CyberGatekeeper polices policies

ensuring that remote system software and hardware configurations comply with corporate standards and security requirements is no small task. Trying to base network security on physical location or geographic whereabouts can be like trying to nail Jell-O to a tree because remote users can be coming in off a VPN, wireless connection, PDA, or even by a dial-up connection.

Free IT resource Virtualization Insights from Top Experts - Learn how virtualization gets real! Sponsored by Dell Free IT resource TechNet: More ways to know it, share it, and keep it running. Sponsored by Microsoft InfoExpress CyberGatekeeper Remote Policy Enforcer InfoExpress, infoexpress.com/ Very Good  8.5 criteria score weight Security 9 50% Management 8 20% Setup 8 20% Value 8 10% Cost: CyberGatekeeper Agent: starts at $40 per seat for 1,000 seats; CyberGaekeeper Server: $6,500 or two for $9,820 Platforms: Policy Manager: Windows 95 and later, Internet Explorer 5.01 and later; Desktop Agesnt: Windows 95 and later, Red Hat Linux 7.x; Web Agest: Windows 98 and later and IE 5.01 and later Bottom Line: This scalable network audit, authentication, and gatekeeper solution boasts versatile network configurations. It provides impressive granular control over establishing policies and can recognize multiple types of remote user systems, their versions, and installed applications. About our Reviews and Scoring Methodology

Allowing noncompliant systems to connect to the corporate network is risky because unauthorized personnel might get access to corporate data and viruses can be introduced.

Remote-user authentication solutions such as InfoExpress’ CyberGatekeeper Remote Policy Enforcer can ensure corporate security standards are met, making life easier for the system administrator without taking up too much precious real estate in the server cabinet.

Three-pronged defense

The tidy, three-component CyberGatekeeper suite audits and enforces system configuration — and thus admission to the network — using a straightforward three-step process. Step one begins with administrators defining policies using the CGPM (CyberGatekeeper Policy Manager). The policies are distributed to the CGServers from a console at a centralized location. After they are in place, CGAgent, which auto-installs and runs on the remote system, sends audit info about the client back to the server whenever a client attempts to access the network. The server grants access only to those systems that comply with defined policies.

I was most impressed with the product’s flexibility and the granularity of the software’s policy designation capabilities. It’s highly scalable and has versatile configuration options.

Physically, the hardware is fairly utilitarian, with serial and USB ports, as well as mouse, keyboard, monitor, and printer ports. It also includes two 100Base-T Ethernet ports — one to hook up to the network switch or hub and the other to connect to the device that sits closest to the remote access servers.

The documentation carried me through to successful deployment. The administrator requires enough expertise to talk to the box via a terminal emulation program such as HyperTerm, which is supplied with Windows 2000 Server. This approach works well and is not that painful, but IT managers who are accustomed to a Web-based interface will need to rethink their expectations.

In addition, the appliance is noisy when powered up, making it difficult for a person sitting near it to think.

CyberGatekeeper can be deployed in a single-server, multiple-server, or redundant-server installation. In a single-server implementation, the CGServer sits between the internal router and the external switch that supports multiple external routers or a VPN.

In a multiple-server setup, each CGServer uses the same virtual external IP address but is connected to separate internal routers. In a redundant deployment, internal IP addresses for the two servers connected to the same router are different, but the virtual external address remains the same. A redundant-server deployment provides fail-over capability and an extra measure of reliability and security, but it’ll cost you more.

I like the intuitiveness of the CGPM software interface as well as the thought process behind the programming. Setting up policies gets easier after a competent admin goes through the process once or twice.

In a nutshell, a CyberGatekeeper policy comprises a When section and a Requirements section, both of which contain test conditions that are established by the administrator.

A When condition might be defined as “when a Windows operating system is present,” and the accompanying Requirements might be that “the user is running a current version of a specified anti-virus application, a personal firewall, and a Web-based browser that supports SSL.”

Test conditions, which define the When and Requirements conditions of any policy, can be set up as either basic or compound. Basic might mean a general rule such as a single application or configuration — a network IP address, specific operating system, or registry value. Compound could mean one or more previously defined simple test conditions. Test conditions verify critical data on the incoming system, such as OS installation and version as well as installed applications and their configurations.

CyberGatekeeper gives administrators a reasonable range of options that are fairly granular for setting up policies. For example, policies can be narrowed down to application specification, file size, version, or date. Administrators can choose from numerous preconfigured lists in drop-down menus and can customize policies along the way. Settings for one server can be exported to other servers via FTP, which simplifies configuration for a multi-server deployment.

CGAgents come in Windows, Linux, and Web flavors and are installed on the remote user’s system. An administrator can build a custom installer for any of them. The Web agent communicates from the remote device via a browser and sends that device’s system back to the server. The Linux Agent has to be launched manually in its own window from the command line.

Agents can be configured to audit various conditions such as the establishment of a VPN tunnel or matching dial-up name, window name, and local IP address. I was happy to see that they can be configured for three different levels of transparency to the user.

CyberGatekeeper Remote Policy Enforcer adds a layer of security to the network and simplifies user authentication without making deployment unduly complex. This product combo is well worth considering.