Vendor Briefings, May 2006

St. Bernard Software's Patch Management to the Rescue
Do you work for a midsized company that needs an easy-to-deploy patch management solution? If so, Steve Yin, vice president of sales and marketing for St. Bernard Software (http://www.stbernard.com), says UpdateEXPERT Premium is the tool for you. In addition to closing security holes by patching, UpdateEXPERT Premium provides customizable templates that implement the security settings that Microsoft and the National Institute of Standards and Technology (NIST) recommend for compliance with HIPAA, the Sarbanes-Oxley (SOX) Act, and other regulations. UpdateEXPERT Premium has a central management console and reporting capabilities to supply audit information about your company's regulatory compliance.

Casey Flinn, St. Bernard senior product marketing specialist, described St. Bernard's iPrism Internet-filtering appliance, emphasizing that implementing the iPrism solution on a hardened FreeBSD box maximizes security and minimizes latency and complexity for administrators. iPrism filters at the kernel level, not just the application level, and uses St. Bernard's iGuard database of categorized URLs. St. Bernard analysts review and classify all URL before adding them to database updates.
—Renee Munshi

Postini Provides the Proof
Regulatory compliance and records-retention policies drive many companies to archive email and Instant Messaging (IM) traffic. "The bottom line is that any company can be sued," stated Andrew Lochart, senior director of marketing for Postini (http://www.postini.com). "If you can't produce [the documents required in a lawsuit], you've got a problem."

I spoke with Andrew about Postini Archive Manager, a service that captures, stores, discovers, and deletes email and IM traffic. "Trying to do this for yourself can be complicated and expensive," noted Andrew. With Postini Archive Manager, customers "don't have to worry about buying large hardware or software systems or about storage-capacity planning."

Customers can purchase the new service as a standalone solution or integrated with Postini's existing security-related services (i.e., Postini Perimeter Manager and Postini Perimeter Manager for IM). Pricing and service vary according to which employees' email and IM messages you want to archive and how many years you want to retain archived messages. Pricing begins at $160 per user per year for 1 year of "ingestion" (Postini's term for capturing traffic) and 1 year of archiving, with an expected average 1GB of storage per user (additional storage is available).
—Lisa Péré

Symantec Lowers Compliance Cost
Today, corporations must deal with the ever-increasing cost and complexity of demonstrating and managing compliance with varied and multiple regulations. Symantec (http://www.symantec.com) briefed us about a solution that reduces IT compliance cost by providing automated policy management that defines and disseminates policy throughout an organization. Symantec BindView Policy Manager 3.0 creates and disseminates both IT and non-IT policies; maps policies to multiple regulations, standards, and frameworks; translates regulatory requirements into actionable policy; and demonstrates compliance to policy by collecting evidence from third-party sources. Policy Manager 3 reduces redundancy by assessing compliance across regulations with one set of universal audit controls. For example, one antivirus policy helps companies meet their malicious software prevention objectives across multiple compliance acts and regulations. Policy Manager 3 is now available through Symantec's reseller and distributor network.
—Gayle Rodcay

Mirage Networks Controls Network Access
Network security has changed significantly over the years, coinciding with the latest technology shifts. Now, more mobile devices enter and exit our networks, introducing the latest threat: The User. Scott Olson, vice president of marketing for Mirage Networks (http:// www.miragenetworks.com), briefed us on Mirage's NAC-in-the-Box solution, Mirage NAC 3.0. The product provides Network Access Control (NAC) by assessing risk for devices entering the network, mitigating threats and enforcing policies post-entry, and independently quarantining infrastructures for diagnosis and problem remediation.

The core of the Mirage NAC 3 solution is its behavioral rule set, which contains six categories of rules that detect any behavior that might signal an internal or external attack. This behavioral set avoids the need for signatures or agents to detect security threats and works out of the box for instant implementation.
—Blake Eno