Monday, January 29, 2007

How Agnitum Will Protect You in 2007

After we announced Outpost Security Suite Pro in January’s Agnitum Directions, we received a huge number of comments and questions from our users.

In today’s blog post, I am going to cover the most common questions we’ve received, along with our vision for how Agnitum will be helping you protect your computers in 2007 and beyond.

But let me start with users and their needs, not products and their features.

Broadly speaking, there are two types of user when it comes to Internet Security:

  • People looking for an all-in-one solution
  • People looking for individual best-of-breed solutions

While both types of user are obviously looking for robust security, the former clearly places a greater emphasis on convenience and ease of use. The latter is probably more technically inclined and prefers to implement ‘best-of-breed’ solutions in each category (firewall, antivirus, antispyware, antispam, etc) in order to maximize their online protection.

It is worth noting that in each group there are users with both basic and advanced levels of computer knowledge and security awareness. It is just that one group is looking for a fast and convenient solution, while the other group is ready to sacrifice their time to find and test different solutions and figure out how to get all the components to work together.

It’s clear that market trends are tending towards the provision of all-in-one solutions, so we ambitiously took on the goal of developing a product that combines individual best-of-breed products into a time-saving suite.

Outpost Security Suite Pro
Outpost Security Suite Pro product will provide firewall, anti-virus and anti-spyware (in one anti-malware module), proactive protection, and a spam filter. Many fans of Outpost Firewall Pro expressed concern that Agnitum was simply jumping on the bandwagon, and that any suite would be just another “me too” product. The major question was “Why did you decide to create your own security suite?”

Three reasons come to mind:

Compatibility issues
Although the concept of using different best-of-breed products for optimal security is reasonable, it has not proved successful in the face of constantly developing new threats. Historically, most security software vendors (including Agnitum) improved their protection by adding new security features.

This approach frequently resulted in incompatibility between firewalls, antivirus and antispyware software once these products begun to perform the same security measures. This means that the same system events are being monitored by the firewall, the proactive protection, the antivirus and antispyware, leading to system slowdowns and memory overloads due to several security applications running rather than just one. And it’s no surprise that vendors failed to provide 100% compatibility between their products.

As a result, it is becoming more and more difficult to find a combination of best-of-breed products that will play happily together without turning off some important security features in each program.

With the continuing appearance of new threats and the consequent appearance of new products to defeat those threats, it’s clear that incompatibility issues will continue to arise, making it less and less likely that high levels of security can be provided by the use of multiple products from multiple vendors.

Time is money
Best-of-breed security can be an expensive exercise when you’re buying standalone solutions from different vendors, but it can be justified if better security results. However, this argument ignores the cost of the extra time you spend. Time to install, learn how to use, configure, update, and schedule.

Even when you’ve found the best applications for your needs in each category, chances are they won’t work together well without some tweaking, so you’ll have to spend more time figuring out how to solve incompatibility issues. And of course, when the next update for any one of the programs appears, new incompatibilities are likely to arise.

Incompatible approaches to security
As we’ve already seen, even the best combination of standalone security solutions is becoming increasingly inconvenient and inflexible in the face of rapidly changing threats.

So to keep our users protected, we’ve been gradually incorporating additional functionality into our core Outpost Firewall Pro product, adding anti-spyware to Outpost 3.0 to detect and remove spyware, Trojans and keyloggers and anti-leak capabilities to Outpost 4.0 to proactively block malware from trying to send data out from users’ computers to third parties.

And that is why we are now planning to provide all-in-one protection for our users.

But Outpost Security Suite Pro will not be another “me too” product. It’s based on best-in-breed firewall and proactive security engines, which means that, unlike existing suites, Outpost Pro is focused on preventing the problem in the first place and only after that to use reactive security measures like signature-based antivirus and antispyware.

Release Schedule
We are planning to release two versions of Outpost Security Suite Pro. The first version is intended for Windows XP systems and is already in beta testing; as soon as possible after that, we plan to ship a Vista-compatible product.

