For

As enterprise protection goes, the ServerLock System has some quirky (in the best possible sense of the word) features that make it different to any other enterprise security products I have looked at during the past year. WatchGuard Technologies does some brave boasting in its brochures, saying that the well-documented attacks that crippled Staples.com, the AP wire service, the New York Times and the White House could have been prevented had ServerLock technology been in place. At a lower overhead cost and with a more streamlined security management model to boot!

Now, not wanting to sound cynical, I suppose there is only one way to test this assumption. Get some or all of the above mentioned victims to run an evaluation copy of the ServerLock System and issue a challenge to the hacker community. Perhaps I am being unfair to all security system developers by suggesting an 'ethical hacker fest' to push their products to the limit, but such an option may become a reality for products of the enterprise variety who are targeting high pedigree organizations. In fairness, having thrown that politically incorrect spanner in the works, I reckon the 'ethical' hackers would be seriously challenged in their efforts to bust an optimally configured ServerLock protected system.

Designed for the Windows NT/2000 platform, the ServerLock System consists of three main components. The heart of the system is the ServerLock Manager, which controls the integrity protection of all systems across the enterprise. The ServerLock Console provides the administrative interface, and finally, the ServerLock is the nucleus of the system, the client-side agent that locks down critical areas of the client system, providing content protection from internal and external attacks and errors as well as user accounts, binaries, system files and registry keys.

One thing I really like about the ServerLock System is that separate passwords are required for configuration and management functions, and to change the management password, you must also know the configuration password for ServerLock Manager. This strictly separates ServerLock administrative functions from management group administrative functions. The ServerLock System administrator powers extend to adding/deleting management groups and adding/deleting machines in management groups, while the manager's functions extend to remotely controlling machines and users as well as having the power to change user passwords. This separation of duties by password is an effective tool. With a sensible lower limit of seven characters and a manageable upper limit of fourteen characters, the password requires some 'must haves,' which make it formidable.

It is important to understand that the ServerLock System is a complimentary system to be used in conjunction with other security products such as firewalls, anti-virus, etc. and its strict usage will obviously form a vital part of an overall enterprise security policy. It is in fact the final line of defense for protecting content, its ultimate function being to lock down the critical components of the operating system, as well as critical business content, its ultimate goal being to provide a new baseline for in-depth security.

The ServerLock Console operates transparently to the user and facilitates both centralized and per-host group creation and management. The novel feature here is the utilization of an industry-first kernel-based PKI to provide a hardened secure connection between systems. This is serious stuff, encompassing a 239-bit elliptical curve cryptosystem (ECC) from Certicom, making interception an unattainable goal for all but the most dogged and ingenious interlopers.

A ServerLocked system runs in either operational or administrative mode. When in operational mode, the normal day-to-day business of accessing applications and all that that entails is carried out and no type of reconfiguration or reloading can happen while ServerLock is in this mode as all protections are enabled. Reconfigurations, reloads and updates can only happen in administrative mode, and remember, it is not just a simple matter of switching between modes, as each is password protected.

It has to be said that the ServerLock Console is indeed elegantly and intuitively designed, a pleasure to use. The initial console screen gives you a world of information at a glance. This includes a network view, management groups, protection view with the machine selected and a reporting view on the bottom pane, which gives you a rolling commentary on all activities.

Color codes keep you constantly informed of your current level of security through an icon on the desktop. Green indicates that no administrator is logged on but all protections are set. Yellow indicates that the ServerLock administrator is logged on. Red is the most important one in my view. This should be the one that will inform, warn and provoke appropriate action. In my case it is the buzzer that sounds if I get out of my car without switching off the lights. The buzzer warns and informs and I reach in and turn the appropriate switch, so I will not be surprised and shocked by a dead battery when I return. The equivalent to my warning buzzer in ServerLock is the red icon, which indicates that no administrator is logged on but that at least one protection is off. This should obviously encourage the administrator to log in again and check out the protections. Finally, gray indicates that the connection or protection state is unknown. This will alert you to the fact that either you are not yet connected or authenticated, or there is an internal error in the ServerLock Manager.

There are a few potential glitches in the system that could make you vulnerable if you were unaware of them or did not fully understand the implications. One of these relates to the ServerLock disabled hardware profile, which is created on installation, and which you must use for password recovery if you were unfortunate enough to forget it. You can only invoke the ServerLock disabled profile from the system console, and booting into it completely disables ServerLock and leaves your machine unprotected. The user guide warns you to ensure that this ServerLock disabled hardware profile is not the default one - otherwise you could be working in a fool's paradise.
  

SC On-Line
SC Magazine
www.scmagazine.com