Search

Reviews several anti-spyware computer software. eTrust PestPatrol Anti-Spyware Corporate Edition r5 from Computer Associates; NOD32 2.5 Antivirus System from Eset; Anti-Virus Client Security 6 from F-Secure; Security Suite 8.6 from LANDesk; VirusScan Enterprise 8.0 with Anti-Spyware Enterprise Module 8.0 from McAfee; Sunbelt CounterSpy Enterprise 1.5 from Sunbelt Software.

This article compares two anti-spyware tools, namely, Computer Associates' (CA) eTrust PestPatrol Corporate Edition 5.0 and Tenebril's SpyCatcher Enterprise 3.0. CA recently acquired PestPatrol and added its product to CAs overall enterprise protection strategy, known as eTrust Threat Management. The Corporate Edition adds centralized client and update management with an intuitive graphical user interface and a straightforward approach to spyware and adware protection. It was impressing how PestPatrol console identified the network setup. All client-related functions are easily accessed from the console. Overall, eTrust PestPatrol Corporate Edition did an excellent job of detecting and removing adware and spyware from the systems. The management console is easy to navigate, and there is enough flexibility in how and what to scan to fit most situations. SpyCatcher Enterprise takes an approach similar to PestPatrol Corporate, creating a central point of administration for clients. The management console is lean yet usable, offering flexible control of what malware to keep an eye on and what to ignore. Installation of SpyCatcher Enterprise went smoothly with no surprises on the Compaq ML-530 rack-mount server running Windows 2003 Server. SpyCatcher did an adequate job of locating and disabling malware on the test systems. As did PestPatrol, it found all of the major spyware applications, but PestPatrol seemed to be able to locate a few more support files. Unlike PestPatrol, each SpyCatcher client is responsible for downloading its own updates from Tenebril, instead of using a single distributed download. SpyCatchers reporting features are better than PestPatrol's, but not by much.

This article reviews several computer software that provide excellent end-to-end electronic mail security. PGP Universal is a pure e-mail security product, providing mail encryption, anti-virus scanning and attachment filtering, along with PGP's zero-footprint Web-mail interface, Web Messenger. Universal does allow administrators to easily create different encryption and signing policies for various mail domains and to quickly manage individual user's keys. Sigaba Secure Email 5.0 takes a granular view of secure mail processing through extensive use of rules and object lists. SendAnywhere is Sigaba's zero-foot-print delivery technology and Sigaba Vault provides a secure Wen-based portal system. PostX Enterprise Platform 5.0 provides e-mail security by mixing in advanced mail routing capabilities with WebSafe, one of the better Web-mail portals going. PostX provides a flexible way of sending secure e-mail without requiring client-side utilities or plug-ins, while still giving businesses control of user authentication. Tumbleweed Secure Messenger 6. has a very powerful and flexible policy engine that allows businesses to create rules based on domain, message, and user among other things. Secure Messenger also performs virus scanning, spamfiltering and content filtering.

The article features two Web-based application firewall solutions from Imperva Inc. and Sentryware. Hive from Sentryware is a proactive security device, unlike most intrusion protection systems (IPS), which are reactive. Instead of using set policies or rules to protect Web applications, Hive embeds advanced encryption standard-encrypted tokens in the hypertext markup language (HTML) stream on the fly. These token are specific and unique to each HTML page and each object on the page. When a user accesses the home page of an application, Hive actually takes the HTML while it is in transit and rewrites it to include the token information, a long hex key. Token creation and HTML rewriting take place at near wire speed and are completely transparent to the application. Hive is more resilient to changes in the underlying HTML interface than traditional IPS and application firewalls. It includes Sanity Checks to make sure no one tries to use a structured query language (SQL) injection attack, cookie poisoning, a shell code exploit, or cross-site scripting against a Web application. On the hand, Imperva's Web application protection takes the essence of an IPS and adds to it advanced heuristics and attack correlation. It does not rely on preset list of known application vulnerabilities, and it can protect against unknown attacks on Web servers and database servers. Unlike Hive, SecureSphere is a reactive form of application security. The solution detects anomalies or outright attacks. SecureSphere uses two appliances. The SecureSphere G4 Gateway looks at all the traffic on local area networks and logs each Web page request or database lookup to SecureSphere's other appliance, the MX Management Server. The SecureSphere console is where all the collected traffics is analyzed, sorted and stored in a provided SQL database engine.

The article evaluates the InterScan Web Security Appliance 2500 software from Trend Micro.

The article reviews the network security software Elemental Security Platform 2.0 from Elemental Security.

The article reviews the auditing and security policy enforcement software Policy Commander 1.5 from New Boundary Technologies.

