Secure AppGuard can help defend against unknown threats

Everyone knows how it works. A cop pulls someone over for a traffic violation, gets the driver’s identification and runs the name through the computer system to see if there are any outstanding warrants. Traditional antivirus and anti-malware protection works the same way. Known criminals, or viruses, are apprehended and taken away to where they can’t do any more harm.

But what if it were a new virus with a clean record? It would be like a cop pulling someone over, getting the identification, and finding that they have never committed a crime before. Except it could be worse. Traditional antivirus software would ignore the fact that the suspect is covered in blood and the back of the car is filled with sacks of money. As long as the driver’s identification doesn’t match the profile of a known criminal, he would be sent on his way. In the malware world, that is how a lot of unknown programs end up doing considerable damage before they are finally caught.

The AppGuard Enterprise program from Blue Ridge Networks looks at the characteristics of typical malware and viruses and stops bad behaviors instead of looking at known signatures. If you have it running on a system, you will still need traditional antivirus software as part of your protection scheme, but AppGuard can provide a safety net to stop the latest threats that normal protection misses.

AppGuard prevents programs coming into a system from outside from doing certain tasks or accessing certain areas within your computer. It doesn’t matter if this is a new exploit just created by a hacker to get through the natural defenses of an operating system or an existing bug that your antivirus hasn’t yet patched. Because even if a malicious program gets through, it still won’t be able to do anything bad on a system protected by AppGuard.

AppGuard locks down common malware targets, such as the system root directory, the HKLM Registry Hives and the HKCU Run / RunOnce command. This protection extends to program executables that try to launch from a flash drive or other connected storage device.

However, the software ignores programs that are already on your system. When installed, the AppGuard program assumes that anything already sitting on your machine is a valid application, otherwise you wouldn’t be able to run common programs such as Word without the AppGuard software blocking some component of the application. That isn’t really a negative, just a necessary factor that happens when you have virus protection that doesn’t rely on signatures. AppGuard fits best as a catch-all behind standard antivirus protection.

AppGuard really shines when you have a new virus that has not been cataloged by antivirus software or when a virus might be known by the antivirus software but your local machine has not updated its virus definitions before an attack. Depending on how much a user goes online, these zero-day outbreaks can be dangerous without protection in place.

To test AppGuard, we infected a test Web site with malicious code that was pretty new because we just recently wrote it. And we didn’t install any antivirus protection on our test system, though this is not recommended outside of a closed test. The AppGuard stopped our executable from affecting the test system.

In our test, a system protected by AppGuard and nothing else was able to browse infected Web sites and use flash drives with viruses without becoming infected itself. And this worked even if the browsers were in privacy mode, which could be a hole in your overall security architecture.

One problem you might run into is if you have a valid program trying to use protected system resources from outside. It will get blocked. But you can always configure AppGuard to allow that to happen or install the program properly within your system, which will cause AppGuard to ignore it all together.

Another thing that might cut into AppGuard’s market is that a lot of newer operating systems, such as Windows 7, have this type of protection somewhat built in. Windows 7 and even Vista will alert a user when a program is trying to do something to system files or trying to run. The danger with that protection is that the alarm bells tend to go off all the time, even when valid programs sitting on your hard drive are trying to run. And like the boy who cried wolf, eventually users will just stop listening to all the worthless warnings, right about the time when a real warning pops up. AppGuard stops only programs outside a system from doing things that could damage a system. We received no false alarms in our testing.

AppGuard is reasonably priced at $24.95 for a license to use it on three PCs running XP, Vista or Windows 7. There are also special pricing options available for government agencies with a lot of computers to protect. According to our contacts at AppGuard, businesses with as many as 10,000 PCs have installed the software with no problems. Each version of AppGuard basically runs and protects a single PC, and that is all that it cares about. So whether an agency has 10 or 1 million PCs, AppGuard will still work with each individual system.

As a backup for normal antivirus protection, it can’t be beat. It could be an important piece of a secure environment in which losing data or getting hacked isn’t an option.

Blue Ridge Networks, 703-633-7322, www.blueridgenetworks.com

Blue Ridge Network’s Secure AppGuard

Pros: Good value; acts as a safety net when antivirus programs fail to spot a newly created threat.

Cons: Won’t do anything about existing threats on a network. Most new operating systems have a form of this protection embedded already.

Performance: A-

Ease of use: B+

Features: A-

Value: A

Price: $24.95 for a three-PC license.