SBC launches network intrusion detection service

SBC Communications is moving into the network security realm with a managed intrusion detection service that constantly monitors network traffic patterns and behavior to detect worms, viruses and other malicious activity.

The SBC PremierSERV Managed Security Services offering is a major step forward in the data service world for SBC. Using a Mirage Networks counterpoint device installed at the customer premises, behind the enterprise firewall, the service is able to look for traffic patterns that typically denote problems and respond in real-time, based on parameters pre-set by the customer. Because its detection is based on network activity, it is able to identify problems that may not yet be known, named and addressed by other security solutions.

"For example, the service would look for a device that has an IP address assigned to it, but is asking for another one, because that's what a worm does," said Rick King, director of managed services for SBC. "We drop the [Mirage] device on the customer's LAN--a single device can handle 1000 computers--and because it is on the trusted side of the network, behind the firewall, it can look for behavior that is not good."

SBC Managed IPS will also be on the lookout for unusual broadcast messaging or peer-to-peer traffic, he added.

The service, which costs several hundred dollars a month, is aimed at enterprise customers and does not replace either anti-virus software or firewalls, King stressed.

"This is complementary to those things," he commented.

Corporate customers list security among their top concerns in SBC's market research, King said, in part because they face such a variety of potential threats.

"New threats come out all the time that make it through a firewall or anti-virus software," he said. "A single employee can bring a virus into a network on an infected laptop, plug it into the network and cause all kinds of problems."

The SBC Managed IPS offers customers a range of real-time response options.

"What happens is, we come in, and we'll work with the customer to establish a security policy," said King. "We have the ability to be more or less aggressive in the traffic that we lock down on a network. At its simplest form, we can just monitor or alarm--the service can detect but not take any automatic mediation. At the other extreme, we can configure the network so that as soon as network problem is identified, we take the port of that PC out of the network."

SBC also can set the system up to temporarily keep the offensive computer out of the network for up to 15 minutes and will contact the customer via phone, e-mail or page and let them help decide how to respond from there. The Managed IPS is SBC's latest effort to develop a tighter relationship with its enterprise data customers, King said. The company now has a portfolio of managed services that includes: firewall, virus scanning, content filtering and vulnerability scanning.

The "soft launch" of the product already landed 22 customers, prior to making SBC Managed IPS generally available, King said.