EarthLink Protection Control Center 2.0

Faced with new threats, the largest independent ISP in the U.S. upgrades threat prevention with technology from Sana Security.

by Alex Goldman ISP-Planet Managing Editor [January 29, 2007]

Today, Atlanta, Ga.-based EarthLink is announcing an upgrade to its Protection Control Center (PCC) product with the addition of Attack Shield technology provided by San Mateo, Calif.-based Sana Security.

Protection Control Center, originally launched in December of 2005, already had what you'd expect in an ISP security offering: anti-spam, anti-virus, and anti-phishing.

"Our customers have new concerns," explains Ben Kaplan, senior product manager for EarthLink security applications. "Customers are worried about identity theft, for example."

The existing product did not alleviate those fears.

Even worse, it was not superior to the competition. "We saw our security offering as being at parity with the competition," Kaplan says. "With the addition of the Attack Shield technology, we achieve differentiation by adding an active protection layer."

What it does
Sana Security's technology is the only system that removes the problem instead of quarantining it, claims Timothy Eades, Sana Security senior vice president of sales and marketing.

"When you're removing [items from the mail flow], the fear is of false positives," Eades notes. "You want to avoid friendly fire."

The company therefore works hard on avoiding false positives, and claims a false positive rate of 0.03 percent (that's 3 in every 10,000). The technology is supplemented by whitelist and blacklist functions. The lists are updated every 90 to 180 days, and are not a core feature, Eades stresses.

The end of signatures
Instead, the core feature is being able to detect malware instantly. He refers us to a Yankee Group report dated January 15, 2007 called "Anti-Virus is Dead; Long Live Anti-Malware."

The report says that the traditional anti-virus system, which is based on virus signatures, cannot react quickly enough to threats and cannot react to threats which affect thousands of users but not millions of users. More importantly, signature databases are becoming too big. "The signature files of the market leading anti-virus product that Yankee Group uses, for example, exceed 9 MB, encompassing 200,000 signatures. Full disk scans of a typical PC's 100,000-plus files exceed 90 minutes."

Instead the report recommends two technologies: behavior blocking and herd intelligence. Behavior blocking is technology that monitors an operating system and prevents applications from doing things they shouldn't do, and herd intelligence uses the experience of thousands or hundreds of thousands of users to find dangers that affect very few users.

The report commends Sana Security for its behavior blocking technology and Prevx for its herd intelligence technology.

EarthLink uses Brightmail, and also Symantec anti-virus.

"When you install Symantec on your computer, it will tell you to get rid of McAfee, which is not easy to do," says Eades. "We don't do that."

You complement anti-virus software? "We argue that anti-virus is not sufficient on its own," says Eades.

He adds that the Sana Security technology provides additional benefits, such as automated rootkit removal.

Pricing
EarthLink's Protection Control Center (PCC) with Active Shield is available now. It provided for free to EarthLink members and for $36 per year or $3.95 per month to subscribers of other ISPs.

EarthLink can also provide the Active Shield component by itself (for those who already have anti-virus, anti-spam, and anti-phishing) for $24.95 per year.

Active Shield is offered to customers of EarthLink's lower priced brand, PeoplePC, for $2.95 per month or $24.95 per year.

— End