New Top Layer IPS Device Keeps Close Eye On The Firewall

The Attack Mitigator IPS 5500 device, based on an ASIC-based architecture, sits behind the firewall to inspect traffic and block cyberthreats that the firewall might have allowed through. The new 5500 device moves beyond blocking denial-of-service attacks and HTTP worms to also inspect applications such as e-mail and FTP files.

"Firewalls have allowed many worms to go through to the Web server," said Michael Paquette, vice president of marketing and product management at Top Layer, Westboro, Mass. "Our product sits behind the firewall and closely checks what the firewall allows through."

Attack Mitigator 5500 processes 60,000 transactions per second and operates at speeds of up to 2 Gbps, Paquette said.

By using deep-packet inspection called Top-Inspect technology, as well as anti-denial-of-service processes and comparisons against databases of known attacks, Attack Mitigator identifies and disarms threats not seen by the firewall, he said.

Attack Mitigator is designed to reside not only behind the firewall, but also close to critical assets such as applications to protect against external and internal threats, he said.

"I think our customers are going to migrate to the new Mitigator 5500 because now with the application layer covered they won't have to buy multiple boxes," said Adam Lukaszuk, senior technical consultant for security solution provider Edgetech Services, Toronto. "The ASIC architecture they have developed is also appealing because it reads the traffic and flow going through and determines whether it's malicious or legitimate, which cuts down on false positives,a major headache for enterprises."

Attack Mitigator IPS 5500 will be available in three flavors,a 100-Mbit version, 500-Mbit version and 1,000-Gbit version. The product is being beta-tested by customers and will be available in the first quarter of 2004. Pricing is not yet available.