Features

We've looked at PoliVec Builder in the past, a policy development tool from the same stable. Part of the PoliVec suite, PoliVec Enforcer integrates seamlessly with its policy development tool counterpart to keep the enterprise secure.

Therefore, policy can be locked down to stop system changes and policy non-compliance from weakening the protected network infrastructure. Extensive reporting enables a precise picture of your network and real-time monitoring ensures that notification of problems can be dealt with in a timely fashion.

Policy enforcement is only as good as your management system allows, so a serious vulnerability could go unnoticed without prior knowledge of the problem.

Security Expressions allows deployment using no-agent technology to ensure that, once installed on either Windows NT or 2000 systems, the administrator can add machines within a group, that are required to adhere to the policies that pertain to that group.

Sygate Technologies says that its policy enforcement ensures remote connections over a VPN are not exposed to hijacking of data. It ensures remote authentication is only made if the user conforms to the policy set in force. This makes a lot of sense.

What Sygate Secure Enterprise provides is the ability to maintain certain rules, even for remote users. These include whether their firewall is current and configured correctly, if the remote user's anti-virus is up to corporate specifications and, equally important, up to date. These are just a few example of areas where compliance may be required.

The basis of any policy management tool is the ability to manage its users and to recognize potential problem areas. Some do this without agents and others prefer to manage policy enforcement with agents residing on both workstations and servers. This is the case for Symantec Enterprise Security Manager, which uses the agents as its means of communication between its networked machines, enabling timely updates and compliance reports.

Symantec Enterprise Security Manager has already established itself in the policy management solutions market. This particular solution ensures that policies are intrinsically complied with throughout the organization, as well as maintaining system security through recognizing changes that could affect the security of the network.

Using control information files (CIF) the product can be managed from a central console, but in a large organization you may require more than one. Agents provide the means for the information to be collected across a distributed network to ensure updates are accomplished at regular intervals. Changes can be identified and the appropriate action taken, while logs and reports may be generated for further analysis.

At the heavy duty end of the market, SSH Secure Shell for Windows Server offers enough security for even the most paranoid network administrator. Already recognized as one of the most popular applications for creating secure sessions in Unix, it is now available for Windows, replacing such protocols as Telnet or FTP with a hardened connectivity solution for those businesses that require more than usual security for data transfer.

Recently acquired by NetIQ, VigilEnt Policy Center provides a policy management tool that ensures users are aware of their responsibilities while providing solid policy control across the company network.

This is a corporate-level security solution and requires a user database to allow you to import users so that user groups can be established. The policies can then be set for these groups, with users being required to answer questions to establish understanding and compliance. Logs are kept to view user input and also to define problem areas. This performance-related system means that users know how to use company data and they learn what is required of them, while the administrator can see statistics and reports. Users not complying can be identified and an email can be sent to them to remind them of its significance. This ensures that not only do your employees comply with your policies, but your company can prove compliance with the regulators and specifically with ISO 17799.

You can stipulate certain user rights to allow for policies to be reviewed prior to publication and distribution. But of course you may use pre-written policies, amend them or create your own, as required by your own particular corporate needs.

Each enterprise will look long and hard at how they implement their corporate security policy. While many administrators look to implement an enterprise-wide solution, some may look to deliver specific policy management features for areas that their particular enterprise rates as high risk.

This means that in order to deliver policy management across all electronic communication a specific policy solution will be required that specializes in this particular function.

Remember the halcyon days of the dot-com boom, when analysts were insisting that no company worth its salt could continue in business unless they had a web presence? Their weighted words were sufficiently terrifying to ensure that businesses rushed to add that all-important 'e' to their trading, resulting in countless new web sites appearing.

CyberGuard offers a range of firewall/VPN appliances with specifications ranging from three Ethernet interfaces and 125Mbits/ sec throughput to 21 Ethernet interfaces and 2Gbits/sec throughput. All have an integrated VPN, run the same firewall software, and have the same configuration GUI. We tested model KS1500, which can have up to 18 Ethernet interfaces, of which two are gigabit-over-copper as standard.
Performance is the strength of the KS1500, which is designed to cope with 1.5 Gbits/sec throughput and up to 1.2 million simultaneous connections. The firewall boasts a host of certification standards including Common Criteria Eval­ uation Assurance Level 4+ (EAL4+), ICSA, ITSEC E3, Checkmark, etc. The secure operating system was designed to meet TCSEC/NCSC criteria at the 'Orange-book' B2 level.

ViraLock takes a different approach to securing a users' email system from the ravages of viruses and other malware. Rather than prevent a virus infection, the software is designed to work with existing anti-virus applications and firewall systems to prevent a users' mailbox from being compromised by an executable of any type.

One very important area of email security is encryption. Unless you are using leased lines or virtual private networks (VPNs) to transmit information, the moment an email leaves your firewall it is at the mercy of the internet. Emails can be intercepted and read without your even knowing about it, which poses a terrible risk for corporate information. However, encrypting the email does give you a high degree of ­ reassurance.

PC Guardian provides a nifty little program called Encryption Plus Email that allows you to encrypt email body text and any attachments. The email product is very easy to install - full installation of the administration program takes less than a minute. The product is designed for individual use, so the administrator installs it on each workstation, then configures it centrally and rolls out the user files across the network. Encryption Plus Email is only available for Lotus Notes and Microsoft Outlook, but since these two cover a large proportion of companies this shouldn't be a problem.

