Content Analysis

GCSx CoCo addresses content analysis in order to identify and isolate malicious software (at least viruses, macros, dangerous file types, mobile code and spyware) from the gateway and the host.

It is good security practise to use a multi-layered approach where financially possible and this may be most easily addressed by adding an additional gateway layer device that uses a different scanning engine than the end point security.

---

Network Vulnerability Scanning

There is quite a range of Vendors products that could add an additional layer of scanning at the gateway (Network Boundary).

Many Enterprise Firewalls will have the ability to scan for Malicious content such as those listed in the vulnerability list above with a third party Software utility coming from mainline vendors or by using Open Source AV software. 

 NETASQ is best known for designing and building the NETASQ EAL4 certified UTM Firewalls. Key features include intrusion prevention, firewall, antivirus, antispyware, antispam, content filtering, VPN and SSL-VPN access. EAL4 Certified on all Netasq firewalls.  

 Check Point UTM range have the ability to scan for vulnerabilities using application level scanning and added OEM signatures from companies like Kaspersky.,

 Stonesoft specialise in High Availability Security Appliances including Firewalls, IDS/IPS and SSL VPN in both hardware and virtual appliances. 

Networking and security solutions from Juniper Networks helps consolidate network security issues for small, medium and large enterprises

  Palo Alto Networks’ next-generation firewalls provide network security by enabling enterprises to see and control applications, users, and content – not just ports, IP addresses, and packets – using three unique identification technologies: App-ID, User-ID, and Content-ID. These identification technologies, found in Palo Alto Networks' enterprise firewalls, enable enterprises to create business-relevant security policies – safely enabling organizations to adopt new applications, instead of the traditional “all-or-nothing” approach offered by traditional port-blocking firewalls used in many security infrastructures.

The XTM family of network security appliances is a new class of performance-driven solutions. Blazing fast throughput combines with advanced networking features to handle high-volume traffic securely - and at an affordable price. Includes a suite of flexible management tools that allows IT administrators to manage security through an intuitive centralized console, command line interface, and web UI. 

 The MSA security appliance from Celestix is specifically designed for network security, running a hardened version of Microsoft ISA Server 2006.

SonicWALL provides firewall products with unified threat management services such as network anti-virus, anti-spyware, virtual private networking (VPN), content filtering and other security services.

Network Boundary or Gateway Appliances are often used as an additional layer of security and put inline or out of band to add additional scanning ability when the firewall is unable to include the additional security. 

 

---

Network Access Control Partners

 CounterACT limits non-compliant device access to specified resources, thus enabling users to remain productive while their device-compliance violations are addressed. For example, if a user device is found to have an out-of-date anti-virus (AV) definition file, it can be moved to a VLAN, allowing the user to access email and Internet while blocking the device from other critical resources. CounterACT can then work with existing services to provide guided remediation and/or cue the AV server to auto-update a specific device. Once remediation is complete and the device is found to be in compliance, complete access to the production network may be granted or restored.

CounterACT integrates with a number of remediation services, including patch management, anti-virus, anti-spyware, vulnerability management, and more. These third-party integrations allow CounterACT to orchestrate and automate the process of correcting policy violations. For example, if a device misses a critical patch, CounterACT detects the policy violation and automatically cues the patching engine (Microsoft WSUS or SMS) to update the specific system. Often this can be done without the user’s involvement, retaining update report information for future security audits.