Features

In the past we have looked at pcAnywhere, which has been a consistent runner in past telecommuting group tests. This time around Symantec has supplied its Client Security.

When considering security in any area, be it IT, ATMs or even opening your own front door, there is always one weak spot: it has to involve people. Despite all the research, we are years away from being able to recognize a person's identity with 100 per cent certainty (even if using finger-printing, retinal scanning or DNA testing) in real time.
Unfortunately, the drive to encourage remote working means that more and more people need access to the corporate network, with all of the security risks that that entails: how can you be sure who the person is on the other end? One solution - or rather, preventative measure - is to simply publish only necessary information on an extranet, but even then, this can still be confidential data and a risky business.

If anyone was under the illusion that data storage was boring, think again. The new technology engaged in protecting your critical data takes a fresh and enthusiastic approach to data security - ensuring that what you deem sensitive, value or trusted, is also worthy of iron clad protection within your storage infrastructure.
If you think that there's anything exciting to see as the data passes through the box, you'd be disappointed. In fact try finding CryptoStor within the Fibre Channel (FC) network or backup application and you may just hit a small snag - it's nowhere to be seen. But that's the point.

Oblix NetPoint is described as an identity management solution for the enterprise. What this means is that it is designed to manage the multiple identities and permissions in a modern e-business environment where you must provide access to a huge variety of different people - many of whom will be entering the network from outside the corporate firewall. In a modern large e-business enterprise it can be a daunting task to do this securely.
Oblix NetPoint simplifies the management of user identities and permissions across multiple applications and provides single sign-on. It makes it easy to add or remove users, to change permissions, and to enforce password rules.

In the Gateway Security product, Symantec has come up with a range of gateway appliances, each of which combines firewall, anti-virus, virtual private network (VPN), content filtering and intrusion detection in one rack-mounted system that is 1U high.

Another USB token approach, this time from Feitian Technologies, a company based in Beijing, China. The ePass2000 product comes attractively packaged with the software, printed user's guide, a USB token (in this case the ePass2000 with 1024-bit key functionality), overview brochures and even a mouse mat. This may give an impression of an off-the-shelf consumer oriented product, but the ePass offering is actually quite comprehensive.

The Aladdin eToken is a small, lightweight, attractive USB device, about the size of a physical key, which can generate and store user credentials such as private keys, passwords and digital certificates within its own protected chip environment.

RSA is usually associated with token solutions, providing dynamic one-time password facilities plugged into back end authentication servers like RSA's ACE/ Server. But there are times when a token is not ideal: you have lease costs to consider, the server-side requirements are relatively high and inexperienced users can find one-time passwords tricky to handle.

The SafeWord PremierAccess product immediately impresses as a solution that has been well considered from the outset. Developed around the dynamic password concept, it may nevertheless support smartcards and other tokens, and even biometrics. These methodologies may be mixed and matched depending upon the needs of the enterprise.

Entercept falls into the category of an intrusion prevention system (IPS). In common with traditional host-based IDS, Entercept resides on the host itself, but it works at a much lower level than a normal HIDS system.

This solution provides a network-based IDS, real-time session monitoring and internet/email content blocking. eTrust Intrusion Detection can be installed in standalone mode, or it can be distributed on separate machines. The intrusion detection program installs as a service under Windows NT/2000. As usual, the monitoring interface is a NIC in promiscuous mode, and therefore the presence of the IDS is concealed from the attacker.

This solution is supplied as software, desktop or rack-mounted. Each network sensor is a separate appliance, handing high-availability, high-security 10/100 or gigabit monitored segments.Running on a hardened OS, based on Red Hat Linux, in a small installation it can be managed using a web-based interface, software or optionally as an appliance.

ActivCard Gold provides the expected functionality for securing the desktop, remote network access and access to web services, via digital signatures stored upon a smartcard. Appropriate software utilities are provided to manage these functions. However, the ActivCard approach goes one stage further by adding biometrics technology to the mix.

Authenex Strong Authentication System (ASAS) is described as a network security application that provides strong (two-factor) authentication for remote, VPN and web access. This would appear to sum things up quite well and Authenex provides a variety of software tools to support this goal.

This product concentrates on hard disk data encryption. However , it does include a VPN client integration for IPCrytor VPN gateways, which is a remote access solution. Encryption may be in relation to your own local hard drive, or a specific directory or folder on the corporate LAN.

First, allow us to congratulate Datakey on a most comprehensive and clearly written set of user guides. This is an important factor for many users and yet so often overlooked in contemporary products. For those as yet unfamiliar with smartcards and tokens, this can be very helpful and save them a lot of time as they progress along their own particular learning curve.

The Schlumberger DeXa.Badge is not so much a single product, more of a secure identity philosophy. Potential use of the associated chip cards could range from simple intranet/internet secure login, to a full blown certificate-based enterprise deployment for local and remote access, physical access control and other related applications.

NetScreen uses multi-method detection (MMD) in its IDS appliance, which also includes intrusion prevention options. MMD integrates stateful signature analysis with the detection of protocol anomalies, traffic anomalies, IP spoofing, layer 2 and SYN-flood attacks. Plus, it includes detection of 'backdoor' exploits and a network honeypot. The NetScreen IDP-100 is rated at 200Mbits/sec throughput, offering a choice of eight Fast Ethernet or two separate gigabit monitoring ports.

This is a network-based IDS, supplied as an appliance. There are four versions of the NID-300 series - the difference being in the number and speed of the Ethernet interfaces. The top-of-the-range model has two 10/100Mbit and two gigabit network interfaces. One of these interfaces is always reserved for management, but the remainder can be used for monitoring. In this way, a single NID-300 can monitor load-balanced or failover WAN connections. By separating the management and monitoring interfaces, NID-300 can operate in stealth mode, as the monitoring interface does not respond to any network traffic or requests from any service on the monitored network.

RealSecure 7.0 is the result of the integration between RealSecure and the BlackICE NIDS sensor technology. It runs on a dedicated machine and acts as a NIPS sensor to monitor a network segment, looking for intrusions or suspicious activity. If an intrusion is suspected, it can respond by recording details of the event. It can notify the network administrator, reconfigure the firewall, or terminate the event.