SecurityFocus officially commences selling ARIS Predictor alerts

Security Focus Inc. this week will formally launch a subscription service, called ARIS Predictor, that the company says will alert corporations to pending network and virus attacks before they occur. The service works by automatically collecting and analyzing intrusion and incident data from more than 7,000 computers scattered across 130 countries, according to the San Mateo, Calif., security firm.

"There's a demand for these services because companies don't have the resources to look at all the vulnerabilities and threats and then try to decide which ones are relevant to them," said Allan Carey, an analyst at IDC in Framingham., Mass. Security Focus offers "a service where you receive customized reports based on a profile of your network," said Carey. That makes it the first structured and customizable as well as most comprehensive service of its kind, according to Carey...

New service warns of network attacks

By JAIKUMAR VIJAYAN

But others have been attempting, at various levels, to give enterprises more warning when it comes to dealing with security threats.

A user group called the Anti-Virus Information Exchange Network (AVIEN) has been quietly running a $99 subscription-based Early Warning System (EWS) that is consistently hours faster than other alerts in warning members of impending viruses and worms, said founding member Robert Vibert. AVIEN's member's include security professionals from companies such as 3M Corp. Electronic Data Systems Corp., Ford Motor Co., Nortel Networks Corp. and Prudential Securities Inc.

Network Intelligence

The ARIS Predictor system generates the following reports:
Port report: Frequency of attacks against specific ports
Source IP: Attacks originating from specific IP addresses or IP ranges
Source country: Frequency of attacks from specific countries
Attacked products: Attack types targeted at vendor products
Source ISP: Frequency of attacks originating from specific Internet service providers
Attacks targeting specific port: Types of attacks and frequency of attacks directed at particular ports

The group uses the EWS system as a bulletin board to exchange virus and vulnerability information and alert one another of suspicious incidents before they explode into real problems, said Vibert, whose Braeside, Ontario-based company, Segura Solutions Inc., maintains the service. With both the Nimda and Code Red worms, users were able to alert one another a good three to four hours before antivirus vendors had their alerts, he said.

"Whenever any new malicious code is discovered in the wild, the AVIEN community shares the details as it unfolds, even prior to the antivirus industry having a chance to obtain and analyze the malicious code, publish their findings and write new [patches]," said Russ Cluett, a member of EDS Canada's information systems security group.

"We can construct defenses before the virus hits our gateway, which is invaluable in containing an outbreak," said Paul Schmehl, supervisor of support services at the University of Texas, Dallas, which is part of the AVIEN network.

AVIEN is the main reason the university had "zero infections from Anna Kournikova, one of the most prolific viruses ever," Schmehl said.

SNP.