EdgeWave iPrism Technology
Security of a high-performance appliance and the flexibility and scalability of a feature-rich, software-based solution

Kernel-Level Filtering:

iPrism Web Security uses FreeBSD as the basis for its hardened and optimized operating system. FreeBSD was chosen because it offers better performance and more security and compatibility features than many other operating systems in use today.

Because iPrism Web Security has its own OS, it can provide complete interoperability with any platform you are using. By employing the exceptional stability of the FreeBSD OS, we have built a Web security solution that is customized and configured to run uninterrupted on our h-Series appliances, ensuring continuous Web filtering protection from the moment of deployment. Also, as a completely self-contained solution, iPrism Web Security is transparent to the end-user and can be installed into any network without additions to workstations or any added software.

Neither network architecture changes nor alterations to existing firewalls and/or routers are required to operate the iPrism Web Security solution in its most common installation, transparent bridge mode. Operating in the less common proxy mode requires minor modifications to network routers and a slightly longer installation time. However, we offer IT administrators the option of multiple deployment modes making it one of the most flexible and extensible Web filtering solutions on the market.

Kernel-Level URL Filtering Technology

iPrism Web Security's software is compiled into the FreeBSD OS at the kernel level to deliver near zero-latency URL filtering with 100% traffic inspection and enforcement. Unlike many other URL filtering solutions that process requests from the application layer, our content filtering gives you the speed of pass-by with the accuracy of pass-through technologies. When combined with the speed of the h-Series appliances, the performance is unrivalled.

In transparent bridge mode, which is the standard deployment, requests for the Internet pass through the iPrism Web filter and go to the Internet. While this is taking place, the Web filter is making a decision on whether or not to block the requested URL. As the URL request returns from the Internet, if the Web filter is configured to block the website, the user is redirected to an announcement that the page has been blocked and the request itself is discarded. If the site is allowed, then the URL filter allows the site to be passed back to the user.

Since the URL filtering decision is being made while the remote site is working on the URL request, the Web filter is able to process URL requests with no apparent network slowdown. For users, this means less frustration, fewer help desk calls and more efficiency in enforcing your corporate AUP.

iPrism Delivers Hack-Proof Security

Another advantage of a hardened and optimized OS is security. iPrism Web Security is commonly installed between your firewall and internal systems with all Internet traffic routed through it. This positions the iPrism solution as your strongest defense against Internet-based threats.

iPrism Delivers Hassle-Free System Upgrades

Another advantage of the integrated OS and software, is that administrators do not need to manage OS and software updates separately, which often require more tedious technical tasks and more time.

Policy Engines:

iPrism Web Security offers flexible policy rulesets that allow you to manage your acceptable use and security policies with accuracy and granularity. It enables you to log both Web and application activity on your network and protect against security threats while minimizing productivity loss, mitigating bandwidth degradation and assuring your organization's compliance with regulatory requirements.

Web-Based Categories

iPrism Web Security is the only Internet filtering solution on the market that uses a one-hundred percent human-reviewed ratings database, known as iGuard. Powered by a team of trained analysts and iPrism automated rating protocol (iARP™), iPrism delivers over 99% Web coverage with near 100% accuracy of the 10-20 million most frequently visited websites. Unlike other solutions that focus on rating quantity over quality, this minimizes false positives and assures that each site rated by iGuard has a higher degree of accuracy when compared to heuristic analysis or blended classification technologies, resulting in better enforcement of your acceptable use policy and increased ability to mitigate risks.

iGuard Analyst Team
A team of multi-lingual web content experts rates sites by domain, specific URL and/or general IP address into 70 categories using documented detailed criteria that also allows the creation of custom local categories for flexible policy setting. You receive daily database updates and hourly updates on sites that have contain security risks such as botnets, spyware, malware, and phishing. In addition to the typical categories for restricting access to adult content, gambling, dating and the like, iGuard also categorizes websites that offer anonymous browsing, so users can't avoid policy enforcement through circumvention; malware sites, to keep users from having their computers infected; and web-based email and IM sites so you can control personal email and IM use, if necessary.

