Websense's Dynamic Protection against Web Malware

[jwolach]

Yesterday, one of my customers asked me if PAN has or is working on a feature like Websense's Dynamic Protection against Web Malware. Supposedly, Websense customers are protected against known web sites that get attacked and compromised, by automatically blocking them in their ThreatSeeker Network. The example the customer used was when Google got hacked & compromised.  They said that Websense sent out an alert and then blocked Google in there master database until everything was okay and then automatically unblocked it. Apparently, Websense promotes this feature to their customers.

Does Brightcloud have a similar feature?

Thanks,
Jeff

[networkadmin]

On the PAN side of things there is a "dynamic updates" option, but I too would be interested to know a bit more about how it works.

I'm assuming, using Google as the example that you've given, that if someone wants to visit Google than the PAN would first check its internal Brightcloud database and only uses the dynamic lookup for sites it doesn't have listed?

[pantac]

Jeff,

From the many articles I have read on this, the attack on Google was a classic case of an advanced persistent threat in which an unknown vulnerability in IE6 was used to give the attackers access to the users Gmail account.  So there is a bit of exageration on the websense side.

Now on to the question. Yes, our DB does have "known malware sites" category that you can block. Using the threat prevention capabilities, you can then apply threat prevention to the allowed web traffic.

Relative to the specific dynamic threat feature, we can arrange for a call with prod mgmt if you think it is warranted.

Matt