With Security Blanket 3.0, you won't lose sleep over Web-facing servers

Pros: Covers many existing organizational guidelines
Cons: Client software needs to be installed on each client
Performance: A-
Ease of Use: A-
Features: B
Value: B+
Price: $3,000 for Admin Console and $198 per client (government price $2,550 for Admin Console and $168 per client).

Network administrators know the importance of locking down a server that connects to the Internet. However, because almost all operating systems are designed to be used in a variety of environments and for many purposes, administrators must do a lot of work to minimize the chances that someone hacks the systems via a network connection. In addition, they must also have intimate knowledge of the inner workings of the operating system they want to secure.

Various organizations have developed standards to define a common operating system configuration that is secure for their purposes. The most commonly used standard is the Defense Information Systems Agency’s Unix Security Technical Implementation Guide. DISA developed the STIG for the Defense Department, and many other organizations in government and the private sector also use it.

Even with those standards as guides, locking down the ever-increasing number of servers and other computers that are potentially vulnerable is no easy task. And it’s an ongoing process, as new exploits are found and patched, so you can’t go through and lock everything down once and expect your systems to remain protected. Someone could find a new tunnel into your secure network if you’re not careful. That threat is even more intense if a network contains servers with different types of operating systems. If an administrator is not versed in every type of operating system — as few people are — it adds yet another potential problem.

Security Blanket Enterprise Edition Version 3.0 from Trusted Computer Solutions could be the tool administrators need to secure networks and stay one step ahead of the bad guys.

Security Blanket can lock down any Red Hat Enterprise Linux, CentOS or Sun Solaris server in your network. We found installation of the software to be reasonably easy, although you need to install it on each server you want to cover. After installing the Administration Console, it can be accessed through a Web interface.

We were pleased with the easy-to-use administration console. We could quickly identify Red Hat Enterprise Linux, CentOS and Solaris machines on the network and organize them into groups according to various factors. Then we could scan an individual computer or group to check for compliance with any one of eight established standards, including DISA’s Unix STIG, the Center for Internet Security’s benchmarks and DOD’s Joint Air Force Army Navy 6/3.

If your organization’s security policy differs from those standards, Security Blanket gives you the option to create a custom profile based on one of the established standards or made from scratch. Security Blanket has 192 modules, each of which disables a potentially vulnerable function or alters a setting to make the computer more secure.

If an administrator were to go into the operating system of a single server, it might take a week to tweak each of the various functions until it was compliant with DISA’s Unix STIG. We were able to do that task with Security Blanket on three CentOS servers in only a few hours. You also can scan a computer or group for compliance with a profile without making any changes.

Security Blanket also has a handy automatic configuration undo function. If a computer or group is configured to meet a guideline profile and then is unable to run a certain application properly, Security Blanket can undo the changes it made. You can then isolate the module that caused problems for the application.

The Reports section will allow a network administrator to prove compliance with a particular standard. The software can generate assessment reports after a scan and outline the computers in a group that pass or fail each point of a selected profile. Baseline reports enable an administrator to quickly see any changes that have been made to a computer since its last scan.

You can schedule scans and profile applications to run at certain times, either once or periodically.

Trusted Computer has set a reasonable price for the Security Blanket Enterprise Edition at $3,000 for the Administration Console software and $198 for each client computer covered. The government price of $2,550 for the Administration Console and $168 per client computer make it an even better bargain.

This software is good for any network administrator who needs to protect Linux, CentOS and/or Solaris servers on a network. And it is especially ideal for network administrators with those types of servers who are not experts with all of the operating systems.

Trusted Computer Solutions, 703-318-7134, www.TrustedCS.com