Clamp down on security leaks

You can also employ an API that integrates alerts with other security-event management systems. This might be helpful when a virus is transmitted, so a response can be coordinated with other security people and applications. Security executives can measure and reduce risk using company-level customized dashboards. These allowed me to identify and reduce security risks by efficiently grouping violations by department or individual.

Free IT resource TechNet: More ways to know it, share it, and keep it running. Sponsored by Microsoft Free IT resource Attend the SOA Executive Forum: Breaking SOA Bottlenecks SOAExecForum.com/may2007 Sponsored by InfoWorld Return to special report DOWNLOAD PDF Click here to download InfoWorld's special report Leakproof your data

Because Tablus emphasizes structured data analysis, Content Alarm is a fine solution for protecting against the loss of personal identification information and for monitoring against ID theft. Automated content classification should reduce management costs. However, detection is only a partial answer to data leaks. For enterprises wanting to go beyond finding problems and plugging holes, an upcoming upgrade (currently in beta) adds blocking. Alternatively, you can complement Content Alarm NW with the agent-based Content Alarm DT or a similar tool.

Vericept Intelligent Protection Platform 7.1
Vericept’s software watches all inbound and outbound Internet traffic for content that falls outside of your acceptable-use policies. Data passes through an analysis engine, which stores and reports on out-of-bounds communications. This system differs from other products: Vericept looks for broad inappropriate behavior by users, such as conflict-of-interest messages or communications that indicate a disgruntled employee. Based on these patterns, you can use positive evidence to stop abusive and criminal behavior. Custom categories for corporate compliance (including compliance with HIPAA, SB 1386, and Sarbanes-Oxley) are weak, but Vericept plans to add this and other functions later this year.

Vericept 7.1 maintains the product’s ease of use. It worked well out of the box, evaluating my entire test network’s traffic without requiring me to create special policies. Moreover, business users should have no trouble accessing a number of key features, including customized monitoring, which enhances accuracy.

The new Category Builder helped me tune several of the 61 Vericept-supplied categories (such as codes of conduct and acceptable use); I specified a range of source and destination IP addresses to watch for. I also specified specific data — credit card numbers, for example — to watch for.

Vericept can’t automatically register content, such as information in a database, for observation, yet several other functions have worth. The Social Security number category now uses information from the Social Security Administration to determine if a number is valid. Furthermore, I manually created custom categories with text related to names of confidential projects.

After establishing the basic monitoring rules, I further tweaked each category by determining when monitoring happened; this lessened false positives. For instance, I permitted Internet shopping after business hours.

Vericept combines multiple inspection engines, which have complementary analysis techniques. These probed all my unencrypted TCP/IP traffic and correctly identified harmful content, including material used in Telnet sessions, bulletin board postings, chat rooms, and peer-to-peer file sharing. Vericept can’t open encrypted IM or SSL Web traffic, but the software can detect their use. This gives you some insight into potential use of rogue encryption.

This solution locally saves extensive metadata about noted incidents (approximately a year of workday monitoring) and has administration commands for archiving collected events on external storage devices for more extensive historical analysis. For my tests I examined several weeks of captured activity using the four types of reports available from the Web user interface (Event Query, Event Summary, Event Search, and Most Recent Events). Most Recent Events showed a list of current bad messages, with links for drilling down to details about the event. Executives using Vericept can view threat summaries, as they can when using Vericept’s competitors.