Labs

When we reviewed BlackICE PC Protection just over a year ago it was the firewall with by far the most effective intrusion detection system (IDS). Not only could it keep the bad guys out, it was also able to report exactly what they were trying to do. Even when we allowed incoming requests for web traffic it kept an eye on things and logged alerts when worms such as Nimda and other nasties came in to attack the web server.

Since then very little has changed, and the software is still at version 3.6, although it has received numerous security updates. In our latest tests it made mincemeat

ADVERTISEMENT

of the attacks. The most important change has been BlackICE's price. It has dropped from £35 to £27, which addresses the main problem we had with it last year. Its updates cost just £11, whereas in the past you would have had to pay £15 for further annual updates.

One fairly uncommon feature of BlackICE PC Protection is the severe Application Control feature. Similar in theory to ZoneAlarm's Program Control, where the firewall keeps close tabs on which programs are allowed to connect to the internet and receive connections from outside, Application Control is more thorough. It works by taking a snapshot of all executable files on the hard disk. If an attacker or virus changes a file, BlackICE will know about it. In practice this requires a lot of effort. After installing a program you'll need to re-run the baseline system to gather a new set of checksums. This takes ages and is so disruptive that we've turned it off on real systems we've protected with BlackICE. You can choose to install without the Application Control, which speeds things up.

The firewall and IDS are very effective and the software is priced just right, making this our firewall of choice.