Collecting bits of compliance data from disparate products is the problem that Preventsys' Security Risk Management System addresses. Preventsys was purchased by McAfee last week.

This product doesn't do its own data gathering - the reason we couldn't include it in our comparative test - but takes the results from multiple sources, such as Configuresoft Enterprise Configuration Manager, Qualys QualysGuard, open source Nessus-based scanners and a host of other assessment scanners, compliance tools and configuration products.

Out of the box, Preventsys supports commercial applications such as McAfee, nCircle, ISS and Application Security. A software developers' kit is available from Preventsys to integrate with other products.

The results of these compliance scans are then pulled into the Preventsys system, correlated and evaluated against defined policies to provide an aggregated view of enterprise compliance.

Preventsys includes a unique feature called a policy lab, which lets users import their own company policies or configuration guidelines into the system, even the exact policy document, if necessary.

The Preventsys product pits a user's policy against the compliance database; the result is an aggregated risk score and a prioritized list of issues to remediate. Preventsys includes a ticket system to assign and track remediation tasks. As an alternative, it can integrate with enterprise ticketing systems, such as BMC Software's Remedy, to track the resolution of identified issues.

At the moment, Preventsys is unique in its approach, but NetIQ is moving in the same direction. It has developed the Risk and Compliance Center, a separate product that integrates with the NetIQ Vulnerability Manager to provide reports and dashboards on compliance that are more executive-level. NetIQ may begin to support data from other sources in the future, says a company spokesman. We also see several other companies in the wings with similar products.

Network World will be performing a comparative test with these products later in the year.

Enterprise compliance needs to be viewed holistically. The compliance products we tested can help with system configuration but should not be viewed as the only compliance solution. Enter Preventsys, which provides a fairly holistic picture of compliance within an enterprise network.

< Previous: New Boundary | Next: How we tested 6 products >