Administrators often forget that management of emails isn't simply a question of who can send or receive them, or the content. When email arrives it sits in the inbox, but who has permission to access that inbox, or other folders for that matter?

With high turnovers of employees becoming increasingly common, the stressed administrator may well lose track of individual permissions. For example, many companies usually have a set of freelance or contract email ­ accounts that can be assigned to temporary staff. The permissions required by one contractor may be far more extensive than those required by their successor, but they could very well inherit those permissions when they arrive. And human nature being what it is, inquiring minds will almost certainly take advantage of this, whether innocently or maliciously.

Although F-Secure may not be the first name in anti-virus that springs to mind, its products are among the heaviest hitters in the industry. Unlike some products which depend purely on their signature lists to be updated, F-Secure also comprises multiple scanning engines and heuristic detection techniques that make it one of the first products to detect new viruses. The company has now brought its expertise to bear in email security with F-Secure Anti-Virus for Internet Mail.

The product is available for Windows (NT and 2000). A Unix version would be nice, although there is a version for Unix which sits at the firewall level. Installation presented no headaches. However because of the way the product works, disk and memory requirements are quite high. It is also better to share the scanning across more than one scanner server to keep bandwidth usage lower.

Gordano is a company that has made the messaging arena its own. Its NTMail product was a revolution when it was first launched in 1994, and it was recently re-branded and overhauled to become Gordano Messaging Suite (GMS).

Installation is simple and straightforward, and Gordano has also ensured that the product is suitable for all major operating ­ systems. Once installed, navigation is easy: the product is logically structured with well-laid out GUIs. Both configuration and management are carried out via a web-based interface.

What strikes you when looking at the installation instructions for the securiQ and organiziQ Suites is the sheer number of operating systems supported. Although the mail server has to be Lotus Domino, alongside the familiar Windows platforms we see IBM OS/2 and AIX, Sun Solaris and a couple of Linuxes. We're told that from January the mail server will not have to be Lotus Notes, but our review was not able to verify this.

securiQ focuses on the management and security of email traffic, with features such as anti-virus available. This allows you to use your tool of choice, but does seem unfair given the cost. organiziQ manages the administration and overheads incurred by email.

New Zealand-based Marshal Software, now part of NetIQ, might not be so well known as some vendors in this Group Test, but it has produced an impressive product in its MailMarshal application, a fully-fledged email security solution.

MailMarshal is suitable for any type of organization. For small businesses, it can be used to replace the existing mail server and act as a POP3 server for up to 500 users. Larger organizations can co-locate the product on their SMTP server (although this is another spool-and-forward application, so performance is an issue), or install it on a dedicated machine.

No security software Group Test would be complete without an appearance by Symantec, and this is no exception. Symantec's offering is its Norton Internet Security Suite, specifically targeted at the standalone desktop machine, or those connected to smaller networks. Because of this, it is only available for non-server versions of Windows.

Installation of the product is extremely straight­ forward, aided by the very well-written documentation; as you would expect, considerable emphasis is placed on the prevention of viruses. The product very much urges you to take responsibility for your own actions, and the manual contains a very useful guide to the risks the internet can pose - something many home users may know nothing about.

One of the major headaches for network administrators is bandwidth consumption. However big your pipe into the internet happens to be, it's the last few feet from the server to the desktop that is the killer. A few years ago, people took their eye off the ball where bandwidth is concerned, as it was assumed that everyone would be migrating to the fatter cables of category 6. However, standards issues and an unwillingness to spend money in today's uncertain times means bandwidth is still at a premium. Files have not stopped growing, with multimedia data bringing many networks grinding to a halt.

Matters would be considerably worse if it weren't for the godsend that is PKZIP. Files are compressed by as much as 90 percent, allowing hefty files to shrink to more manageable and less bandwidth-hungry sizes. Probably the most ubiquitous non-Microsoft application around, PKWARE's PKZIP is probably the best compression program available - well, they did invent the Zip format.

There is another aspect of security that is often overlooked in the rush to install firewalls, anti-virus software and email management systems, and yet it is possibly the oldest aspect of them all. Many people bemoan the days when they could leave their doors unlocked and not worry - and that was because there was a large degree of trust in the community. Exactly the same is true of many of the new business practices that the internet has made possible. Whereas a deal might once have been sealed with a handshake, over the impersonal internet that isn't possible. Or is it? One company that has long believed that it is, and has become the market leader in asserting it through its technologies, is RSA.

RSA Keon Core PKI Product Suite is a set of powerful applications which will allow you to construct a complete public key infrastructure (PKI) to allow trusted communication over the internet. After installation you will have the Keon CA (certificate authority) and the Keon RA (registration authority) applications present on your machine. The former issues digital certificates, while the latter processes applications for the certificates. You will also be able to generate public and private keys for encryption and decryption.

Security has been the mainstay of SurfControl's business for quite some time, so it is no surprise to see an email security solution. A policy-based application, SurfControl E-mail Filter is actually an SMTP host through which all mail is diverted.

Installation is amazingly simple. It's just a matter of entering the required information into a few windows and telling the product where it sits in relation to the email server. For reasons of economy, it can be installed on the same machine as the mail server, but for reasons of reliability this isn't recommended.