Stopping Malware Before It Starts

While the product is now available for Internet service providers, an enterprise version that works with private networks should be available by next summer.

Simplicita ZBX is actually made of up three components that together create a tight ID and quarantine system. (See screen shot below.) First, the Reputation Knowledge Server creates a list of IPs that are known to send malware. To gather this, the company relies heavily on the unsung work of the Shadowserver Foundation, which complies databases of harmful Internet activity.

The Reputation Knowledge Server passes information to the DSN Traffic Switch, which blocks access to malicious sites. Previous efforts at controlling the problem have relied on individual users downloading and installing anti-virus programs. But administrators can't hope for full compliance, so it's more effective to simply block access to known trouble spots.

When a computer is infected with malware or when it attempts to access a suspicious site, the third component, the Walled Garden Server, comes into play. If the user has a corrupted machine, this server can provide access to software downloads that can clean it, or provide a link to technical help.

If the user was trying to access a known malware provider, this page could explain why the connection can't be made.

You can see an example of Simplicita ZBX's warning page, which tells users how to fix their computers, in this screen shot.