* The Reviewmeister continues his tour of endpoint security products
Let’s continue our tour of endpoint security products with Sygate Technologies’ Secure Enterprise 4.0.
Because setting up and deploying software that touches every client on your corporate network is no trivial matter, we assessed how each vendor handled this daunting process.
Secure Enterprise 4.0 provided on-site installs of the management server/console and several clients because it is included in standard purchases. We then re-performed their work to make sure there were no hidden “gotchas” in the process.
To test policy functionality, we attempted to create and deploy a policy that would block all inbound traffic except remote desktop, block outbound traffic to Port 23 on remote systems, block Netcat from binding to Port 468, and block Solitaire (sol.exe) from running.
Once the policy should have been deployed, we tested remote desktop connectivity, telnet connections and our ability to play Solitaire.
Sygate was successful at blocking Port 23 outbound. We then configured each policy to allow inbound Port 3389 for Microsoft’s Remote Desktop Connection Utility. Sygate successfully allowed the remote connection.
Overall, policy generation was challenging across products when determining how a specific product can implement a specific policy. Network-based policies were easier to implement than application-based policies.
Sygate provides some log viewers and a mechanism for generating graphs from the logs in the database. It also includes the ability to view statistics on client status by group or individual system, which lets you see which clients have not reported in for a while that may require investigation. We would like to see reports generated for this information.
We tested application control (also referred to as execution containment) features by running an application that accessed the network in a way prohibited by policy. We tested intrusion detection by performing a port scan. We tested intrusion prevention (which is implemented as anomaly detection, if at all) by running a Universal Plug and Play Protocol (UPNP) attack. We tested defense resilience by performing a “coarse uninstall” of the product. We defined a coarse uninstall as the deletion of files from the product’s program files folder. We deleted all the files we could, as an attacker would.
Sygate handled execution containment and detected the network intrusion. For the full report, go to https://www.nwfusion.com/reviews/2004/0920rev.html
