August 22, 2016
- Ease of Use:
- Value for Money:
- Overall Rating:
- Strengths: Very simple to deploy and an effective endpoint protection approach.
- Weaknesses: None that we found.
- Verdict: Solid, simple product that will fit well in large or small enterprises.
Bufferzone uses a unique approach to protecting the endpoint. Rather than detecting threats and blocking them, it simply contains them. It places endpoint applications - those that either housed at the endpoint such as browsers or those that execute on the endpoint as client-server applications - into a secure container. The container spins up automatically when the application is launched. Browsers, for example, launch with a red border, indicating that they are contained. Applications that are considered "safe," launch with a green border. This ensures that the user knows they are protected. The exception is email. Email launches with a yellow border and that tells the user that the email and any attachments are tagged and protected. The tag is persistent.
Bufferzone permits reading but no writing. So, when a user surfs to a malicious site everything is fine until the site tries to write something that, in turn, tries to write out to the computer. That will be stopped. The result is good protection at the endpoint without sacrificing performance. The containers are fully virtualised rather than being some sort of barrier between the malicious application and the operating environment that can be bypassed by clever malware. The virtualisation extends only to the application, not to the operating environment.
The isolation addresses the four main areas of the computer: file system, memory and processes running therein, the registry and the network. "Safe" sites are those that are designated by administrators as internal sites. These are allowed to bypass the Bufferzone controls. However, external sources are considered potentially hostile and are contained. This includes the usual internet applications - such as browsers, Skype, etc. - but it also includes other external sources, such as thumb drives.
Thumb drives make an interesting use case. There are valid reasons why a user might not want to be restricted to reading from the drive, but likely will want to save to it as well. That's fine, but you can't go the other way and write from the thumb drive to the computer.
The endpoint piece is very lightweight consuming only about 70MB of RAM. It is simple to deploy. This brings up another unique feature: the product does not have its own management console. Rather, it integrates with your existing management stack, such as LANDesk, Microsoft or McAfee ePO. This saves money and puts it under the same pane of glass. However, for smaller installations, there is an on-premises Bufferzone management console available. For larger implementations, the third-party management console can be used for deployment.
Bufferzone can integrate with SIEMs and other analytics tools. It recognises and collects more than 40 kinds of events, including such things as registry alterations and network activity. This provides the sort of intelligence that is valuable in preventing repeats of potential incidents. It will run in Windows 7 and higher and requires 4GB of RAM or more and at least 500 MB of available disk for installation space.
Support is good with eight-hours-a-day/five-days-a-week assistance included in the purchase or subscription price. More extensive aid may be customised and quoted as a separate service. The support portal is a customer-only login on the company's web page. In addition to the support page, the website has a resources page with a lot of supplementary material that should be useful - both during the buying process and after deployment. The support portal offers phone and email support with a built-in ticketing system so users can track trouble calls.
Price is reasonable and, overall, we saw nothing objectionable in the product. We did see a lot to like, however, and that makes this a very viable offering in the purely endpoint security arena.
SC Webcasts UK
Information Security Manager
Infosec People - Hammersmith, West London
Junior Penetration Tester, Hertfordshire, to £35k + benefits
Infosec People - England, Hertfordshire
Cyber Security Architect
CYBER EXECS - London (Greater)
SOC Analyst, Aldershot, £47-56k + package
Infosec People - Hampshire, England, Aldershot
Senior Security Engineer
Loveworklife Recruitment - United Kingdom
Sign up to our newsletters
SC Magazine UK Articles
- Tesco Bank allegedly ignored warnings of hack from Visa
- Investigatory Powers and Digital Economy Bills could threaten economy
- Updated: A million German routers knocked offline by failed Mirai botnet attack
- Gooligan ad fraud malware infects 1.3M Android users, installs over 2M unwanted apps
- Microsoft update left Azure Linux virtual machines open to hacking
- SC Awards Europe 2016 winners announcements!
- ISIS radicalises 'lone wolves' through strong social media presence
- Updated: How will Brexit affect the cyber-security industry in UK and Europe?
- 9.2 million medical records for sale on darkweb
- Microsoft Office 365 hit with massive Cerber ransomware attack, report
- ICYMI: Tesco warned; IP Bill threatens economy; German routers offline; Azure trojan; Gooligan fraud
- Data centres are on the move - where will they end up?
- 90% of ITDMs believe IAM is crucial to digital transformation success
- Research: Hacked companies could see customer exodus if breached
- Misconfigured drive exposes locations of explosives used by oil industry