Intrusion SecureNet Impervious to ``Witty'' While Protecting Critical System Uptime.

Business Editors/High-Tech Writers

RICHARDSON, Texas--(BUSINESS WIRE)--March 23, 2004

The Architecture of the Intrusion SecureNet Intrusion Prevention 

and Detection System Protects It from the Witty Worm

Furthering the commitment of providing enterprises and governments with the first Common Criteria certified, best of breed network intrusion detection system, Intrusion Inc. (Nasdaq:INTZC), a leading provider of intrusion detection solutions for the information-driven economy, today reconfirmed to the market that the innovative, gigabit speed interpreted architecture of the Intrusion SecureNet System makes it virtually impossible for worms or buffer overflows to allow access to the Sensors. Additionally, with the Witty Worm signature the Intrusion SecureNet System blocks the worm from accessing critical systems, security products and desktop computers within the network.

The SecureNet System was architected from the beginning as an interpreted system, which provides a vault for the critical signature and protocol decode engines. The interpreted system acts as an internal firewall to the SecureNet IP&DS allowing only task specific commands to pass, thereby protecting the SecureNet System from worms and buffer overflow attacks that can lead to malicious code insertion and propagation.

"Networks are falling under more persistent, creative and damaging attacks every day and this latest worm is a foreshadowing of what is to come," said Ryon Packer, vice president of product management, business development and marketing at Intrusion Inc. "Worms are becoming more destructive and digging deeper into the enterprise, costing thousands of dollars per compromised computer in repair time, lost productivity and headaches! Well-implemented policies and network compartmentalization enforced and supported by certified, rugged security products layered throughout the enterprise are inversely related to the frequency, severity and cost of network outages and lost work."

This latest worm targets unpatched, Microsoft(R) Windows(R) (Nasdaq:MSFT) versions of RealSecure and BlackICE from Internet Security System(TM) (Nasdaq:ISSX), leveraging a published vulnerability in those systems to gain access to the host and to then spread to every other system on the network. The witty worm over-writes the hard disk of the host system, corrupting files and the operating system to the point that the computer software must be completely rebuilt or restored in order to function.

In addition to the architectural immunity to this type of worm, the Intrusion SecureNet System can detect and block this worm, saving the enterprise thousands of dollars per system in restoration or reinstallation time. The Intrusion SecureNet signature for the Witty Worm is available on the Intrusion Inc. OpenSource Signature Center at www.intrusion.com.

About Intrusion Inc.

Intrusion Inc. is a leading global provider of the Intrusion SecureNet(TM) line of leading network intrusion prevention, intrusion detection and regulated information compliance products, as well as deployment technologies and security services for the information-driven economy. The Intrusion SecureNet(TM) family of network security products for governments and enterprises help protect critical information assets by quickly detecting, analyzing and responding to attacks and the misuse of classified and regulated information. Associated Intrusion SecureNet(TM) Intrusion Detection(R) services provide unique value to governments and enterprises in protecting information assets. For more information, please visit www.intrusion.com.