During testing, Deep Content Fingerprinting precisely registered Microsoft Office documents, PDF files, and C++ source code. This process works by scanning file systems or content repositories -- plus, it does on-the-fly assessment of e-mail attachments and Web uploads. Interestingly, fingerprinting works with

Click for larger view.

content written in any language or character set (including non-Roman ones, such as Japanese). The resulting highly compressed fingerprints (1TB of data typically reduces to a 5GB pattern-matching file), combined with this systems' standard pattern matching (for detecting, say, common U.S. and European identity numbers) reduced false positives to zero in my evaluation.

Additionally, fingerprints infallibly detected when I copied parts of a protected document into another, compressed the new file, and modified the original text. Yet the system is smart enough to know that insignificant noise, such as added spaces, should not trigger alarms. Additionally, the system inspects encrypted objects.

Depending on the policies I'd set, the Content Inspection Appliance blocked messages, put e-mail in a quarantine queue for later action by the proper authority, or re-routed mail to another Mail Transfer Agent server for processing (such as adding encryption or applying digital rights management). This worked without any noticeable delay when sending from Microsoft Outlook, communicating with instant messenger, using Web mail, or transmitting files via FTP.

With blocking, the originator can be informed of the reason for the action, which helps to educate employees and further reduces risk of accidental disclosures.

When security violations happened, incidents were recorded, and the manager I specified was immediately notified to act using the Content Protection Dashboard. Importantly, CI-1500's own security ensures that incidents related to one department (say HR or finance) can't be viewed by others. In one section of the dashboard, color-coding highlighted the most severe problems so I could review them first. Reports let me see the details of the incident, record a comment, take appropriate action (such as releasing a message from quarantine), and close the task. This workflow's flexible, which let me quickly re-route some incidents to others for action.

Other dashboard functions let me generate custom alerts and reports, display graphs of incident trends, and see risk metrics. Although the CI-1500 lacks some the sophisticated report functions found in its competitors (generating and e-mailing reports on schedules, for instance), what it offers is still above the norm.

Similarly, on the forensic side, reviewers can view the audit history of incidents and sort them by different criteria to help spot patterns. That said, the CI-1500 doesn't retain information about all communications it monitors, so it's not perfect if you need to go back and see messages that might have been missed.