CyberGatekeeper polices policies

ensuring that remote system software and hardware configurations comply with corporate standards and security requirements is no small task. Trying to base network security on physical location or geographic whereabouts can be like trying to nail Jell-O to a tree because remote users can be coming in off a VPN, wireless connection, PDA, or even by a dial-up connection.

Allowing noncompliant systems to connect to the corporate network is risky because unauthorized personnel might get access to corporate data and viruses can be introduced.

Remote-user authentication solutions such as InfoExpress’ CyberGatekeeper Remote Policy Enforcer can ensure corporate security standards are met, making life easier for the system administrator without taking up too much precious real estate in the server cabinet.

Three-pronged defense

The tidy, three-component CyberGatekeeper suite audits and enforces system configuration — and thus admission to the network — using a straightforward three-step process. Step one begins with administrators defining policies using the CGPM (CyberGatekeeper Policy Manager). The policies are distributed to the CGServers from a console at a centralized location. After they are in place, CGAgent, which auto-installs and runs on the remote system, sends audit info about the client back to the server whenever a client attempts to access the network. The server grants access only to those systems that comply with defined policies.

I was most impressed with the product’s flexibility and the granularity of the software’s policy designation capabilities. It’s highly scalable and has versatile configuration options.

Physically, the hardware is fairly utilitarian, with serial and USB ports, as well as mouse, keyboard, monitor, and printer ports. It also includes two 100Base-T Ethernet ports — one to hook up to the network switch or hub and the other to connect to the device that sits closest to the remote access servers.

The documentation carried me through to successful deployment. The administrator requires enough expertise to talk to the box via a terminal emulation program such as HyperTerm, which is supplied with Windows 2000 Server. This approach works well and is not that painful, but IT managers who are accustomed to a Web-based interface will need to rethink their expectations.

In addition, the appliance is noisy when powered up, making it difficult for a person sitting near it to think.

CyberGatekeeper can be deployed in a single-server, multiple-server, or redundant-server installation. In a single-server implementation, the CGServer sits between the internal router and the external switch that supports multiple external routers or a VPN.

In a multiple-server setup, each CGServer uses the same virtual external IP address but is connected to separate internal routers. In a redundant deployment, internal IP addresses for the two servers connected to the same router are different, but the virtual external address remains the same. A redundant-server deployment provides fail-over capability and an extra measure of reliability and security, but it’ll cost you more.

I like the intuitiveness of the CGPM software interface as well as the thought process behind the programming. Setting up policies gets easier after a competent admin goes through the process once or twice.