The Reconnex platform is centered around the identification, monitoring, and leak-prevention of sensitive data throughout the enterprise. Its core modules and appliances provide for the discovery and identification of such information both at rest and in motion, as well as the ability to take action on that data in the form of alerts, warnings, user education, encryption, or even blocking; the latter feature facilitated by the platform's ability to communicate and function with 3rd party devices and applications including corporate switches and MTAs.

The three primary components of the platform include the iGuard appliance, the inSight Console, and the new Endpoint Agent.

The iGuard appliance is the heart of the platform and is deployed off of a switch TAP. It provides both passive monitoring of data in motion as well as the ability to scan desktops and file shares by IP address for the existence of sensitive information (discovery). The iGuard ships in two possible models: The 2U 2600, with 400 GB of storage space and targeted to small/mid-size deployments (geared for 10 Mb/sec networks); and the 3U 3600, with up to 2.2 TB of storage (external storage also supported), power and data (RAID 5) redundancy, and targeted to 1 Gb/sec networks.

The inSight console serves as the central control and management point of the platform; managing multiple iGuards and Endpoint Agent deployments throughout the network and providing the Control functions described below. inSight is required for the management of multiple iGuards and/or Endpoint Agents; but can standalone iGuards are possible.

Finally, the Endpoint Agent is deployed on Windows (2000/XP/2003/Vista) endpoints, and provides iGuard-like functionality specifically to mobile endpoints (laptops, etc.). The Endpoint Agent can provide filtering, monitoring, and scanning controls for sensitive data on the endpoint even if it is disconnected from the core network (the agent synchs with the inSight Console when the PC is next connected to the network). In addition to the transmission of data across network ports, the Endpoint Agent is able to monitor data activity to removable drives; including USB drives, CDRW, IEEE 1394, SCSI, ATA, PCMCIA, COM, and more. Such activity can be governed by centrally defined policies; allowing, for example, the movement of information that is weighted to be sensitive to a certain degree to be blocked.

Onto these core platform components, customers can load a mix of functional modules which work together to provide specific monitoring and management functions.

The Discover component provides the ability to identify sensitive information in existing file shares or repositories. Discovered data can trigger actions such as alerts, quarantine, or encryption; as well as be fed into the Monitor component for subsequent identification should the data be transmitted.

The Control component, (the inSight Console), provides the ability to define and distribute rules and policies for the identification and protection of sensitive information; as well as provides reporting and analysis features for identified and captured data. Content classification leverages a variety of techniques used individually and in combination; including content signatures, grammar analysis, and "document biometrics," the latter of which the vendor states is able to identify sensitive data even if it has been modified.

The Monitor component provides the main data-in-motion protection of the platform, and is able to recognize over 300 document types independently of the port/protocol used to transmit them. The vendor states that the Monitor component can scale to support "... hundreds of thousands of concurrent connections," and can additionally--with the help of 3rd party proxy appliances--decrypt and analyze SSL traffic.

The Capture component provides for the capture and storage of content discovered both at rest or in transit for after-the-fact analysis. The vendor states that the actual files themselves are not stored; but rather proprietary signatures are stored in the DB. Features include support for off-appliance storage (SAN, NAS), and support for indexed searches based on keywords, communication parameters, content types or other customer-defined concepts.

Finally, the Prevent component works in concert with the existing corporate MTAs, proxies (IM, FTP, HTTP, etc.), and network switches to enforce alerting (both to admins and the end users themselves, for educational purposes)and blocking policies for detected sensitive data. See the vendor's site for interoperability information.

The Reconnex platform is available now; the Endpoint Agent functionality is expected to be available at the end of April. iGuard (2600) pricing starts at $34,995, while the inSight Console starts at $40,000. Endpoint Agent is priced at $25,000, which can cover up to 1,000 users depending on selected modules.

Visit the Reconnex Web site for further information.