Reports of data breaches increased dramatically in 2008, and identity theft is still among the fastest-growing crimes. Security vendors are racing to help consumers and businesses protect themselves, with AVG Technologies making one of the first big moves this year.

AVG, an antivirus and Internet security software provider, has acquired Sana Security to help battle the growing threats. Sana develops behavior-based software that proactively protects against threats in a way similar to the human immune system.

"Sana's unique behavioral software, combined with AVG's existing security technology, will provide the most comprehensive online identity protection in the industry, delivering continuous real-time protection," said J.R. Smith, AVG's CEO. "At the same time, AVG will continue to maintain low-PC-resource utilization for optimal system performance, a critical requirement both for the individual at home and for the business user."

Mimicking the Immune System

Sana's products use advanced behavioral technology to protect user information such as log-ins, passwords and account information, as well as other critical data stored on a computer.

By mimicking the approach used by the human immune system to repel attackers, the software prevents hackers from capturing and transmitting sensitive information from a user's machine.

Sana's technology "learns" normal application behavior by observing the way those applications interact with each other -- their "code paths." Software bugs, user configuration errors, malware infections, and other forms of attack force applications down unexpected code paths. The behavioral technology recognizes this misdirection and eliminates threats before they can affect the user's data.

Understanding the Threat

The need for technologies to guard against identity theft is growing. According to the Identity Theft Resource Center, only 2.4 percent of all breaches in 2008 faced encryption or other strong protection methods. Only 8.5 percent of reported breaches faced password protection. As ITRC researchers said, it's obvious that the bulk of breached data was unprotected.

According to a Gartner study, there were 15 million victims of identity theft in 2006. That means every minute about 28.5 people became a new victim, or just more than two seconds per victim. AVG estimates tens of thousands of new computer threats are released every day, including increasingly complex bots, rootkits, spyware and Trojan horses.

Indeed, as the threat landscape evolves with more sophisticated online attacks, AVG said Sana's technology complements its existing portfolio by delivering continuous threat detection and automatic removal of malicious software. According to AVG, Sana's technology helps computer users simplify and streamline protection against identity theft.

A Layered Approach

Is this a breakthrough in identity-theft protection? Symantec already has a product, Norton Antibot, based wholly on Sana's technology, and the implications of AVG's acquisition aren't clear. Symantec wasn't immediately available for comment. In any case, the idea of behavioral technology in security products is nothing new.

"Most of the major anti-malware products already include behavioral-protection technology to some extent or another to augment more 'traditional' detection mechanisms," said Graham Cluley, a senior security consultant at Sophos. "Companies have typically been very reluctant about relying solely on behavior-based malware protection products, so it makes sense to incorporate the approaches alongside one another to boost detection rates."

Sana's personnel, together with its research organization, Sana Labs, will be integrated into AVG and maintain offices in Silicon Valley.