Metascan® ICAP Server

Tony BerningSenior Product Manageraberning@opswat.com

5 June2013

Agenda

Overview of Metascan

Overview of ICAP

Metascan ICAP Server

ICAP Server Licensing

Metascan ICAP Support Roadmap

Further Resources

Overview of MetascanMulti-scanning solution

What is Metascan?Multi-scanning engine

An API driven server application that allows customers toincorporate multiple AV engine scanning technologies into theirsecurity architecture

Supports 0 to 30 anti-malware engines [and growing!]

Simultaneously scans files with all engines

Scan directories, files, archives, buffers, and boot sector

Automatic online definition updates or manual offline updates

What is Metascan?Multi-scanning engine

Flexible and scalable API driven solution Many programming Interfaces –

C++JavaPHPC#/ASP.NETRESTful (Web API)/HTTPICAPCLI[command line interface]

Analyzes files locally on a single server or remotely accessesfiles from Windows, Macintosh, or Linux systems

What is ICAP?Internet Content Adaptation Protocol

Content adaptation protocol Lightweight HTTP-like protocol

Used to transparently extend proxy servers

Generally used to implement Virus scanning Content filtering

Metascan ICAP ServerHTTP traffic scanning with multiple engines

Metascan ICAP ServerHow does it work?

Proxy traffic sent to ICAP server

Scans all HTTP traffic over the network

Scans incoming and/or outgoing traffic Incoming traffic for file and web content downloads Outgoing traffic for file uploads

Blocks contents containing threats Configurable through the Metascan Management Console

Metascan ICAP ServerDeployment

All endpoints within an organization are connected to the Internet through a proxy server

All traffic going through the proxy can be scanned by Metascan

Licensing for Metascan ICAP Server

Metascan ICAP Server connections use Metascan Remote Client licenses

Two types of licensing, concurrent and non-concurrent Concurrent restricts the number of remote clients connected at the same time Non-concurrent restricts the number of unique remote clients that have ever connected to the

Metascan server

Every Metascan Server license includes 1 concurrent remote client license

Metascan ICAP Server Roadmap

Metascan ICAP Server is included in Metascan 3.7.3

Beta is fully functional, has been tested against Squid proxy 3.1

Future releases will include certification on other proxy types and versions

Further Resources

Metascan Server demo installations (including Metascan ICAP Server)available at http://portal.opswat.com (requires creation of a free OPSWATPortal account)

For further questions on Metascan ICAP Server functionality, contactsales@opswat.com