Overtis launches browser plugin for Web app control

The plug-in allows administrators to blank out features within Salesforce.com and Google Apps

A 3-year-old startup called Overtis launched a browser plug-in on Tuesday aimed at letting companies control what data employees can access through Web applications like Salesforce.com and Google Apps.

The plugin, called the VigilancePro WAM (Web Application Manager), allows administrators to blank out certain tabs, hyperlinks, and buttons within a Web application. For example, an administrator could block access to Salesforce.com's contacts as well as the ability to print or use copy-and-paste depending on where the employee logs in, said Overtis CEO Ed Macnair.

[ Get the no-nonsense explanations and advice you need to take real advantage of cloud computing in InfoWorld editors' 21-page Cloud Computing Deep Dive PDF special report. | Stay up on the cloud with InfoWorld's Cloud Computing Report newsletter. ]

To do this, Overtis has mapped all of the functions within Google Apps and Salesforce in order to provide the granular control, he said. Both of those companies have worked with Overtis to make it work, Macnair said.

Macnair said there are increasing concerns among organizations over how to protect sensitive data when using Web applications. Salesforce.com has some controls built in, but the plug-in expands on those, while Google Apps has few access controls once a user has been authenticated.

The plug-in also provides a full audit trail, which is needed in industries like financial services, Macnair said. If a user is allowed to print, that event can be logged, as well as what data the employee accessed in the application.

The plug-in also acts as a single sign-on mechanism. Users have a login and password for the plugin, which then authenticates the user to one or more Web applications. The browser plug-in does this by communicating with a server component.

Administrators can also limit what devices their employees can use. The plug-in is provisioned by sending an employee an e-mail with a link to download it with pre-loaded permissions. Since the plug-in handles authentication to the Web application, an employee must have it in order to get access.

The plug-in would ensure, for example, that a consultant doesn't have access to the sales or customer information, said Fran Howarth, senior security analyst for Bloor Research.

"The insider threat is large, and data breaches are every day news, so this is an excellent tool for controlling information access to try to prevent these problems from occurring," Howarth said.

The plug-in is compatible with the Firefox and Internet Explorer 9 browsers, although Overtis plans to release it for Safari and Chrome. The company also plans to develop a version for SAP.

Overtis' idea is not revolutionary but does address key security issues around authentication and data access for organizations using cloud services, said Eric Domage, manager of western European security research and consulting at IDC.

The Web browser is the gateway to data held in cloud-computing services, Domage said. Whether organizations choose to use the plug-in will depend on price, however, as companies are unlikely going to want to pay for another application on top of Salesforce.com, he said.

Overtis plans to sell the plug-in for Salesforce.com through its App Exchange. It will cost $10 per user per month. Overtis has priced the Google Apps plug-in at $5 per user per month.

Send news tips and comments to jeremy_kirk@idg.com