Evaluates the Hailstorm 2.5, a device from Cenzic for analyzing Web applications for security issues as well as regulatory compliance and overall functionality. Features and capabilities; Results of the tests conducted on the device; Cost.

This article focuses on the Elemental Compliance System (ECS) security management services from Elementary Security. The only truly secure computer is one that's unplugged and buried in a hole 6 feet deep or so it is been said. Unfortunately, you cannot disconnect and bury your servers to keep them safe. You can, however, move access control from the user domain to the device domain. ECS wraps metered network access control with granular policy management and exceptional reporting. Although ECS relies on software agents deployed on known computers and servers, it still enforces policies on computers not running its agent by limiting or denying connections to hosts that do. ECS is not intended for small networks. It is a full-blown enterprise system that requires enterprise-level infrastructure. ECS is an agent-driven system. Agents collect and report to the server very detailed information about the hosts on which they are running. That information includes operating system and patch level. The agents also look for user-defined attributes such as running processes. Based on all this and other information, ECS automatically places the host into one or more groups which are collections of hosts that share a common criterion.

Reviews the Caymas 525 Identity-Driven Access Gateway computer security software from Caymas Systems.

Reviews the computer software Enterprise Mobile Security Manager 2.5 from Senforce.

This article evaluates the Forum XWall Web Services Firewall from Forum Systems. Forum XWall Web Services Firewall can help you fight back and protect your exposed Web services. By peering into each simple object access protocol message, it allows or denies inbound connection attempts based on policies and rules you define. Also, Forum XWall enforces XML intrusion prevention and validation and provides multiple levels of monitoring and auditing. Available as an appliance, software you install on your hardware, a plug-in to Microsoft Internet Security and Acceleration Server, or embedded on a PCI 500 card. Forum XWall has most of the tools necessary to protect your Web services from attack. Installing Forum XWall's software version on a Compaq ML53O running Windows 2003 Server with IIS and UUDI is straightforward, although initial configuration will take some knowledge of XML and WSDL to get things going. In a production setting, Forum XWall should be run on a separate server so that it can efficiently proxy your Web services to consumers and simplify installation. The power of Forum XWall becomes apparent as you begin to define validation criteria and access control lists for each Web service operation.

Evaluates the NetSwift iGate Pro Secure Sockets Layer Virtual Private Network appliance from Rainbow Technologies. Key features; Capabilities; Sites and connectors used in the iGate.

This article reports on the launch of the Version 2.0 Elemental Compliance System of Elemental Security. The agent-based security system was renamed Elemental Security Platform with an advanced client platform support and additional predefined rules. Included also are updated regulatory policies for the U.S. Health Insurance Portability & Accountability Act of 1996, Payment Card Industry and Cisco Network Admission Control requirements.

This article features the new LANenforcer network security product line from Nevis Networks as of November 2005. The new line of LANenforcer products takes a hardware-based approach to network user access and policy enforcement. Based on Nevis' parallel LANsecure architecture, LANenforcer is designed to provide a personal demilitarized zone around each network user by combining comprehensive access control with defense against both known and unknown threats. Similar in concept to ConSentry's Secure LAN Controller, LANenforcer installs transparently between your users and the central wiring closet and uses custom application-specific integrated circuits to perform packet inspection and policy enforcement without injecting any noticeable latency into the system. Available with 12, 24, or 48 10/100/1000 ports, LANenforcer appliances can handle from 25 users and 1.2Gbps of throughput as many as 1,000 users and 10Gbps. INSET: I Nevis LANenforcer.

Evaluates the ConSentry Secure LAN Controller secured local area network server from ConSentry Networks. Versions of the server; Features; Price.

Evaluates the Cenzic Hailstorm 2.0 automated application security assessment tool. Ease of use; Features; Cost.

This article comments on the integration of computer virus and spyware protection. For the most part, viruses behave along a certain set of well-known guidelines. In many cases they are crudely written and usually install into well-known locations on the computer. Based on this knowledge, anti-virus programs will detect anything trying to pass through their nets. Spyware is quite different. Because it is written for financial gain, it tends to be more sophisticated in design and implementation. Spyware programs are harder to remove. At this time, Symantec AntiVirus Corporate Edition does not have a true anti-spyware detection and removal engine. It can detect and remove Trojans, but because most spyware does not come in that format, it isn't helpful. F-Secure stated that it is moving toward an integrated anti-virus/anti-spyware product, and that it is close to releasing a stand-alone detection product. But according to an F-Secure representative, detecting spyware with an anti-virus package is problematic due to end-user perception. In the end, the top anti-virus vendors will likely provide an integrated anti-virus/anti-spyware package for one-stop desktop and server security. Exactly how long it will take them to work out all the kinks, however, remains to be seen. Until then, separate anti-virus and anti-spyware software will remain a fact of life for enterprise administrators.