Hi orda,
this description from the first article:
"What Lynn refers to as "active defenses" were pioneered by the National Security Agency. In an essay last year, Lynn likened them to a cross between a "sentry" and a "sharpshooter" that can also "hunt within" a network for malicious code or an intruder who managed to penetrate the network's perimeter".
That outline does not fit into my understanding of what Wave's products can do. Especially the "hunt within a network”.
I like the active defense part in that Wave's End Point Enforcer could check the device trying to access the corporate virtual private network (VPN)and check for appropriate PKI Certificates/health status/network access control policies etc. but the "hunting within a network for malicious code sounds like a "Deep Packet" analysis program.
Main article: NSA warrantless surveillance controversy
The National Security Agency (NSA), with cooperation from AT&T has used Deep Packet Inspection technology to make internet traffic surveillance, sorting and forwarding more intelligent. The DPI is used to find which packets are carrying e-mail or a Voice over Internet Protocol (VoIP) phone call.[19] Traffic associated with AT&T’s Common Backbone was "split" between two fibers, dividing the signal so that 50 percent of the signal strength went to each output fiber. One of the output fibers was diverted to a secure room; the other carried communications on to AT&T’s switching equipment. The secure room contained Narus traffic analyzers and logic servers; Narus states that such devices are capable of real-time data collection (recording data for consideration) and capture at 10 gigabits per second. Certain traffic was selected and sent over a dedicated line to a "central location" for analysis. According to Marcus’s affidavit, the diverted traffic "represented all, or substantially all, of AT&T’s peering traffic in the San Francisco Bay area," and thus, "the designers of the ... configuration made no attempt, in terms of location or position of the fiber split, to exclude data sources comprised primarily of domestic data."[20] Narus's Semantic Traffic Analyzer software which runs on IBM or Dell Linux servers, using DPI technology, sorts through IP traffic at 10Gbit/s to pick out specific messages based on a targeted e-mail address, IP address or, in the case of VoIP, phone number.[21] President George W. Bush and Attorney General Alberto R. Gonzales have asserted that they believe the president has the authority to order secret intercepts of telephone and e-mail exchanges between people inside the United States and their contacts abroad without obtaining a FISA warrant.[22]
The Defense Information Systems Agency has developed a sensor platform that uses Deep Packet Inspection
.[23]
http://en.wikipedia.org/wiki/Deep_packet_inspection
| 