Formerly known as Entercept, McAfee Host Intrusion Prevention (Host IPS) is McAfee's software-based host-intrusion platform for desktop and server machines. The software is available for Windows desktop machines and servers; the server agents include specific additional functionality for the protection of the IIS Web server and Microsoft SQL Server 2000. The vendor's site notes that Solaris, HP-UX, and Linux implementations are also possible; prospective customers should contact the vendor for details of these platforms.

McAfee Host IPS is deployed as individual endpoint agents that are managed via the vendor's ePolicy Orchestrator (ePO) product (Host IPS is available as a stand alone offering; but ePO provides the centralized management capabilities). The agents provide the actual protection for the host machines themselves; while ePO allows for the deployment, updating and centralized policy management of the individual agents.

The desktop/server agents feature three methodologies for the identification and prevention of host vulnerability exploits: Behavioral Rules prevent zero-day (unknown) attacks; signature analysis identifies known attacks and exploits; and a built-in system firewall attempts to enforce defined corporate traffic policies based on IP addresses, protocols, or ports. The desktop agents feature protection functionality specifically designed for commonly exploited applications such as Internet Explorer and Outlook; while the server agents are capable of scanning for exploits of Web and/or database servers such as directory traversal and SQL injection attacks. Other agent features include buffer overflow exploit prevention and the ability to block the use of USB devices on target machines.

New features in the latest McAfee Host IPS release include the aforementioned integration with ePO; and "Vulnerability Shielding," which provides for the automatic updating of security content (similar to the vendor's AV signature files) to recognize the behavior of exploits trying to take advantage of specifically known vulnerabilities.

The latest McAfee Host IPS release will be available on February 22nd. Pricing is $1,095 per server for the server agent, and $33/client for desktop agents. Both prices include the 1st year of support.

Contact McAfee for further information.