Take the Tolly test for SSL VPN gear

The Tolly Group, a networking test firm, has posted a resource that could help users decide which Secure Sockets Layer remote access vendor is best for them.

The company has made public a set of tests to run on SSL gear that users could use before deciding whether to buy. While SSL VPN devices have many individual capabilities, Tolly lists three that are key for potential buyers to review:

* Access control. How does the SSL gateway make sure only authorized users get past it?

* Endpoint security. How well does the SSL software clean up the remote machine so no traces of SSL sessions are left for later users to find?

* System Security. Is the SSL device itself secure?

Within each category, Tolly lists specific features to look for.

Tolly has reviewed these features on a limited set of SSL gear and has certified that some meet Tolly standards, but just the description of what was tested for is helpful to someone researching the equipment. With sample gear on site, potential customers could check out for themselves whether the products pass muster in these categories.

In a recent column for Network World (link below), Tolly President Kevin Tolly says SSL vendors attempt to make implementing and using their products as easy as possible, but that is very different to being simple. Having recently tested this type of equipment, his thoughts can be helpful to people weighing whether SSL VPN gear meets their needs.