Justin Peltier

Paraben has been the market leader in hand-held forensics because the software is easy to use and covers a wide range of devices, including PDAs, smart phones and cell phones. The ForeScout CounterACT was the device which took the most time to install and configure. The Sophos NAC Advanced product is a well-designed offering which balances the need for ease of administration with network protection. The offering from Symantec is much larger than the scope of this review. With StillSecure Safe Access, every device starts in the quarantine network segment and has to test out of quarantine to reach devices on the protected network.
STRSRCH and URL_SRCH are command-line utilities that can search text files for IP addresses, email addresses, URLs and strings. The biggest advantage of these offerings is the speed at which they can process large amounts of data. We are fans of open-source software and Helix 1.9 falls into this category. Helix has two components, each with its own set of utilities. The first component is the Windows element, which can be started on a booted Windows system by simply inserting the CD into the drive. Forensic Toolkit (FTK) is one of the most full-featured sets of products. It includes a forensic imager utility, a registry viewer facility and the Distributed Network Attack, which aids password recovery with the password recovery toolkit. Paraben has established itself as the market leader in hand-held forensics because its software is easy to use and covers a wide range of devices including PDAs, smartphones, and mobile phones. A good all-around product with a large feature set. The unit can be a bit of a challenge for organizations that do not need all of the included features. Stonesoft offers a variety of firewall platforms designed to meet the needs of various sized organisations. The device from Secure Computing is an appliance-based offering that runs on a 1U rack mounted device. The Sidewinder provides two Ethernet interfaces, which can be separately addressed and configured. The AEP Networks offering is an appliance. The Netilla Security Platform (NSP) offers several choices for authentication of SSL VPN clients, including NT Domain, Active Directory, LDAP, RADIUS, Vasco, Kerberos and local database. Stonesoft offers an appliance for any size network. In this group test we looked at StoneGate SSL-6000 built to support up to 5000 concurrent users. The unit is a 3U rack mountable appliance delivered with three (two redundant) power supplies and is quite heavy. The Array Networks SPX Series Universal Access Controller is an appliance that provides a number of features through a browser-based SSL VPN approach. The SPX allows remote file access through SMB, browsing internal websites, access to internal mail servers and standard TCP-based services.