The flagship offering of GuardianEdge Technologies, the GuardianEdge Data Protection Platform provides a centrally managed platform for the policy-based enforcement of data encryption and device controls for Windows based endpoints (Palm OS 5.x also supported for smartphone management). The platform is integrated with and requires a Microsoft Active Directory-based infrastructure and leverages A/D Group Policy Objects for the administration and deployment of access and encryption policies and authentication credentials synchronization.

At the heart of the offerings is the GuardianEdge Data Protection Framework, which provides the core management capabilities for each of the platform's individual components. The Data Protection Framework provides tools for the packaging and deployment of the other components (in traditional or MSI-based packages), the creation and distribution of enforcement policies (which are stored/deployed as GPOs via a policy-management MMC snap-in), user registration and management, authentication synchronization (the end user's login credentials for the data protection components are automatically synchronized with their A/D credentials), and client auditing and reporting. Endpoints communicate to the central GuardianEdge server such information as the state of the applications, compliance with assigned policies, and the security posture of protected machines. System events are accessible through the Windows System Event Viewer.

Onto this core framework is loaded the customer's choice of multiple functional components (which can be mixed as needed). Key among these are:

- The GuardianEdge Hard Disk Encryption component provides the ability to fully encrypt the end point's hard drive using 256-bit AES encryption (FIPS 140-2 validated). Users access the drive via pre-boot authentication (both passwords and smartcard/token-based authentication are supported), with Single Sign-On supported to the network domain. Encryption and decryption is transparent to the end user, and targeted users can be remotely disabled by administrators, among other features.

- GuardianEdge Device Control enables the selective, policy-based control of input/output operations on endpoint machines; the vendor lists USB, FireWire, serial, parallel, infrared, CD/DVD, floppy disk, tape, WiFi, and Bluetooth communications as supported. Policies can be implemented broadly (allow or deny all), or via parameters allowing for such actions as permitting read-only access to specific devices at specific times. Other features include support for white-lists by pre-defined devices and device models, class, type, or serial numbers; data movement tracking and auditing; file type controls that allow for the controlling of reading/writing based on file types; support for "shadow files," by combinations of specified file types, computers, or groups, that target specific files for file movement logging and/or automatic mirroring to the central repository; support for CD/DVD white lists; alerting and logging for internal port access (IDE, SCSI, ATA, etc.); eDirectory support; and support for internal or external SQL databases.

- The GuardianEdge Removable Storage Encryption component provides 128 or 256-bit encryption specifically for data on removable drives, such as USB, FireWire, compact flash, iPods and other storage devices. Policies can be implemented enforcing data protection at the file level, with access protected by passwords or digital certificates. An Access Utility, with the ability to encrypt and decrypt the data, resides on the removable media itself; enabling the drive to be accessible from any computer.

- GuardianEdge Smartphone Protection (Palm, Pocket PC, Windows Mobile, Symbian) extends the platform's protective features to Enterprise smartphones; including policy-based encryption of data on smartphones (files, DBs, removable media), controlling of access to applications, ports, WiFi, and external devices from the smartphone, and network access controls that ensure the device is compliant with corporate policies before allowing it to connect to the enterprise network. Additional features include support for device wiping based on extended device inactivity, password failure thresholds, or Over-The-Air administrative actions; support for application-specific passwords; and a self-service portal for resetting forgotten passwords.

Other complementary products in the line include Device Control Auditor (provides an assessment of currently connected peripheral devices on end user machines); Advanced Authentication (adds multi-factor authentication support for the Hard Disk Encryption or Removable Storage Encryption products); and the Altiris Connector (enables the deployment and monitoring of Hard Disk Encryption and/or Removable Storage Encryption through the Altiris console).

The latest platform release boasts enhanced versions of both Hard Disk Encryption and Removable Storage Encryption, with new features including support for Novell eDirectory and non-domain machines as well as enhanced reporting and auditing capabilities.

Visit the vendor's Web site for further information.