Reflex Disknet Pro 4.4

Removable media is the scourge of network administrators, as its use in a business environment can be virtually impossible to monitor. There's now a wide range of high-capacity storage products available, and the USB port makes them all too easy to use. Flash drives can be a problem, and in the last PC Pro Labs (see issue 118) we saw pocket-sized products with capacities of 256MB costing as little £34. Not only can these be installed quickly, but the Labs performance results show how easily large chunks of corporate data could be siphoned off in seconds.

Disknet Pro offers the perfect security solution, as it aims to control the use of all types of removable media and restrict access to serial, parallel and infrared ports as well. Data that has to be transported safely can also be authorised and encrypted, so only another system in the Disknet Pro environment can access it. The Disknet Pro console functions as an MMC (Microsoft Management Console) snap-in, which was easily loaded onto our Windows Server 2003 domain controller. All workstations to be controlled require an agent to be installed, and this can be deployed easily using the supplied MSI file with an Active Directory Group Policy.

Mobile users are also catered for. You can allow specific users to have administrative access to the client settings at times when they're disconnected from the main server. The client contains several components that combine to control access to all ports, stop unauthorised programs from running, and prevent specific file types from being created, copied or downloaded. You can also activate a module that provides password protection at boot time.

Your first job is to create profile templates that determine how clients behave, and it's here that Disknet Pro reveals all of its aces. You can decide whether users have access to the boot-time password and if the client icon should appear in the System Tray. If activated, the PSG (Program Security Guard) blocks specific file types from being created, or existing ones modified, and the default list can be customised. An exemption list is used to declare applications that may require full access to any of the listed file types and all these lists can be backed up to an initialisation file for safekeeping. The Port Guard feature is a major strength as it blocks access to PC ports of all types. You select those you want to control access to and simply decide whether to block all access or allow read or write permissions.

The RMM (Removable Media Manager) handles access permissions to devices such as flash drives. If such a device is inserted, you can either block access immediately or request that the media be authorised and scanned for viruses. This can be run automatically by the server or you can allow the user to follow a wizard. The process writes a signature on the device, which then allows it to be used on other designated systems. The EPM (Encryption Policy Manager) provides even tighter media access controls, as it can enforce encryption on removable devices before access is allowed. Ideal for protecting media on the move, EPM can restrict access to members of specific groups.

Auditing is good. You can select from a range of events, such as hard-disk configuration changes, download failures or the detection of unauthorised removable media, and pick a notification level. For important events the client can send an immediate warning to the server, while others can be left until the next period of scheduled contact.