Automated Rating Protocol
Another tool for defending against anonymous browsing is the proprietary iPrism Automated Rating Protocol (iARP™) feature. This adds more protection by compiling unrated URLs, accessed by your employees, and sending them to the iGuard team where they are analyzed, categorized and returned to your iPrism with your daily or hourly database updates.
Learn more about iGuard

Dynamically-Detected Ratings

Award-Winning Inbound Malware Protection
iPrism Web Security offers onboard Antivirus with detection capabilities that have won awards from leading certification authorities, including VB 100, West Coast Labs and ICS. Even if you are already using an antivirus solution, our antivirus adds another layer of security by scanning all incoming HTTP traffic and blocking malware before it can reach your end-users.

Anonymous Proxy Detection
Anonymous proxy sites are pervasive and easy to build. The Internet landscape is littered with sites that offer proxy site-building scripts and instructions for enabling them via free hosting services. The frequency with which purveyors of this circumvention technique are able to erect these sites has made the conventional defenses of many Web security solutions ineffective. As soon as one site is located and blocked, another one emerges. iPrism's dynamic script-based (i.e. PHProxy, CGIProxy) proxy site detection helps thwart these circumvention attempts by identifying proxy sites on the fly, giving you much better defense against this difficult threat.
Learn more about Anonymous Proxies

Non-Web Applications & Protocols

iPrism Leverages the Botnet Threat Index
iPrism Web Security leverages its unique botnet technology to prevent bots from 'phoning home' by contacting command and control hosts outside your network. Once a bot has been detected and blocked, administrators can be alerted via Email Alerts or Real-Time Monitor so they can later remediate compromised endpoints with the security of knowing that the immediate threat has been mitigated. iPrism on-box reporting will show compliance with regulations that protect users' identities and data.
Learn more about Outbound Anti-botnets

EdgeWave Circumvention Defense Network
iPrism's new Circumvention Defense Network blocks attempts by client-side circumvention tools to connect to their network of proxy or re-routing servers, rendering them harmless and protecting your organization from the damage circumvention can cause including regulatory compliance infractions, data leakage and exposing your network to security breaches. Once the circumvention threat has been blocked, iPrism's Email Alerts and Real-Time Monitor features can be used to address the transgressors and take more serious action if required. iPrism's historical reporting features can document that regulatory compliance, your acceptable use policy and security policies are being enforced.
Learn more about Circumvention Defense

Protocol Pattern Detections
Detects 10s of client-side applications (potentially 100s of different versions) sharing a standard protocol for comprehensive application control including IM, P2P and FTP protocols:

• Instant Messaging (IM) application protocols over any port including Skype
• Peer-to-Peer (P2P) application protocols over any port
• File Transfer Protocol (FTP) over any port

iGuard:

Flexible Policy Enforcement
The iGuard team is an experienced group of multi-lingual web content experts, who rate sites by domain, specific URL and/or general IP address into 80 categories, using documented, detailed criteria that also allow the creation of custom local categories for flexible policy setting. You receive daily database updates and hourly updates on sites that contain security risks such as botnets, spyware, malware, and phishing. In addition to the typical categories for restricting access to adult content, gambling, dating and the like, iGuard also categorizes websites that offer anonymous browsing, so users can't avoid policy enforcement through circumvention; malware sites, to keep users from having their computers infected; and web-based email and IM sites so you can control personal email and IM use, if necessary.

Automated Rating Protocol
Another tool for defending against anonymous browsing is the proprietary iPrism Automated Rating Protocol (iARP™) feature. This adds more protection by compiling unrated URLs, accessed by your employees, and sending them to the iGuard team where they are analyzed, categorized and returned to your iPrism with your daily or hourly database updates.

• iARP customizes the iGuard database for your organization by adding the unfiltered URLs employees use every day
• It allows you to add URLs automatically, eliminating the need to manually submit URLs you want to include in your database
• Insures that if a site cannot be rated using iARP, your administrator can rate it using Filter Mana

With iPrism's 100% human-reviewed analysis of anonymous proxies, and iARP feedback, false positives are virtually eliminated and there's no need to over-block unrated sites.

