Which is more important to you in a suite?

Given you have a choice, Sandboxing or In The Cloud ability.

Kapersky 2010 has the ability to sandbox, as Prevx will in the fall. Is this more important from a security standpoint or is the ability to scan for new malware with the Cloud ability.

 

Re: Which is more important to you in a suite

If I were to be using a suite, I would have to say Sandboxing in my case. Even with "Cloud" technology, it is still basically scanning for sigs or behaviors. If you are the first one to encounter a new malware you could be comprimised. However with Sandboxing your actual system would be "hopefully" protected by the Sandboxing.

 

Re: Which is more important to you in a suite

I believe both are very important. Kaspersky for example use them both

 

Re: Which is more important to you in a suite

Sandboxing is my choice, but in reality, it boils down to how well either technology is implemented and maintained.

 

Re: Which is more important to you in a suite

I would prefer the sandbox feature.

 

Re: Which is more important to you in a suite

ITC is easily my choice. The one developed by F-Secure

 

Re: Which is more important to you in a suite

sandbox for me cuz i dont trust in the cloud approach mostly.

 

Re: Which is more important to you in a suite

Hi
What is special with F-Secure ITC?

 

Re: Which is more important to you in a suite

The flip of a two headed quarter should be able to determine this "Sandboxing or In The Cloud ability" dilemma for you quite nicely.

If per chance the flip ends up Sandboxing - Well I guess I'm more comfortable.

 

IMHO in the cloud. Because if there's a file I want to save and run ITC is the easier way to confirm if it's safe.

 

For a novice like me? Sandbox.

 

Re: Which is more important to you in a suite

Hi Sjoeii. It's just they were one of the first ones to 'develop' the technology. DeepGuard

 

Not true, I believe Agnitum developed the idea a few years back with firewall permissions, your rule set could be compared against their database and changes could be pushed out if your settings were not safe, I forgot what they called it though, but it isn't a new idea. Hell they might not even have been the first, just the first company i was aware of doing such a thing.

 

I never said that FS created that technology

When it comes to ITC, I trust them better than any other company.

 

Re: Which is more important to you in a suite

aha
You are talking about Deepguard. I heard some great things about it indeed

 

Is there more antivirus going to have sandbox or just Kaspersky

 

Re: Which is more important to you in a suite

Here's a quick overview of it

 

I am afraid but I think ZA was the first to intergrate collective knowledge into a security tool back into 2005...
http://smartdefense.zonealarm.com/tmpl/body/sdservices/sdrc_defense.jsp

 

Sure
Thanks for the link.

 

Re: Which is more important to you in a suite

Hi Macstorm, thanks for the link

 

ImproveNet (http://www.agnitum.com/support/improvenet/description.php). I believe that's what you meant?

 

Trjam,

I do not like the OR.

The ideal "security" application would

Have smart heuristicss/behaviour blocking (like PrevX's AGE/Heuristics option)

Should not bother users with suspicious files, but put them in a quarantaine sandbox, in a transparaent way like DefenseWall does

Next it should gather forensics and check the cloud on the suspisious file, for known malware, like Hitman Pro does

WHen known Malware, blast away the file away, when uncertain run it through automated analysis (like Panda does), when proven good, free it out of the policy quarantain, when malware blow away.

All without bothering the user

Just my 2 cents

 

Kees! I was wondering where you were my friend. As for your response, I totally agree and in the fall Prevx will offer just what you asked for. Ooops, did I say that.

 

Behavior blocking technology is the most interesting for me (Threatfire kind of approach before any other) and my humble opinion is that it is a technology that will mark the next 5-10 years in antimalware software development. If I have to choose between "in the cloud" and "sandbox" as a part of security suite, I choose "in the cloud" because, among other things, it is a question of time when will be a malware that successfully bypass sandbox protection. At that time, everyone of us will need a program that will be able to effectively detects and eliminates malware on the first place.

 

Yep, that's what i meant, couldn't recall the name though. Thanks