Promisec's Watchful Eye

On the left hand side of its workspace pane, Spectator displays all the machines that are being inspected. Spectator provides options for connection through single IPs, IP ranges and computer names. After selecting the machines, Spectator displays the items on the left pane. Because only individual end points are inspected, they appear on the left pane. Administrators can also import files with IP addresses.

To select users, administrators can either import host files from Active Directory or they can use a dynamic import that integrates with it. Every time Spectator runs automatically, it will contact Active Directory to collect new end points or those that have been switched off.

Spectator provides a single-run inspection or a loop inspection. The loop inspection scans end points on a continuous basis. Loop inspections can also run via intervals that can be set in the tools menu.

On the right pane, Spectator provides a database of programs and services it can scan. The database is listed by categories such as peer-to-peer applications, service packs, remote control applications and accessible hardware devices.

The inspections are listed alphabetically allowing administrators to quickly find the scanning options that are enabled and disabled. The scans are categorized, so administrators can work with them in groups. Engineers found the list of P2P applications comprehensive.

Promisec's research department constantly scours the Internet looking for new trends in each category. If an item is not listed in Spectator, administrators can customize it using a user defined module. The module allows administrators to type the name of any application and Spectator will look for it.

Spectator is able to identify Bluetooth, network, wireless and modem cards that are available. If the wireless cards have the same IP address as some network cards then administrators can know if the cards are used simultaneously. This feature can identify simultaneous connectivity between private and public networks. Administrators can see if intruders are trying to break down the barriers between private and public networks.

If an intrusion is detected, Spectator can shut down the service remotely. Spectator can also identify removable storage devices, even if it has been unplugged before a scan and has been taken out. If a device is brought back, Spectator is able to identify the device because it maintains a record of all connected devices. In addition, Spectator can identify any software that synchronizes with hardware devices, including music managers. Spectator can remove the drivers and service remotely for the devices. It is not, however, able to block access to the devices. If a company has standardized Blackberry devices, then administrators can turn off the scans for Blackberry devices.

Changes are made on the fly, so administrators do not need to make manual corrections. Applications that are not registered cannot be removed. Some new applications such as Skype VoIP software cannot be uninstall at this time.

Step 3: Analyzing Results

Any new services or hardware running that was not captured can easily be identified in a report. Spectator provides a list of online reports through XML and HTML. The online reports immediately reflect the changes whenever any changes are made to a configuration in Spectator. One of the reports provides the number of unidentified hosts and applications running on a network.