Check Point Offers Protection From App-Level Attacks

Called Application Intelligence, the technology will be incorporated into the company's flagship FireWall-1 Next Generation with Smart Defense.

While firewalls provide access control at the network level, malicious hackers are launching attacks against applications that firewalls are configured to allow, such as Web applications, said Mark Kraynak, strategic marketing manager at Check Point, based here.

"Security needs to be enforced at the application level in order to protect customers from that new set of threats," he said.

Application Intelligence, which builds on the capabilities of the Smart Defense attack blocking technology Check Point released a year ago, detects and prevents attacks at the application level by inspecting traffic to see if it complies with relevant protocol standards and expected usage. The software also blocks applications' ability to carry malicious data and controls application-layer operations.

By providing an integrated product for network-level and application-level protection, Check Point's new solution provides lower cost of ownership for companies, which are buying separate products to protect applications, Kraynak said.

"This will reduce the need for a third-party application security proxy. Overall, it's going to reduce customers' costs because they won't have to spend money on that third-party proxy server," said Frank Darden, CTO of Mission Critical Systems, a Fort Lauderdale, Fla.-based security solution provider. "And all of the protection is in a centralized area they can control and manage," he said.

Application Intelligence has the ability to control and block peer-to-peer applications such as Kazaa as well as instant-messaging programs, which is significant, Darden said. "We get calls every day from customers asking how they can block those things, and there hasn't been a good answer until now," he said.

Slated for availability June 3, Application Intelligence is included in Smart Defense, which comes with FireWall-1 so no separate license is required. Check Point charges an annual subscription for new attack signatures and other updates.