ISS BlackICE PC Protection 3.6

BlackICE has been around for years: it was one of the first products to share the personal firewall space with ZoneAlarm and has gathered a well-deserved loyal following ever since. The latest incarnation of the firewall is BlackICE PC Protection and this shows great maturity both in terms of stability and defence - for instance, it now provides excellent outbound protection, unlike some of the earlier versions.

ISS (Internet Security Systems) refers to this as being an Intrusion Detection System rather than a personal firewall, the distinction being somewhat blurred, as other firewalls also do more than just monitor packets and ports these days. However, it does manage to keep on top of new exploits by way of regular automatic updates to enable the best use of its application layer packet intrusion detection, which analyses traffic patterns in order to determine when an attack is being launched.

During installation, you can choose if you want to install the Application Protection component, and BlackICE will perform a baseline scan for all Internet-enabled applications on your system - this took nine minutes on our test machine. However, we like the fact that it did a thorough job and that it kept us informed of progress at all times.

In use, we were surprised that BlackICE failed the stealth tests in default mode, with TCP pings being non-stealthed according to PC Flank, but otherwise all tests were completed with flying colours. Tweaking the configuration would strengthen defences further, but it's here that BlackICE is let down by a complicated interface that might prove daunting to all but the most experienced of software firewall users.

This product is a double-edged sword. It's a powerful weapon against intruders for those who have the skill and confidence, but the novice could find that a simple slip may lead to a virtual 'friendly fire' incident. It's all too easy to make a configuration error that reduces, rather than increases, your protection.

We do like the depth of logging, though, together with the back-trace functionality to reveal network information about would-be intruders. It's just a shame the overly uncompromising interface proves to be something of an Achilles heel, leaving less complicated products better suited to the personal firewall needs of all but the most confident of users.