Oakley SureView v5.0
Strengths: Extremely powerful, exceptional forensic capabilities
Weaknesses: High price
Verdict: If you need very strong data-leakage protections with powerful forensics, this is the product for you. For its unique approach to forensics we designate this product Recommended
Oakley Networks' SureView appliance offers very complete extrusion prevention with a twist. Along with the usual event reports, the device can replay the actual event complete with pre-encryption data. As an investigative tool, this is unsurpassed by any other product feature we've seen.
Because SureView uses agents at the endpoints - user workstations - virtually all data leakage policies can be monitored, including the use of peripherals such as thumb drives. The product comes with more than 200 pre-made policies and adding new ones is not difficult.
Installing the appliance was easy using the installation guide provided. There is a guide to take you through the installation, setup and configuration processes, and other documentation takes over from that. The entire process is fairly intuitive.
SureView performed very well and it was easy to replay an entire incident. The replay feature behaves like a DVD player, and every action by the offending user is recorded as a set of screen shots. As a forensic evidence tool this capability really shines. Using the replay feature, you can see exactly what the violator did to cause an alarm. Usually this is enough to encourage the offender to admit their breach. For accidental behaviour, this function is an excellent teaching tool. For deliberate violators this provides all the forensic evidence you will need.
Documentation for the product is very good, but we found the website a bit thin, mostly consisting of marketing materials. Support packages can be purchased, and documentation is available online for users with a support contract.
The product is very expensive, with a price tag of £50,000. This, however, is for unlimited users, so for a very large enterprise this product is a good value. We liked SureView for its forensic capability, and it did quite nicely as a straightforward extrusion prevention tool as well. However, at its high price, it will most likely find its best application either in large organisations or in applications where extremely high control of internal information leakage is important.