With the Health Insurance Portability and Accountability Act, Sarbanes-Oxley and Gramm-Leach-Bliley legislation becoming common terms, mandated security and privacy measures are now part of everyday IT life. With that reality, IT security professionals need tools in their repertoire that help them prove their environments comply with these standards when auditors come knocking on the door.

In this Clear Choice Test, we examined products designed to help evaluate system configurations against predefined security and privacy policies, provide reports detailing compliance levels and identified issues, and assist in remediating issues that could result in penalties for noncompliance.

Altiris, Configuresoft, Elemental Security, NetIQ (acquired by AttachMateWRQ during the course of the test), New Boundary and Symantec agreed to participate. We also took a closer look at how Preventsys' Security Risk Management System helps provide a more aggregated view of policy compliance across multiple products. Preventsys was purchased by McAfee last week. IBM, TriSixty, Polivec, Ecora and Cambia declined to be tested.

The good news is that strong options abound in this class of products, with five of the six tested earning an overall rating of at least four out of five possible points.

NetIQ's Vulnerability Manager came out on top as the most well-rounded product. While it did not stand out in any individual area, it performed solidly across the board in policy management, reporting, compliance checks, configuration and remediation.

Symantec's Enterprise Security Manager (combined with agentless technology it picked up recently with its purchase of Bindview) placed a very close second, standing out for its reporting and remediation information components, but losing a bit of ground on ease of use for policy-development. Configuresoft's Enterprise Configuration Manager earned kudos for being the most intuitive product tested, though how it describes identified compliance issues could be improved.

Elemental Security, the new kid on the block, earned high marks for its Elemental Security Platform device-discovery and remediation-action options, which are based on the packet filter embedded in its agent software. Elemental may be an even stronger contender once its reporting functionality and flexibility match the rest of its technology innovation.

Whitepapers

• Gene Kim's Practical Steps to Mitigate Virtualization Security Risks
• Selecting Effective Virtual Directories
• A Modern Approach to On-Demand Email and Data Security
• Best Practices for HP Servers and HP Enterprise Virtual Array in a Microsoft Exchange
• Compliance, Protection, Recovery: A Layered Approach to Laptop Security
• Endpoint Security: Data Protection for IT, Freedom for Laptop Users

View more SECURITY whitepapers

Webcasts

• Key Considerations for a Successful 802.11n Deployment
• Solutions to the Toughest IT Challenges in Remote Offices
• Lowering the Cost of Email Archives
• High Availability for SQL Server 2005 Using Array-Based Replication and Host-Based Mirroring Technologies
• Technical Overview of Exchange Server 2007 with HP Servers and Storage
• Bringing Order and Security to your Mobile Workforce: Corporate Mobility Policy and Device Management On-Demand

View more SECURITY webcasts

Special Reports

• The Evolution of Network Security
• Taking Virtualization Up a Notch
• Learn how to Keep your Mobile Workforce Connected
• The self-managed network

View more SECURITY special reports