Network Computing is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

$28 Million for an Old Idea?Part 2: Page 3 of 3

The company's secret sauce is its application identification technology. Just as an IPS uses signatures to identify malware, PAN's firewall uses signatures to identify applications.

And here's where we get to drawbacks. Signatures are contradictory by nature. On the one hand, you can never have enough because new applications appear all the time, and existing applications change. PAN says it has a database of 500 application signatures, with 5 to 10 new ones added each week. Still, that's a fairly limited set, which means a lot of policy work as administrators decide how the firewall should handle unidentified applications. Home-grown apps may also be a cause for concern.

On the other hand, the bigger the signature database, the more time and processing power you invest in scanning traffic. Firewalls that introduce significant latency don't last long. The company says its firewalls can process tens of thousands of signatures at line rate (it sells 2Gig and 10Gig appliances). That's an extraordinary claim, and it remains to be seen if the company can live up to it. Signatures also aren't omniscient; false positives and false negatives should be expected.

That said, I like Palo Alto Networks' approach. If they don't screw up on execution, I predict one of two outcomes: they disrupt the firewall and IPS markets, or get bought. Or maybe both.