Circumvention Defense:

iPrism Exclusive Feature is a Website Blocker for Circumvention Attempts
iPrism's exclusive Circumvention Defense Network is an Internet site blocker that stops attempts by circumvention tools to connect to their network proxy or re-routing servers, rendering them harmless and protecting your organization

iPrism is the Website Blocker that Stops Hard to Detect Circumvention Tools
Employees or students trying to circumvent your network have a number of new tools at their disposal. Most of them are client-side applications that are hard to detect for any Website blocker solution, because new versions are constantly being released, which will change their communication behaviors. If you are wondering how to block internet sites that host these tools, they work by connecting to a growing number of externally-hosted servers that proxy or re-route the original Web request, evading your Internet site blocker and allowing anonymous browsing and its inherent risks such as exposing corporate networks to malware and data loss. Because these circumvention tools are changing so fast, it's almost impossible for any IT administrator trying to block these internet sites to keep up.

iPrism Demonstrates How to block internet sites with Superior Anti-Circumvention Technology
iPrism's new Circumvention Defense Network is a website blocker that stops attempts by circumvention tools to connect to their network proxy or re-routing servers, rendering them harmless and protecting your organization. Once iPrism determines that the circumvention threat has been detected, iPrism's Email Alerts and Real-Time Monitor features can be used to block the internet sites and take more serious action if required. iPrism's historical reporting features can document website blocker activity that regulatory compliance, your acceptable use policy and security policies are being enforced.

CDN Can Block Internet Sites that Host Circumvention Tools for Immediate Protection
EdgeWave Leverages hundreds of frequently-reset virtual machines that are hosted in our scalable cloud data center to detect thousands of externally-hosted non-web servers used by various circumvention sites. To enable our website blocker, we then correlate and filter these IP addresses against those shared with known legitimate websites to eliminate false positives. The results are synchronized with your on-premises iPrism and you get immediate protection to block the internet sites detected. This transparent process enables iPrism to inspect outbound traffic and apply a website blocker, preventing circumvention tools from connecting to their server networks outside. Currently, the iPrism circumvention website blocker feature monitors and blocks UltraSurf, Tor and JAP. However, new circumvention attempts are continuously being detected in the cloud, so your iPrism Website blocker capabilities can stay ahead of emerging threats.

Anonymous Proxies:

iPrism protects against attempts to circumvent your network Internet security via browser-based anonymous proxy detection. Circumventing your network Internet security can be attempted in a variety of ways, including by accessing anonymous proxies. This occurs when a user goes outside your network to connect with a privately hosted proxy server. Detection of these servers is the first step in protecting your network but without an integrated solution for proxy server detection, your IT administrator may spend many hours manually monitoring and blocking these proxy sites in order to protect your organization from the risks associated with anonymous browsing.

iPrism defends against Internet access via browser-based anonymous proxies with a multi-layered approach that includes both real-time methods to detect proxy settings and automatic proxy detection. iPrism conserves your IT resources while effectively protecting your network.

Dynamically Detected Proxies

Anonymous proxy sites are pervasive and easy to build. The Internet landscape is littered with sites that offer proxy site-building scripts and instructions for enabling them via free hosting services. The frequency with which purveyors of this circumvention technique are able to erect these sites has made the conventional defenses of many Web security solutions ineffective. As soon as one site is located and blocked, another one emerges. iPrism's dynamic script-based (i.e. PHProxy, CGIProxy) proxy site detection helps thwart these circumvention attempts by identifying proxy sites on the fly, giving you much better defense against this difficult threat.

iGuard and iARP

iPrism's iGuard database is manned by dedicated analysts who scour frequently-updated sources of anonymous proxies such as forums and other sites, adding their findings to our URL database. This security category is updated hourly and can be enabled on your iPrism via a simple "set and forget" check box.

Another tool for defending against anonymous browsing is the iPrism proprietary Automated Rating Protocol (iARP™) feature. This adds more protection by compiling unrated URLs, accessed by your employees, and sending them to the iGuard team where they are analyzed, categorized and returned to your iPrism with your daily or hourly database updates.

With iPrism's 100% human-reviewed analysis of anonymous proxies, and iARP feedback, false positives are virtually eliminated and there's no need to over-block unrated sites.

