Search

The article presents a comparison of two network security software available in the U.S. market in February 2006 including the IntruShield 2.1 from McAfee and the Sentivist 5.0 from NFR Security and offers information on its features and cost.

The article reviews the Mitigator IPS 5500 intrusion detection and prevention software from Top Layer Networks.

Reviews Determina SecureCore 2.0 computer security software. Information on a Memory Firewall technology included in the software; Importance of the memory firewall to server memory; Platforms supported by the software; Cost of the software.

This article evaluates McAfee's Entercept 5.0, a network-based intrusion detection and prevention system (IPS). Entercept not only protects both servers and desktop systems, it's also equipped with several security components. It's easy to deploy and easy to manage over the long haul. Entercept comprises three components: a management server, a management console, and agents for Windows desk-tops and HP-UX, Solaris, and Windows servers. Entercept agents have two primary functions, serving as a firewall and an IPS. The Entercept management server collects all of the alert data from the agents in the network and dumps it into a Microsoft SQL Server 2000 or Microsoft SQL Server 2000 Desktop Engine database. Installing an agent at the host is as simple as clicking the wizard and providing the IP address of the management server. Entercept agents use a number of techniques to ensure that the data reaching the host is legitimate. Entercept's Java-based management interface is nicely laid out, responsive, and easy to use. Dash-boards provide a graphical view of agent status along with the five most frequently triggered IPS signatures. Outside of the dashboard, other views are tabular and easily sortable.

This article evaluates four network Intrusion Detection System products: Internet Security Systems Proventia G200, Lancope StealthWatch 4.0, Snort 2.10, and StiliSecure Border Guard 4.3 against both live Internet traffic and a variety of attacks that were launched from penetration testing tool Core Impact 4.0. Manual attacks included operating system fingerprinting, privilege escalation, disk operating system, banner grabbing, traversal attacks and Microsoft IIS and Apache Web server exploits, among others. More significantly, on the live network, the products were exposed to nearly a thousand unique attackers targeting more than 50 ports, detecting thousands of events coming in from the Internet or from several thousand hosts inside the network. Among the live threats confronted were the Sasser worm and Gator spyware. As expected, all four products did a good job detecting threats. With only one exception, in which one IDS initially failed to identify the Sasser worm, the products successfully alerted the presence of all the manual attacks and live threats they confronted. Although the four proved roughly equal in terms of recognizing attacks, important differences--ranging from ease of setup and management to depth of packet analysis and reporting, but especially the fundamental approach taken in detecting threats--may help dictate which solutions best suits individual networks. INSETS: Attack of the Inhospitable Host;The Early Bird Gets the Worm.