Product Reviews

A lot has happened to BlackICE Defender (see Reviews, issue 78) since the personal firewall software was launched at the beginning of last year. Its approach to PC protection caused some debate, as it was one of the few products that checked incoming network traffic only. It's easy to see both sides of the argument, although ISS (Internet Security Systems), the new owner of NetworkICE, has now added a range of new features to defend against Trojans and viruses.

Instead of expecting you to decide whether each application should be allowed to access the Internet, BlackICE uses a slick routine that takes over much of this process. During installation, Application Control checks every file on your PC and creates checksums for each application it finds. This must be run on a clean, virus-free system, but from this point on BlackICE runs checksum verifications against any application that tries to load. If the checksum doesn't match or has no record of the application in its list, it prevents it running. Communication Control is the second line of defence, keeping an eye out for unidentified applications attempting to communicate with other PCs locally or via the Internet.

The software is as simple to install as its predecessor, although

ADVERTISEMENT

the baseline process can take a while on application-heavy systems. BlackICE offers four protection modes and defaults to Cautious mode, which is designed for regular Internet usage and only blocks suspicious traffic that attempts to access the OS and networking services. Nervous mode blocks all unsolicited inbound traffic except for instances such as interactive Web site content, while Paranoid mode bolts the door.

BlackICE keeps a low profile on your PC and doesn't panic when an attack is detected - it flashes its System Tray icon and plays a WAV file if required. You can view details such as the time, date and type of attack, and the number of occurrences from the Attack tab. Each entry is also accompanied by an icon showing the severity of the event and the type of response.

BlackICE's backtracking capabilities are superb, as it will log the intruder's IP address and, where possible, include the DNS, NetBIOS, node and group names and will frequently grab the MAC address of the network card in the offending system, which is as good as a fingerprint.

Plenty of information about the types of attacks identified is available on the ISS Web site, and you can modify the response to attacks by selecting an instance or an intruder from the log and trust them or block them for an hour, day, month or forever. IP addresses that you want trusted can be entered manually, although BlackICE still only allows individual entries to be added and not a range of addresses.

There's no lack of choice in the personal firewall software market, but BlackICE PC Protection definitely stands out from the crowd. It offers sophisticated tracking tools and application control measures, and unlike many products it runs quietly in the background and doesn't pester you with questions whenever it spots a potential attack.