Internet Security Systems

Internet Security Systems
Name	Internet Security Systems
Industry	Computer security
Fate	Acquired by IBM
Founded	1994
Founder	Tom Noonan
Headquarters	Atlanta, Georgia
Products	Network intrusion detection, intrusion prevention, vulnerability assessment, managed security services

Internet Security Systems

Internet Security Systems was a private company specializing in network security and computer security appliances and services. Founded in the 1990s, it became known for pioneering commercial intrusion detection system and intrusion prevention system technology and for influencing enterprise cybersecurity practices. The company’s products and research contributed to standards and operational models adopted by corporations, financial services firms, and government agencies.

Overview

Internet Security Systems marketed hardware and software for detecting and preventing unauthorized access to computer networks, combining signature-based detection, anomaly analysis, and rule-driven prevention. Its offerings targeted sectors such as banking, healthcare, telecommunications, and defense, integrating with products from vendors like Cisco Systems, Microsoft, Sun Microsystems, and Oracle Corporation. The firm operated research teams that published advisories and coordinated with organizations such as CERT Coordination Center, FIRST (Forum of Incident Response and Security Teams), and national Computer Emergency Response Teams.

History and Development

Founded in 1994 by Tom Noonan, the company emerged contemporaneously with entities like McAfee, Symantec, and ISS X-Force research groups. During the late 1990s dot-com expansion it expanded product lines amid competition from NortonLifeLock and startups such as Sourcefire and NetScreen Technologies. In the 2000s ISS acquired several firms and was itself acquired by IBM in 2006, becoming part of IBM Security and integrating into programs alongside Q1 Labs and Trusteer. Its timeline intersects with major incidents like the SQL Slammer and Code Red worms, events that shaped intrusion detection priorities industry-wide.

Technologies and Services

ISS developed signature-based detection engines, anomaly detection algorithms, and block/allow policy enforcement used in intrusion prevention systems. Its services included managed detection and response, vulnerability assessments, and patch management, working with standards promulgated by IETF working groups and guidance from NIST publications. Research outputs fed threat intelligence feeds consumed by operators at US-CERT, European Union Agency for Cybersecurity, and commercial security operations centers operated by firms such as AT&T Cybersecurity and Symantec Corporation.

Architecture and Components

Products combined sensor appliances, management consoles, and reporting modules. Sensors inspected traffic at network segments, integrating protocol parsers for HTTP, SMTP, FTP, and application-layer analysis for services like Microsoft Exchange and Oracle Database. Management consoles provided policy orchestration, dashboarding, and log aggregation for Security Information and Event Management systems like Splunk and ArcSight. The architecture supported deployment models including inline prevention, tap/monitoring, and distributed collector topologies used in large enterprises and government networks such as those of Department of Defense contractors.

Threats, Vulnerabilities, and Countermeasures

ISS-focused countermeasures targeted threats including buffer overflows exploited by worms (e.g., Morris worm-era vulnerabilities), SQL injection campaigns, cross-site scripting incidents that impacted sites like Amazon (company) and eBay, and advanced persistent threats associated with state actors. Vulnerability research emphasized patch prioritization, signature tuning, and anomaly baselining to reduce false positives. Countermeasure best practices referenced standards from ISO/IEC 27001 and guidance from SANS Institute training and courses used by security teams at Goldman Sachs and JPMorgan Chase.

Industry, Standards, and Regulation

ISS operated in an ecosystem governed by standards and regulatory regimes including PCI DSS for payment card security, HIPAA for healthcare data protection, and compliance regimes under agencies like the Securities and Exchange Commission. The company participated in standards discussions with bodies such as IETF, contributed to vendor interoperability initiatives involving Microsoft and Cisco Systems, and worked with certification programs from Common Criteria evaluation labs and independent testing organizations like NSS Labs.

Notable Products and Vendors

Notable offerings included network-based intrusion detection and prevention appliances that competed with products from Sourcefire (Snort-based systems), Juniper Networks (NetScreen), McAfee, and Trend Micro. Vendors in the same space and complementary markets included Palo Alto Networks, Checkpoint Software Technologies, Fortinet, FireEye, and Cisco Systems whose acquisition strategies and product roadmaps often paralleled ISS’s evolution. Post-acquisition, ISS technologies were folded into IBM Security product lines and services alongside acquisitions such as Q1 Labs and Cedar Mill initiatives.

Category:Computer security companies