|
|
To print: Select File and then Print from your browser's menu
-------------------------------------------------------------- This story was printed from ZDNet Australia. --------------------------------------------------------------
|
Avert your eyes! 4 Net filters reviewed By Matt Tett, Technology and Business magazine October 01, 2004 URL: http://www.zdnet.com.au/reviews/software/internet/soa/Avert-your-eyes-4-Net-filters-reviewed/0,139023437,139161368,00.htm
 
Always a contentious topic, we look server-based Internet content filters and some of the reasons why your organisation might want one, or not.
Undeniably someone needs to stand up and be the sheriff in this global frontier, but who? And because it affects the global community, not just a single set of users, then how? Has the time come to turn off the Internet or make a wholesale upgrade? The arguments on this subject are endless and emotionally charged. The impending changeover to IPv6 may provide the opportunity to also start applying some international laws and standardised regulations on content. (In case you were not aware, the Internet system inherently runs on series of unique numbers called IP addresses, which consist of four eight-bit digits (from zero to 255). This allows just under 430 million different addresses, and when the Internet protocol was created, the innovators thought that there would never be a call to use all the numbers available. Hmmm, another great IT mistake. The time of saturation is upon us -- it has been for quite some time now -- so shortly many services will be moving from IPv4 to IPv6. Apart from addressing the potential for running out of numbers again in a hurry, it also has additional features that can be used for traffic control.) Content filters have surreptitiously crept into the digital landscape over the past year or two, generally under the guise of being added features packaged with antivirus, firewalls, or spam filters (and other traffic inspection systems such as these). Depending on the operator's incentive or need for deploying such tools, there is even perhaps a valid reason for all the posturing and positioning of the filtering products. Indeed, some organisations may even be justified hiding them in clandestine locations to spring on the unwary. Whether you believe it or not, many people actually take their privacy for granted and would not like to think their online experiences and antics on the "anarchic" Internet could be traced, tracked, logged, or even -- shock horror -- controlled. The truth is that these products do exist and have been readily available for quite some time. Incorporating powerful feature sets, they enable the administrators to log virtually every aspect of the users they are able to control.
We are here to open the can of worms -- well, more like a 44-gallon drum of king-sized worms -- for thought and comment, and in the process try not to impose our personal beliefs on what should and shouldn't be considered acceptable in the arena of information control. However, with such a contentious issue it is very difficult to maintain a independent view at times. So the questions are, should a line be drawn? And if so, where should that line be drawn, and who should draw it? Who should regulate the drawer and who can control the line? What do the people think of someone else drawing a line on their behalf to control their use? Who would conform and who would not? Big questions, lots of theories, and no answers. Now the scene has been set perfectly for a media frenzy and application vendor marketing hype. But why would people or organisations want to apply these filtering products? The four main uses of a information content filter are:
Technology & Business readers mainly fall into the "business" category of users, therefore this review will focus mainly on those applications designed around controlling Internet content in the workplace.
Computer Associates (CA), developers in their usual way have sat down and really thought out this application, and then worked to integrate an amazing array of features set fairly and squarely at their target user base. The product is a gateway application and the feature set includes not only HTTP (Web) content filtering capabilities but also FTP (file transfers) and SMTP (e-mail) filtering/management. For the purposes of this review, we will look only at the HTTP content filter side of the product. The application also includes central reporting and a quarantine manager; it's very modular, fits into many varying environments, and can scale well. The Web content filter itself ships with no less than 19 real-time black hole list services (RBLs). The installation documentation provided by CA is very thorough and takes even the novice content filter administrator through several key topics such as good DNS housekeeping practices. The actual installation itself was very straightforward with several simple configuration steps taken along the way. Administration and monitoring is performed through the same interface, with extra access to quarantine and advanced logging applications built in and accessible at the click of a button. The application sets itself up as a proxy server to filter all relevant traffic passing through it. This can still be used in conjunction with a traditional proxy ser-ver application.v Overall, this is a very powerful, refined package that is simple and easy to use. The extended feature set is also a plus to any company needing the extra functionality. Definitely add this application to the shortlist for evaluation. Additional included applications further enhance the ability of the CA filtering application to integrate with domain and directory structures to increase the user auditing capabilities.
Symantec Web Security comes with a very informative 300-page implementation guide. Symantec filtering scans HTTP (Web), HTTPS (secure Web), and browser FTP (file transfers). The Symantec Web Security application can be configured to work with a directory service to authenticate its users and groups. There is a range of predefined lists included with the package, everything from Alcohol-Tobacco to Weapons, and all 28 categories in between including job search, news, and vehicles (useful in an office full of rev heads, but perhaps less so at a car manufacturer). Installation was as simple as inserting the CD and following the prompts. Configuration is performed via a Web interface. The main configuration revolves around setting up the computers, users, and groups. There are also more detailed settings (less used, or set once) under the System configuration settings. It takes some time to get used to using the Web interface and its particular nuances, however we are sure once the administrator spends some time coming to terms with it, there should be no problems. The Web Security application can be configured to filter on a per-user, per-computer, or per-group basis, therefore giving the administrator great control over their environment and enabling them to easily enforce their security policies. The reporting tools are very extensive and can extend to logging all Web sites that users visit, to providing a complete audit log of Web activity. The application installs as a proxy service, albeit on a default port of 8002 (which can be changed), and it can be used in conjunction with other proxy servers too. In summary, while it's definitely a content filter, the system is let down by its Web user interface which takes some time to learn and is a little harder than necessary to navigate. Very good integrated reporting does however ease the situation.
