How we did it

Our test configuration consisted of two client workstations running Windows NT 4.0, with Service Pack 6 applied with Microsoft Internet Explorer 5.0 and Netscape Navigator 4.73 browsers. These two machines served as our clients and were connected to our servers using two Cisco 2600 series routers and an internal frame-relay cloud. Our servers were Gateway machines with a single 800-MHz processor and 512M bytes of RAM. We installed Windows 2000, IIS 5.0 and Active Directory on the servers.

After installing each product and configuring it to protect our Web site running on the IIS 5.0 server, we tested the policy features by attempting to access the protected resource with a correct and incorrect user name and password. As well as testing the policy features, we put each program through several other paces. We created, deleted and modified users in the systems. We created protected resources and tested denial rules with regards to our test user accounts. We created sub administrator accounts to test the delegated authority of each product.

Two of the products tested, Entrust's getAccess and Symantec's Webthority did not run on Windows 2000. In this case we used Windows NT 4.0 with Service Pack 6a. We were able to use Webthority to connect to our Windows 2000 Active Directory, but with getAccess we used an Oracle database because getAccess did not have documented procedures available describing how to integrate Active Directory. Entrust should have documentation available soon that describes the method for incorporation Active Directory into getAccess 4.5.

Related links

Lewis is an information assurance specialist working at the U.S. State Department. Wilson is a security engineer at GRC International, and D'Cruze is an optical engineer at Corvis. They can be reached at slewis@ex-pressnet.com, swilson@grci.com, and martin@dcruze.com, respectively.

Shoring up security
New security techniques include honeypots, decoys, air gaps, exit controls, self-healing tools and denial-of-service defenses.

Cover your apps
Your security plan may not be complete if you haven't protected your applications.

Review: Web access control market offers many options
Securant Technologies' product tops the list with its management tools and ties to Check Point firewall.

To infinity and beyond...
Newest upgrades to the products we tested.

Why do you want web access control anyway?
The push for e-commerce has created a need for the ability to process transactions on the Internet securely.

What does it mean to be a user today?
Helpful explanations of some common terminology.

Interactive scorecard and NetResults: Web access control packages
Use our calculator to see what product would best suit your needs.