enterprise

Qualys has provided an automated remote vulnerability testing service for some time. However, a remotely operated service like that is limited in what it can do when it is trying to access your computers through a properly configured firewall. That is not to say it doesn't do a good job of showing up external vulnerabilities, but it can't give a complete vulnerability picture, as it lacks the 'enemy within' perspective. Incidentally, internal risks are not limited to dishonest or malicious employees - it could apply to an innocent user accidentally running a trojan attached to an email, because he is running it inside the firewall perimeter.
What is needed to complete a security audit is a vulnerability assessment carried out from inside the organisation on the corporate intranet to see what vulnerabilities are exposed to internal users who may be a threat. And that's exactly what QualysGuard Enterprise does with its Intranet Scanner option.

Managing a network has never been easy, whether it comprises 100 or 100,000 machines. Even with a dedicated network administrator, the overheads are horrendous. Rolling out new applications, checking for non-licensed software, looking at network traffic... full-time tasks that often have no one with a full-time job to attend to them. This becomes even more worrying when you consider the security implications.

GASP is probably most famous for being the auditing software of choice for the Business Software Alliance. A free download of a version of this software is available on its web site. However, it can only audit up to 100 PCs and is time-limited. The version we reviewed is very much angled at the enterprise managing thousands of systems.

PC-Duo from Vector Networks has now reached version 2.0. The suite comprises of modular components that can be bought in when needs dictate. Like other desktop management systems PC-Duo includes modules such as Inventory Management, Remote Control, Software Distribution, Diagnostics, Software Metering, and web-based helpdesk tracking.

Sophos sent us the Sophos Enterprise Manager suite, which really consists of two components. SAVAdmin controls client activities, and the Enterprise Manager collects updates and software packages for deployment.

The Trend Micro Control Manager is designed to manage Trend Micro's many and varied anti-virus products. This is another company which has made strong moves into Unix platforms, with products for Linux, Solaris and HPUX.

Accomplished hackers will always perform some sort of reconnaissance on a target network before mounting an attack - finding out details such as operating system types, application version, etc. The idea behind ActiveScout is that if the application can detect this activity it can later prevent it. Bogus host or port data traffic is marked, and the application responds to any future activity it thinks is coming from an attacker with such marked data. It then blocks the packets and stops any damage ever occurring.

This suite of applications consists of the main Sygate Management Server, Security Agent for servers and workstations, a VPN and wireless security application. These enforce security policies at those particular entry points onto the corporate LAN. The idea behind this is to secure as many points of the network from one suite of applications, and it certainly appears to work well enough.

Symantec is a very old name in the security business, but it is not going to rest on its laurels. Its software-based Enterprise Firewall with VPN has had yet another upgrade since the last time we looked at it, and it offers quite a few new features to what was already a very powerful application. The application is also available pre-loaded on one of Symantec's distinctive bright yellow appliances if you prefer.

Either as a closed environment or as a service, Endeavors Technology's Magi Enterprise is a peer-to-peer security solution ideal for end users who have little or no experience with installing security solutions, but who are charged with telecommuting on a regular basis. From the administrator's viewpoint, removing any end-user problems can make the whole job of securing the data flow far easier.

The Aladdin eToken is a small, lightweight, attractive USB device, about the size of a physical key, which can generate and store user credentials such as private keys, passwords and digital certificates within its own protected chip environment.

Sygate Technologies says that its policy enforcement ensures remote connections over a VPN are not exposed to hijacking of data. It ensures remote authentication is only made if the user conforms to the policy set in force. This makes a lot of sense.

What Sygate Secure Enterprise provides is the ability to maintain certain rules, even for remote users. These include whether their firewall is current and configured correctly, if the remote user's anti-virus is up to corporate specifications and, equally important, up to date. These are just a few example of areas where compliance may be required.

The basis of any policy management tool is the ability to manage its users and to recognize potential problem areas. Some do this without agents and others prefer to manage policy enforcement with agents residing on both workstations and servers. This is the case for Symantec Enterprise Security Manager, which uses the agents as its means of communication between its networked machines, enabling timely updates and compliance reports.

Symantec Enterprise Security Manager has already established itself in the policy management solutions market. This particular solution ensures that policies are intrinsically complied with throughout the organization, as well as maintaining system security through recognizing changes that could affect the security of the network.

Using control information files (CIF) the product can be managed from a central console, but in a large organization you may require more than one. Agents provide the means for the information to be collected across a distributed network to ensure updates are accomplished at regular intervals. Changes can be identified and the appropriate action taken, while logs and reports may be generated for further analysis.

While not strictly an appliance, this version of Websense is tightly integrated with all of SonicWALL's range of extremely popular firewall appliances.

If you are looking for a little more than simple content filtering, it is worth taking a look at WebWasher. Aimed at the medium to large business, it provides extensive content filtering and a number of other valuable features.

EnCase from Guidance Software has established itself as the leading tool for forensic investigators. Perceiving a need for similar tools in the enterprise space, the company announced EnCase Enterprise Edition, bringing most of the functionality enjoyed by criminal forensic investigators to corporate users.