Mucking Up Malware

SonicWall NSA 3500
It took reviewers a good hour to work the kinks out in setting up this appliance. It is not as intuitive a configuration as the other devices. Yet, the NSA 3500 offers a lot of granular control and some functionality not seen in the previous devices.

For example, the NSA 3500 offers configuration options for WAN failover and load-balancing. The WAN interface can be checked in specified intervals. There is also a feature, High Availability, which provides redundancy with a second, synchronized NSA 3500.

The appliance has a diagnostic tool and packet-capturing capability for troubleshooting. Diagnostics can be gathered in "tech support result" format and will report in VPN keys and ARP cache. In addition, it will manage VoIP and wireless.

Performance of the appliance was a little lethargic. There was some delay switching between areas of the management interface, and the clients did not seem to "take" to applied policies right away. Yet, once they did, the NSA 3500 made up for performance by detecting a number of intentionally placed threats on the test network. The dashboard picked up on Netsky malware, spyware and blocked multimedia per a defined policy, such as Skype and BitTorrent.

Reviewers didn't see a way to customize the dashboard, and there was no way to drill down to particular items in the dashboard. There are reports options, however, to display detailed information. This appliance features modules besides content filtering: antispyware, RBL filter, client antivirus enforcement and gateway antivirus enforcement.

The Bottom Line
Each device got the essential job done: filtering content and enforcing Web-usage policy. The SonicWall NSA 3500 provides even more with the capability to do sophisticated diagnostics. It's more of a complete network-management solution. Still, it was somewhat disappointing performance-wise, and the initial install was not as smooth as with the other products.

ContentWatch's CP100, although a bit tough to initially get going, gives magnificent reporting in real-time. The ability to see a lot of information without a lot of mouse clicks is definitely a time-saver for a harried system administrator.

But the Sophos WS1000 has the edge. It was breathtakingly simple to set up, but that in no way negates how effective a content filter this appliance is. The scanning capabilities are excellent, and it would take the most stealthy of ruses for any malware to get by this device. A little more flexibility in the dashboard would be nice, as would the ability to drill down to more detailed information from one screen. Still, the WS1000 impressed the reviewers very much.

One thing is certain: There's no foreseeable end to the evolution of malware and Internet threats. Invariably, that means no end to the evolution in the devices designed to combat them.