Startup Pushes Storage Security

Startup PacketMotion is looking to lock down servers and storage with its first products that control access to these internal systems. (See PacketMotion Fortifies Net Security.)

In recent years, technologies that control the network edge, such as firewalls, have become commonplace. But users are now putting other parts of their internal IT infrastructure under the security microscope. Today, for example, IBMs annual global security survey warned that employees are now prime suspects as criminals shift their attention from software vulnerabilities to insider attacks. (See IBM Expects Cyber-Crime Surge.)

In a nutshell, PacketMotion’s new PacketSentry products check network traffic for potential security violations. This could be, for example, when someone in sales or HR gains access to applications on a firm’s finance server.

PacketSentry consists of two separate devices: a 2U probe and 1U manager device. The probe monitors network traffic by connecting to the span port of a switch, which, in turn, links to standard file servers or NAS devices. The appliance converts the switch information into metadata and sends it to the manager device, which imports the data into a Microsoft SQL database for IT managers to check.

“I haven’t seen anyone else that has got this exact same approach,” says Roger Blakely, vice president of IT and information security at Novato, Calif.-based digital media company Sonic Solutions. “We can see who is going to what asset and who is doing what.”Blakely told Byte and Switch he opted for the startup over an endpoint security product from Vernier Networks. “Initially we looked at endpoint solutions. They could provide us protection at the perimeter but not protection internally,” he added.

Another user, Herb Tong, network infrastructure manager for the City of San Francisco, is currently testing the PacketMotion boxes. “It’s going pretty well,” he said. “About four of five months ago viruses such as Zotob were hitting our internal network pretty heavily.” The system makes it easier for him to prevent or contain the impact of a virus.

Tong added that prior to deploying the PacketMotion boxes, his organization relied on protocol analyzer software to monitor its internal data. Although he wouldn't reveal the vendor, he said that the software had its shortcomings. “The protocol analyzer was taking too long to set up filters and analyze all the research data,” he explains.

In contrast, he says, PacketMotion’s probe and manager collate information much more quickly. “We’re able to capture and act on what we saw within a very short time period -- within the hour, versus four hours."

Sonic Solutions' Blakely also feels that the uses of protocol analyzer software are limited: “Rather than spending money on a protocol analyzer and other tools, [PacketSentry] allows us to do multiple things” -- like respond to virus outbreaks or protect intellectual property.Both IT managers tell Byte and Switch that they're looking to link their PacketMotion boxes with their NAS implementations in coming months, although they want the startup to sort out its software updates pronto. “During the beta testing they were rolling out new releases every two or three weeks,” Tong notes. “When the product is in a production environment, I would like to have new releases come out on a scheduled basis.”

Blakely echos those sentiments. “We have never had an update that has caused us an interruption of service, but, as they mature, we would like to see the number of updates drop."

The probe and the manager list for $50,000 and $25,000, respectively, although Scott Ruple, PacketMotion’s vice president of marketing, says volume discounts may apply.

The PacketMotion devices are available immediately.

— James Rogers, Senior Editor, Byte and SwitchOrganizations mentioned in this article: