Trusted NT-Security Powertools (SANS Rept)

[Vin McLellan <vin () shore net>]

        Intriguing and informative numbers for the most trusted, most
popular, and the most highly recommended h/w and s/w tools to enhance the
security of NT systems and networks.

        This guide is another of those impressive "cooperative research"
reports from the System Administration, Networking, and Security (SANS)
Institute. See: <http://www.sans.org/powertools.htm>

                                _Vin
---
<SANS text>

Windows NT Power Tools --
The Administrators' Consensus

The results are in and the winners areŠ.

More than 350 NT administrators and security professionals
participated in the recent SANS Institute project designed to
identify the best tools for improving security, performance, and
administrative efficiency on Windows NT systems. We call those
the Power Tools.

The group members first identified the products that are most
commonly found in NT environments. Then they rated every tool
they use or had used, from critical and highly recommended to
not-recommended and not meeting expectations.

For the first phase, they focused their attention on the
higher-priced Power Tools that are more difficult to install and
use, thereby excluding low-cost utilities and virus protection
systems.

They also went much deeper, identifying the specific business
value that reach product provides, the names of competing tools
and the reasons they selected each one over its competitors, the
surprises they encountered in implementing and using them, and
the capabilities that they most wish the vendor would add in each
tool.

These in-depth findings are the subject of the full report,
"Windows NT Power Tools: Administrators' Consensus,"  which will
be provided free to all attendees at SANS98 (Monterey, May 7-15)
and NT-SANS.

Sample Report <http://www.sans.org/nt_power_tools.htm>

(The NT Power Tools Guide will be distributed to all who attend the SANS 98
conference next month. If you are not able to attend SANS98, you may order
the full report for $59 prior to May 15 and $99 after May 15. A pdf
version, licensed for up to 6 users, is available for $99 before May 15 and
$149 after May 15. To purchase the full SANS report on the 22 most trusted
NT Security products, see:
<https://nt4.corpsite.com/secure_escal/ntpowerform.htm>)


<<<<Here are the results on popularity and ratings:>>>>>


1. Which power tools are most commonly used in Windows NT
environments?

This table tells how likely a product is to be used in a Windows
NT site. It is the ration of the number of people who say they
use the product to the total number of people who said they use
any product.

Microsoft SMS 56.3%

Seagate BackupExec 48.5%

Cheyenne ARCserve 44.5%

Citrix Winframe/Enterprise 36.7%

ISS Internet Scanner 33.2%

Security Dynamics SecureID 30.1%

IDI Kane Security Monitor 27.9%

ISS RealSecure 27.1%

Mission Critical SeNTry 17.9%

CA-Unicenter 17.0%

Legato NetWorker 16.2%

Security Dynamics ACEServer 16.2%

Security Dynamics SecurPC 14.4%

Tivoli TME10 13.5%

Axent Omniguard 13.1%

NCD WinCenter 8.7%

Mission Critical Enterprise Administrator 7.9%

IBM ADSM 7.0%

Schumann SAM 5.7%

Memco SeOS WinNT 3.5%


2. Which power tools are most likely to be seen as critical?

This table ranks the products based on the ratio of the number
people saying the power tool was critical, to the number of
people who said they had used or use the product. For example, if
a product falls below 20%, that means that fewer than one in five
users consider it critical. This is a very demanding criterion.
Table 3, below, uses a less severe criterion.


<<More than 50%>>

Seagate BackupExec 54%


<<40% to 50%>>

Cheyenne ARCserve 49%

Security Dynamics ACEServer 47%

Security Dynamics SecureID 40%


<<30% to 40%>>

Mission Critical Enterprise Administrator 35%

Citrix Winframe/Enterprise 34%

ISS Internet Scanner 33%

Legato NetWorker 32%

Tivoli TME10 31%

NCD WinCenter 30%


<<20% to 30%>>

IBM ADSM 29%

ISS RealSecure 24%

Security Dynamics SecurPC 24%

Mission Critical SeNTry 20%


<<10% to 20%>>

Microsoft SMS 19%

IDI Kane Security Monitor 19%

CA- Unicenter 14%

Memco SeOS WinNT 10%


3. How likely are users of the product to recommend it to other
users?

Here we rank the products by the percent of people who said they
would recommend it.


<<More than 2 out of 3 recommend it>>

Security Dynamics ACE/Server 92%

Security Dynamics SecureID 82%

Seagate BackupExec  76%

ISS Internet Scanner 75%

Security Dynamics SecurPC 74%

ISS RealSecure 70%

Citrix Winframe/Enterprise 70%


<<One half to two-thirds recommend it>>

Cheyenne ARCserve  66%

IDI Kane Security Monitor 63%

Microsoft SMS 62%

Mission Critical Enterprise Administrator  60%

Sistex Asssure 60%

Mission Critical SeNTry  57%

TivoliTME10 56%

Schumann SAM 53%

Axent Omniguard 53%


<<Less than one half recommend it>>

NCD WinCenter 48%

Legato NetWorker 45%

Wheelgroup NetRanger 44%

IBM ADSM 38% CA Unicenter 37%

Memco SeOS WinNT 30%

----------
<End SANS text>

The "sample report," noted above, is really a sample review of one product
from their full NT Power Tools Guide. It indicates the depth and detail
involved in this SANS cooperative research effort.  See the sample product
analysis at: <http://www.sans.org/nt_power_tools.htm>  Again, to purchase
the full NT Power Tools Guide, see:
<https://nt4.corpsite.com/secure_escal/ntpowerform.htm>


<<SANS background & future events>>

The SANS Institute is a cooperative research and education
organization through which system administrators, security
professionals, and network administrators share the lessons they
are learning. It offers educational conferences and in-depth
courses, cooperative research reports, and electronic digests of
authoritative answers to current questions.

SANS Planned Events:

<<SANS 98>>
<<Monterey, CA, May 7-15, 1998>>

The 7th annual System Administration, Networking, and Security  (SANS)
Conference, has been enhanced with NT-SANS, a special training program
which uses Unix savvy and experience to inform and analyze options for NT
Security.

"The seventh annual gathering of system administrators, network managers,
and security professionals is scheduled for May in Monterey, California.
SANS98 offers 43 full and half-day courses on UNIX and network management
and security, plus 12 courses on Windows NT. In addition, SANS98 offers a
five-track technical conference featuring invited presentations,
short-courses
on hot new topics, birds of a feather sessions, and the largest exhibition
of useful tools we've ever assembled."

See: http://www.sans.org/sans98/ataglance.htm
See "More on SANS NT": http://www.sans.org/NT/nt2.htm
See SANS faculty: http://www.sans.org/sans98/faculty.htm

<<SANS Network Security 98>>
<<Orlando, FLA. Oct. 25-30, 1998>>
Call For Papers:
http://www.sans.org/NS98/nscall.htm


<<Other SANS Resources>>

SANS Network Security Digest (Mitchell Crabb, editor)
http://www.sans.org/digest.htm

SANS NT Security Digest (Jesper M. Johansson, editor)
http://www.sans.org/ntdigest/ntapril.htm

SANS's Cooperative Research Projects:

"NT Security, Step by Step"
http://www.sans.org/ntstep.htm

The annual SANS System Admin & Security Survey
http://www.sans.org/salsur.htm

SANS also has several new "cooperative research" initiatives underway to
develop "Step by Step" Guides for technical managers and administrators on
Incident Response, Intrusion Detection, VPNs, and Firewall Troubleshooting.


-----
      Vin McLellan + The Privacy Guild + <vin () shore net>
  53 Nichols St., Chelsea, MA 02150 USA <617> 884-5548
                         -- <@><@> --