Best-of-breed personal firewall
Some Outpost Firewall Pro users have expressed their concern that Agnitum might discontinue the standalone firewall product. Let me reassure you that Outpost Firewall Pro will continue to be available as a standalone product for as long as we have customers wanting to buy it and users wanting to stick with it. Our customers’ wishes are paramount.

Remember, we are already investing a lot of resources in developing a Vista-compatible version of the standalone firewall, so that users migrating to the new operating system will have adequate firewall protection. We are also creating a new interface to meet the latest usability standards. And there’s a long wishlist of features in our development department, just waiting for our engineers to implement them.

So we are always here for those users looking for the best firewall, regardless of whose anti-virus or anti-spyware they prefer to use.

Easy to use spam filter
Before closing, I should also mention our other new product – Agnitum Spam Terrier. We are very excited about this effective little spam filter – as are those people who’ve already started to use it, especially as it’s free, so everyone will be able to benefit from it.

The first version works as a plug-in for Outlook and Outlook Express email clients, and in the future we will likely add support for other email software.

Taking care of your security in 2007
It’s always been our goal to provide our users with the most technically robust security protection without sacrificing ease of use, and our 2007 plans follow this goal perfectly:

  • Providing all-in-one security with new Outpost Security Suite Pro;
  • Providing best-of-breed standalone protection with Outpost Pro Firewall;
  • Providing accessible spam defenses with Spam Terrier Free

As always, we welcome your suggestions, comments, and criticism – so please post your thoughts on our 2007 plans here!


Mikhail Penkovsky
Global Vice President of Sales and Marketing
Agnitum Ltd.

Tuesday, January 23, 2007

Outpost 4.0 Vulnerability Update

David Matousek released on 15 January 2007 details of an exploit that disables self-protection in Outpost Firewall Pro. Virus Bulletin published coverage of the exploit on 17 January 2007. See this link and this link for additional information.

Agnitum is aware of this issue and working on a fix for users that will be available before the end of this month.

However, there is more to this story.

Matousec.com, the site that announced the vulnerability, was founded by David MatouĊĦek in March 2006 and comprises a "small group of young people, mostly university students, who are interested in the Internet, security and other computer related topics". Unfortunately, while the group clearly has some understanding of technical security issues, they appear not to have grasped the commonly-accepted ethical principles of the information security business.

After testing Outpost Firewall Pro 4.0, Mr Matousek contacted Agnitum and suggested that we pay for a report on the issues (http://www.matousec.com/purchase.php) he discovered in Outpost Firewall. In our opinion, this is tantamount to blackmail, and so we declined to pay.

It is a generally accepted principle in the security community that, when a software vulnerability is discovered, the discoverer contacts the vendor and freely provides them with sufficient information to enable them to identify and repair that vulnerability. We were therefore taken by surprise when Mr Matousek took it upon himself to publish details of the Outpost vulnerability without giving us the wherewithal to address the issue directly and protect our customers.

This would seem to be in direct contravention of the group’s claim that their goal is to improve end-user security

Moreover it is a breach of common industry practices such as those cited at:

So, unlike other researchers, Matousek appears to be trying to gain some kind of promotion for themselves by posting the bugs without informing vendors beforehand

Second, Matousec tested Outpost only after he first modified the sandbox.sys module in Outpost (BTP00003P004AO.zip). This is a violation of the End-User-License-Agreement (EULA) and International Copyright Treaties.

As for the vulnerability itself, yes, it may become a risk if the user is logged in with administrative privileges and launches an unknown application that is actually a malicious script. But in this case, the user would be vulnerable no matter what security programs that user is running as intruders can use this type of code to perform almost any kind of malicious activity on a victim’s computer.

In any case, I would just like to re-emphasize that we take the security of our end users extremely seriously, and a bug-fix release dealing with this issue will be issued within the next two weeks.


Mikhail Zakhryapin
President & CEO, Agnitum Ltd.

Wednesday, January 17, 2007

Read our analysis of Vista Firewall in the latest Security Insight

In the run-up to the launch of the consumer version of Vista, we conducted a small preliminary analysis of Vista's improved firewall and concluded that it's no match for a dedicated third-party solution. Read on - and please feel free to share your thoughts below.

Best regards,
Igor Pankov