PacketSure keeps data on the inside

PacketSure is one of a group of products that protect your network from leaking confidential data to the outside world. We were especially interested in its ability to block credit card numbers and prevent specific sensitive content from slipping onto the Internet.PacketSure leverages its position at the edge of the network and has an impressive ability to examine packets and monitor and control traffic between your network and the Internet.The current version of PacketSure uses a single, compact appliance. After opening the box, we found an oversized preinstallation card.The time from opening the box to actually running the product on our network was a little more than half an hour, thanks to the quick-installinstructions on the card.You can install the PacketSure appliance to work in either pass-through mode, where data flows through it to the outside world, or in pass-by mode, where it monitors data passing around it. There are advantages and disadvantages to each configuration. Like most users, we chose the pass-by mode for convenience, connecting the appliance to a hub attached to our router. Very little configuration had to be done at the appliance's console. After the initial install, we did all the management from a Web console. As the console led us through the installation in a logical sequence, we realized this is a mature product. At first, we accepted nearly all the default configurations, which usually logged outgoing traffic but did not block any.A junior network technician can easily install and operate PacketSure. The real trick is to tune the device so it blocks all outgoing traffic you want to keep within your organization while allowing all legitimate outgoing traffic.We followed our normal method, which is to add blocks slowly over a period of days or weeks, carefully watching the results. The idea is to keep adding blocks until we accidentally block a message so important it would get us fired, or until our nerves give out, whichever is first.Some decisions are easy, such as blocking peer-to-peer programs such as BitTorrent. Blocking porn Web sites was easy, too. We put a check in one box to block sports Web sites, and then we tried logging on to a few to see what happened. In each case, we were unable to reach them.How does PacketSure do this? It has huge signature files. PacketSure's list of Web sites has more than 6 million entries, all neatly categorized. And these files are frequently updated.When my users are blocked from a site, I want them to be redirected to a page on my Web site that explains IT security policy. I couldn't see how to configure this, but a Palisade technician showed me where I had missed this feature. It will be more obvious in the next version.As we suspected, credit card numbers that we made up were not detected at all. The credit card companies use standard numbering sequences, and PacketSure easily detected real credit cards by using these sequences. We created files of real credit card and Social Security numbers, which PacketSure used for content blocking. After installing the files, we kept the appliance in a locked room for physical security.PacketSure is easy to administer, and you can customize it to your operation, blocking exactly the necessary content to secure information within the organization.PacketSure watches traffic going both ways. For example, you can block anyone from using GotoMyPC to get into your network but still allow your employees to use it to control computers on the outside.The Payment Card Industry Data Security Standard requires that, if you have cardholder data, you must disable all unnecessary and insecure services and protocols. We found that we could individually disable about 150 protocols with a click of the mouse.We have been burned before when other products incorrectly blocked critical communications. We consider false positives inescapable when using blocking software; it's a necessary cost of security.We'd like to see a feature that lets an administrator review an archive of blocked transmissions and release them if needed. Palisade officials said this is in the works.Dec. 1, 2006, the amended Federal Rules of Civil Procedure for electronic storage began requiring that organizations be able to retrieve their employees' instant messages for legal discovery.PacketSure can easily block IM, but someone in your organization may have the clout to demand IM and get it. Palisade is considering the addition of such a feature.PacketSure can't secure a laptop when it leaves the building. And, while we won't get into how, there are probably several methods a person might use to slip dark traffic past the appliance out to the Internet (although the administrator might still get lucky and catch them). But PacketSure does an excellent job of detecting and blocking private data before it can reach the Internet.Its reports are superior and well-suited to documenting regulatory compliance. The product also provides useful information on the amount andtypes of traffic passing between your network and the Internet.There are several good products in the information leak prevention field. All of them seem a bit expensive. The field is competitive, and we expect to see continued growth in features.Overall, we give PacketSure high marks for working as advertised, plus doing more monitoring, blocking and bandwidth tweaking than we were expecting.We recommend it especially for organizations using payment card data and data that absolutely cannot be allowed to leak into the hostile environment of the Internet.