Network Computingwww.networkcomputing.com

	Issue TOC Print full article Print this page Download as PDF E-Mail this URL Discuss this article Flame the author     In this article Introduction BindView Development Corp. bv-Control 7.2 and Policy Operations Center 4.2 Configuresoft Enterprise Configuration Manager 4.0 with Security Update Manager 2.0 Pedestal Software SecurityExpressions 3.0 Symantec Enterprise Security Manager 5.5 PoliVec Security Policy Automation Suite (Builder 2.6, Scanner 3.5, Enforcer 1.1) NetIQ VigilEnt Security Manager 4.0 Computer Associates eTrust Policy Compliance 7.4 How We Tested Report Card

SecurityExpressions was deceptively simple to use compared with the other products we tested--and that's a good thing, provided you stick to the sample scripts and reports. SecurityExpressions, like the products from BindView and PoliVec, doesn't require agents for Windows computers, though agents are available for querying hosts on remote networks. SecurityExpressions is unique among the products we tested, however, in that it doesn't require that you install an agent on Unix hosts--it just needs an account with root privileges and SSH for secure communications.

Reporting and policy definition are top notch, though custom reports and ad hoc queries are a bit difficult to define. SecurityExpressions can install both patches and service packs through custom scripts. Of course, the price is by far the lowest of the products we tested, which, depending on your needs, may offset the costs associated with building custom reports.

SecurityExpressions splits the tasks of policy monitoring and policy enforcement by providing a Web interface, where we could run reports but not make changes to end systems or the SecurityExpressions application. Each report is contained in an individual SIF file: There's no global configuration for computer discovery and grouping, so we had to repeat basic configurations for each individual report. We exported the SIF files as policy guideline documents, which provided high-level descriptions of each check, or as policy standards where a specific configuration setting is detailed. Both reports are appropriate for administrators, not for general users.