management Specification. Support for those protocols will let Web services applications tap into VeriSign's trust services, such as digital certificates. The company also plans to announce a number of key partnerships.

l Start-up LockStep Systems will preview an upgrade of its software for automatically replacing Web content should a hacker deface it. WebAgain 2.5, which runs on a machine separate from the Web server it is protecting, now supports Windows XP; it already runs on Windows NT. It now also supports FrontPage Server extensions. The software costs $1,000 and competes most directly with products from Tripwire as well as Sanctum's AppScan and AppShield.

l Start-up Stratum8 will preview a product designed to protect up to 10 Web servers at a time from intruders, according to CEO Bob Walters. The hardware/software combination, dubbed the Application Protection System, is scheduled to ship in April for $25,000 and compete with products such as Sanctum's AppShield.