Review: ForeScout Technologies CounterACT

For: A truly massive feature set, which goes well beyond just NAC. Against: The GUI configuration is non-intuitive and documentation is of little help. Verdict:A big product that functions like a firewall, an IPS and a NAC device all rolled into one.

The tool works much like a network sniffer looking for malicious sources - devices which appear to be sending non-standard network traffic. The appliance, therefore, protects a network from zero-day attacks because the filtering is not based on signatures, but rather a deviation from normal network information.

The protection offered by the device is controlled through a configurable network integrity policy. The policy can automatically find out-of-compliance devices, such as a workstation which is not running an anti-virus product or is missing a critical patch or hotfix.

These devices are moved into a quarantine VLAN, which restricts access to the organisation's critical resources. The ForeScout CounterACT does not just quarantine non-compliant machines, it also provides self-remediation tools.

The device acts as a wireless enforcement point by detecting rogue APs and it also functions like an inline firewall. The network firewall protection creates network security zones and this allows the administrator to block network segments in the event of an outbreak, or even deny access to specific devices which have been labeled malicious sources.

The firewall feature also blocks unwanted applications, such as unencrypted protocols. The tool can alert administrators through a number of different methods.

The installation of the ForeScout CounterACT was pretty straightforward. For the initial configuration, the device requires either serial console access or a keyboard and monitor. The initial setup is menu driven and only takes a few moments to complete.

The second part of the configuration was far more difficult. The initial screens for the GUI made us feel lost and we immediately began looking for the documentation CD.

Hardware support is included for 90 days. ForeScout offers basic eight hours a day/five days a week and extended 7/24 support options. Support can be reached through phone, email or website.

The pricing for ForeScout CounterACT is US$13,995, which places it in the middle of the price spectrum.

counteractsecuritytechnologies