Trend Micro's Interscan Web Security Suite is a feature-rich, well-developed security product. Installation could not have been any easier for such a relatively complex application. There is basically nothing to it, just answer a few simple routine install questions and let it run its course. The server needs to be rebooted, then the operator can access the browser interface. Configuration is via a series of drop-down menus on the left-hand side of the interface. If the administrator is familiar with other Trend Micro applications such as the InterScan Messaging Security Suite, then they will find a similar look, feel, and terminology is used. Administration and reporting is also comprehensively covered. As part of the installation routine, the administrator is given the option of installing to an included MSDE database, or for larger sites use an SQL Server database. There are several key routine updates included in the subscription, covering items such as Phishtrap and Spyware patterns. There is also a very comprehensive URL filtering database included if the administrator chooses to install and make use of that. In conclusion, Trend Micro's Web Security Suite is robust, refined, and easy to implement and manage. Very good reporting tools and extra functionality should put it on the top of any administrator's short list for evaluation.
Webspy is a relative unknown when compared to the other vendors participating in this review. Despite Webspy's prodigous range of applications there is none which does content filtering per sé. The majority of their applications simply take application logs, such as proxy or firewall, and attempt to make sense of them to enable administrators to generate reports from the overwhelming amount of data these applications tend to generate. Possibly the application that comes closest to a content screening device is the Webspy Sentinel product. It provides a real-time gateway environment which also has full logging, accounting, and reporting facilities to enable administrators and managers to monitor employee Web surfing events. Due to the nature of the product -- and given the fact that it does not actually apply any rules or policies to block or filter content -- the installation and initial configuration takes only a few minutes and is very straightforward. Once Sentinel has been configured via the small configuration interface, the log files can then be examined. We installed Webspy Analyzer Giga 2.1 which is the enterprise-level log analyser. With the minimum of fuss, we followed the wizard through to create the log file storage area and import the data, it was then a matter of running a summary report and the results where there for all to see. In conclusion, if spying and logging is your game and content control is not a requirement, then the Webspy range of products would surely have some kind of tool to suit your requirements.
Each product was installed onto a Windows 2000 Advanced Server system. Due to the time and level of detail required to build up an accurate and reliable table, we did not attempt to formally test the accuracy of these products. In testing the Lab has done for other clients, we have found all the systems in this review to be sufficiently accurate for business purposes. Consideration was given to the installation and more importantly the configuration and ongoing administration of the applications themselves.
Test bench
Futureproofing
ROI
Service
Company: LCS Enterprises This company wants to monitor and block employees' access to non-work-related Web sites, as management believes employees are wasting too much time on the Web. Approximate budget:Â Open. Requires:Â Web content filtering software or appliance suitable for 200 concurrent users. Concerns: The company is most concerned with the ease and flexibility of applying and customising rules, getting updates, and using/importing custom lists of Web sites. The ability to apply different policies to different groups or users will be highly regarded, as will the ability to integrate with existing directory systems. Management tools and reporting will also be an important factor. The ability to block peer-to-peer file sharing applications or to prevent users from downloading spyware applications would be a bonus. Best solution: The scenario winner in this case is a 50/50 tie between CA's eTrust Secure Content Manager (SCM) and Trend Micro's InterScan Web Security Suite. Really the features, ease of administration, and logging levels between these two applications are very close.
Look out for...
Editor's ChoiceTrend Micro InterScan Web Security Suite Highly Commended: Computer Associates eTrust Secure Content Manager With these business-oriented content filtering applications to choose from, the winner of the Editor's Choice this month goes to Trend Micro's InterScan Web Security Suite with CA's eTrust Secure Content Manager coming a very very close second. Trend Micro gets the gong because it's easier to use, cheaper, and has additional features such as spyware filtering. However, both packages have the features and flexibility to work very well in a business context.
This is a many faceted and very hot topic indeed. Whether you are for or against the filtering of Internet content, the battle certainly seems to be hotting up. Combined with vendors now specifically targeting applications tailored for the various potential users, there are several different fronts and opinions that will emerge in the coming months as more and more people turn to filtering content. So the question remains: to control content or not to control content?
This article was first published in Technology & Business magazine.
RMIT IT Test Labs is an independent testing institution based in Melbourne, Victoria, performing IT product testing for clients such as IBM, Coles-Myer, and a wide variety of government bodies. In the Labs' testing for T&B, they are in direct contact with the clients supplying products and the magazine is responsible for the full cost of the testing. The findings are the Labs' own -- only the specifications of the products to be tested are provided by the magazine. For more information on RMIT, please contact the Lab Manager, Steven Turvey.
Copyright © 2009 CBS Interactive, a CBS Company. All Rights Reserved. |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
