Storm watch for your security

As I drove through the hundreds of miles of devastation following the recent hurricane that struck the U.S. east coast, it was clear how important an accurate forecast can be.

It may be easy to dismiss Al Roker as just another Food Network refugee, but it was weather forecasts of unprecedented accuracy, delivered by professionals such as Roker, that helped to minimize loss of life and property when the storm struck.

Unfortunately, until recently you couldn’t find a decent forecast to predict storms that strike your enterprise with depressing regularity — the relentless series of worms, viruses, and other attacks. But things are changing.

I’m testing a service called DeepSight Threat Management System from Symantec that promises to do this type of forecasting. Symantec’s forecasting is similar in concept to global weather forecasting: The company receives reports from the intrusion detection systems and firewalls of thousands of companies around the world, which are analyzed at Symantec’s security center in the United States. Symantec then alerts its subscribers to impending threats, sometimes hours before the news is available to others.

Having this information means DeepSight subscribers can do a few things. First, they have time to make sure their systems are up to date before the worms or viruses arrive or vulnerabilities are exploited. Second, those subscribers have the advanced knowledge necessary to recognize attacks when they arrive and take appropriate action, such as disconnecting potentially vulnerable remote users.

Of course, this wouldn’t be very helpful if getting the information were difficult. Luckily, it’s not. You can choose the products and technologies you have and only receive alerts on those, if you wish. You can also have very serious alerts sent to your pager or cell phone. These broadcasts rival the timeliness of today’s weather forecasting technology.

At this point, I’m pretty excited about DeepSight, but it’s too early to tell if it delivers. You’ll know that when the review shows up in InfoWorld. So far, it appears to be doing fine — I get daily updates on the overall status of threats on the Internet, and on specific threats as details come to light or their rate of infection changes.

Of course, I haven’t pared down the threat list to things that are actually in the lab, so right now I’m getting every alert whether it’s relevant or not. But that will change, I hope. Meanwhile, DeepSight looks like it’s going to be a key tool for long-term protection of the enterprise.