Trilight Zone

[tricore]

Network Associates Inc. and Symantec Corp. have developed automated signature-delivery technologies they say should help head off the outbreak of fast-moving viruses such as Klez and Nimda.

Network Associates' McAfee Security division next week will unveil the latest version of its VirusScan ASaP managed anti-virus service, which includes an improved peer-to-peer delivery system that enables companies to push updates to PCs not connected to the Internet.

Called Internet Independent Updating, the functionality is designed for organizations such as bank branches, hospitals and government agencies that have large numbers of computers on a corporate network that aren't connected to the Internet.

Upon boot-up of one of those computers, a Virus- Scan ASaP agent automatically searches the subnetwork on which that machine resides for an Internet-connected PC, said McAfee officials in Santa Clara, Calif.


The connected PC then acts as a network proxy for the unconnected machine by downloading any new virus definitions from the VirusScan ASaP Web site to the unconnected computer.

This not only reduces the workload for administrators but also allays fears they might have about isolated machines not receiving updates and being vulnerable to malicious code, customers say.

"Before, it was just horrible," said Richard Underwood, senior systems engineer at Chaparral Energy Inc., based in Oklahoma City, Okla. Chaparral has been beta testing the new version of VirusScan ASaP. "Keeping our PCs current was a nightmare," Underwood said. "Losing a day's worth of work to clean up the Melissa virus, for example, isn't an option. The full deployment will have a lot more benefits."

The new version of VirusScan ASaP, due June 21, also includes functionality for remote users who will check for new virus definitions every time they connect to the network. Previously, dial-up users had to check for updates manually, something that many often forgot to do, administrators said.

For its part, Symantec is working on expanding its Live Update automated service. The company has traditionally used Live Update to deliver virus signatures to customers of its Norton AntiVirus. But the company is working on features that will enable customers to get automated updates for Symantec's vulnerability management and intrusion detection products as well.

Company officials in Cupertino, Calif., said such new functionality is one of the keys to Symantec's strategy of an integrated security suite and response system.

"The Live Update automation is one of the main reasons customers come to us," said Gail Hamilton, executive vice president of product delivery and response at Symantec. "We want to integrate so that you can get all of the updates with one button."