Cisco Security Agent 4

Any program installations also received short shrift and were blocked every time by the Agent. The key-logger utility activated the CSA trojan rule and from the monitor screen we could drill down and see how many times this had triggered alerts on the network. You can then decide from drop-down lists which types of application classes are to be made exempt. CSA gets even smarter as an event-management wizard is provided for each alert. This allows you to create an exception that will permit the action, or you can leave the agent profiler to analyse the event and suggest a course of action. This is a handy tool as you can deploy it to specific hosts where it monitors selected applications and creates custom policies for allowing or denying access to certain programs.

The proactive approach to network security is clearly becoming more desirable - the MailGate from Tumbleweed (see p200) is another good example that uses intent analysis rather than signatures files. The Cisco Security Agent will require a lot more initial configuration work as the policies and rules will probably need customising. The management interface is also geared up for Cisco-centric networks. However, it does offer tough security measures plus extremely good reporting. The fact that it doesn't require updates to be regularly downloaded and deployed network-wide will reduce the administrative burden significantly, too.

Author: Dave Mitchell