Jon Tullett

This product manages and analyzes Windows server log files. While this activity is not limited to forensics, it is an important incident response tool.

Author Peter Warren and Michael Streeter

AuthorB. Winkel, C. Deavours, D. Kahn, D. Kruh

Author Kevin Mitnick & William Simon

Author Roberta Bragg

Publisher Larstan

ArcSight's flagship product, the ArcSight Enterprise Security Manager, is a security event management (SEM) tool capable of analyzing large mounts of network data in real time. The IDS model fell down because the flood of unfiltered alerts overwhelmed the resources of security teams, but SEM provides correlation, filtering and analysis to, in theory, allow the few real threats to be picked out of the blizzard of less important alerts and false positives.

Sourcefire calls its 3D System a "network defense system," avoiding the now loaded terms IDS and IPS. But while some of its components are strictly IDS or IPS, the package as a whole deserves a much broader description.

When 3am Labs asked us to review LogMeIn, we were not sure whether it was really appropriate for SC Magazine. The software is primarily a tool for web-based remote access and administration (there is a "network console" version for enterprise administrators, too). But it has a surprisingly broad set of security features, as well as some clever ways to tie down possible vulnerabilities in remote administration.

The emerging spyware threat is spawning a horde of anti-spyware products. Some have been around for a while, such as the excellent AdAware and Spybot – Search and Destroy.

We have looked at DESlock+ before, with its DESkey USB tokens and file encryption software. And while the previous version impressed us enough to win Best Buy in our Data Encryption test last year, it is safe to say that the product has been improved by leaps and bounds since then.

NMS for PC v2.8 is a file encryption system with some interesting bells and whistles. The software integrates into the Windows logon process, using logon to ensure that access to encrypted data is limited to authorized users.

Using zip archives to compress and transfer files has become such a standard part of everyday computing that the notion of using the same tools for security should come easily to most users.

Control Break's SafeBoot offers a lot of features, but we were a bit put off by several being cited as available at an extra cost, including some basic-looking items such as a scripted administration tool, or a database backup utility.

SafeGuard Easy encrypts the entire disk and places agent software in the master boot record, requiring authentication before the OS is loaded.

Replacing the weak security of passwords with two-factor authentication is a no-brainer for security today, but there are still situations where passwords remain.