Marshal8e6 nabs Avinti for better spam blocking
Gateway runs malware virtually to check nastiness.
By Jeremy Kirk, IDG News Service | Published: 13:47, 14 April 2009
Security vendor Marshal8e6 will buy Avinti, a company which specialises in behavioural technology that scans email and tests malicious content in a virtual machine.
Avinti, based in Orem, Utah, has one email security product, the iSolation server. When an email with potentially malicious content comes through the gateway, that content is sent to the iSolation server for analysis, said Bradley Anstis, director of technical strategy for Marshal8e6.
The iSolation server doesn't use signatures and relies entirely on observing how malware behaves, Anstis said. That's what made the company attractive to Marshal8e6, he said.
If the email has an attachment that the server has never seen before, it will take the attachment and run it in a virtual machine that is identical to a particular company's corporate desktop setup to see if it exhibits any malicious behaviour, Anstis said. That process takes around 20 seconds and is used for between 5 to 8 percent of attachments, he said.
Alternatively, the iSolation server can scan URLs in messages to see if they point to malicious content.
Marshal8e6 will support the iSolation server for existing customers but will wrap the technology into other products. Marshal8e6 is going to turn iSolation into a cloud-based service.
For example, funny looking links detected by Marshal's on-premises email security product will be sent to the company's data center, where many iSolation servers will run concurrently and test links, Anstis said. Also, the data on malicious links will be shared with Marshal8e6's web filtering product, which stops malware and controls web traffic. Marshal8e6 is planning a formal product announcement next week.
Overall, the percentage of malware spread through email has been on the decline as attackers have increasingly moved to building malicious websites instead, which made Avinti receptive to an acquisition, Anstis said. Security giant Symantec was one investor in Avinti, but apparently passed on buying the company.
At one time Avinti had more than 30 employees but Marshal8e6 will take on four engineers and the company's CEO as a consultant, Anstis said. Avinti has about 60 customers, he said. Terms of the deal were not released.