Botnet Defense:

iPrism Web and ePrism Messaging Security Solutions provide malware and virus protection including defense against dangerous botnets. EdgeWave solutions offer virus and malware protection with both inbound and outbound filtering of Internet and email traffic. iPrism leverages our powerful and unique malware protection technology, to provide continuous outbound protection, while ePrism Email Security provides both inbound and outbound botnet protection with exclusive zero-minute defense and its outbound malware protection technology.

Botnets are Pervasive and Dangerous

Among virus and malware protection efforts, bot defense can be the most challenging. Bots are autonomous applications that gain access to your network and can stay hidden for weeks. They can invade any OS, including Windows and malware protection used by most companies may not detect them. Once they 'phone home' to command and control outside your network, they join together with other computers to form botnets. These hijacked computers are called zombies and most traditional malware protection solutions are ineffective against them.

Botnet invasions can have serious consequences including:

• Financial loss, including regulatory non-compliance fines and litigation associated with the theft of sensitive customer/client/patient data or intellectual property leakage
• Damage to ereputation from phishing sites or proxy nets
• The hassle and cost of having to take preventive measure in the case of click fraud, DDoS and SPAM
• The cost of procuring and implementing multiple solutions to detect or prevent compromised endpoints as recommended by many IT security vendors
• The costs associated with acquiring expensive startup anti-botnet appliances

iPrism Web Security Leverages Unique Botnet Threat Technology

At the core of iPrism's malware protection center, is our exclusive botnet threat technology that prevents bots from 'phoning home'. Once a bot has been detected and blocked, users are alerted via email and Real-Time Monitor so they can remediate compromised endpoints. iPrism on-box reporting will show compliance with regulations that protect users' identities and data. You get constant botnet malware protection because the botnet threat index, provides real-time updates to stop new botnet threats. The iPrism threat index has no false-positives and performs without incurring any network latency.

ePrism Email Security has Virus and Malware Protection on Inbound and Outbound Mail Streams

Outbound Botnet Malware Protection
ePrism provides malware and virus protection of your outbound traffic by identifying computers that have been surreptitiously converted to a "zombie" network or botnet client. ePrism blocks any outbound spam and malicious email attempts for complete malware and virus protection. It then notifies your network administrator so that zombie computers can be identified and treated for the underlying infection.

Zero-Minute Defense for Inbound Botnet Malware Protectio
ePrism Email Security's Zero-Minute-Defense is based on real-time knowledge that offers inbound malware and virus protection with the same time-sensitive approach employed by iPrism. Intelligence is gathered from a worldwide sensor network and this information is used to create new detection and protection rules, which are then sent out as updates on a continuous basis. This enables ePrism's malware protection as analysts write rules instantly to block botnet spam at the perimeter. Blocking botnet and other spam assures security, reduces bandwidth use and de-clutters organization mailboxes.

Antivirus:

Award-Winning Free Antivirus Program

iPrism Web Security offers onboard antivirus programs with detection capabilities that have won awards from leading certification authorities, including VB 100, West Coast Labs and ICS. This makes iPrism antivirus one of the top antivirus programs on the market. Even if you are already using one of the many antivirus software programs on the market, our free antivirus program adds another layer of security by scanning all incoming HTTP traffic and blocking malware before it can reach your end-users. Our antivirus program's engine employs port-agnostic real-time scanning of web traffic for threats, known and unknown, on all allowed web pages using a unique four-factored system for dynamically detecting and blocking Internet-based viruses, worms and other malware. Our four-factored antivirus program's technology includes:

• A massive antivirus signature database that's updated every 15 minutes
• Advanced Heuristics, found only in top antivirus programs, that helps limit the size of antivirus definition files and keeps iPrism ahead of virus creators.
• Emulation that simulates execution of a program to detect the Windows operating system, calls the program attempts. This allows the antivirus program's engine to identify malicious behavior in a safe environment separate from the host operating system.
• Neural Network Detection that works intelligently, learning from the behaviors and characteristics of identified malware code to identify and block new threats. Antivirus programs reviews are excellent for this advanced feature.

The iPrism Antivurus Software Program's an "on-box" feature, meaning simple deployment and management, and no extra hardware is required.