But recently announced firewall-based virus protocols such as Content Vectoring Protocol and Finjan Software Ltd.'s SurfinGate API will place much more control in the hands of administrators by giving them a more granular set of criteria for granting and denying applications access. These solutions, although appropriate in many circumstances, still rely on the discretion of the user in cases where digitally signed ActiveX controls and Java applets are concerned. The problem with this is that even with content inspection, some dangerous applets or controls will still pass undetected through the company firewall. The firewall, using a clearly defined security policy, can accept or reject applications from specific certificate authorities and entities without involving the user. Luckily, most of the pieces required for firewalls to provide this sort of service are already in place.
Many firewalls already supply digital certificates for users.
Corporate applications such as messaging and World Wide Web servers have also adopted this approach to user authentication. And some servers are built specifically to handle these certificates. Netscape's recently released Certificate Server, for instance, is capable of storing, authenticating, generating, and even revoking digital certificates. All that remains is to transfer this capability from people and servers to downloadable applications. The benefits are enormous.