AirMagnet's Enterprise 5.0 is designed to deliver wireless intrusion detection, and
performance and security monitoring on a global scale. It continues to step up in class from its early offering of a cool, handheld wireless sniffer for rooting out rogue APs. Enterprise 5.0 is a big-time WLAN security/management product that can scale up to very large, distributed environments.
Through a single console, security managers can control distributed AirMagnet servers, each of which can support up to 1,500 Smart-Edge sensors. The key to this scalable and flexible architecture is the Reporter module, the WLAN analyzer tool that draws on information collected from Enterprise database servers. The Reporter can communicate with single or multiple servers; for very large installations, multiple Reporter devices can connect to all available sensors and servers to view, export or print global reports. Users can choose the information they want to draw from the servers, including signal/noise, AP list, station list, alarms, channel noise and SSID.
Enterprise's console brings all this information to the security manager's fingertips through an intuitive GUI. An overview of the entire system is displayed on the main screen, from which the user can quickly dive into detailed information on policies, known wireless assets and detected rogue devices. Our favorite feature was the Charts option, which graphically displays event summaries and trends.
The IDS/Rogue screen provides extensive details on detected unauthorized devices. It allows you to block and disable switch ports manually or automatically through policy.
One of Enterprise's few clear weaknesses is its limited ability to pinpoint rogue devices' location. The triangulation feature correlates the location of devices on imported floor plans and maps, but we found it to be inaccurate; our rogue testing came in at around 20 feet of the actual location.
If this were a cubicle maze in a multifloor office, finding the rogue device would be difficult and time consuming. Enterprise isn't a practical tool for RF coverage for sensor deployment.
Enterprise does protect and monitor the health of your WLAN rather well. It can detect 115 different WLAN vulnerabilities and performance issues. During our testing, it identified APs deployed without encryption and offered detailed remediation suggestions. It identifies common attacks and caught the dictionary and RF jamming attacks we threw at our test WLAN. It issued alerts and automatically blocked sources for the 24 hours we assigned.
Security and performance policies can be created globally or locally. Policy profiles can specify segments and sensors, the type of policy (security or performance), and importance and notification/alerts. For building custom policies, Enterprise walks you through possible violations in each event category.
Enterprise ships with an extensive assortment of standard, customizable reports that can be generated in a variety of formats, including PDF, Word, Excel, RTF, tab delineated, text, HTML and XML.
With the notable exception of its inability to pinpoint rogue locations and its limitation as a sensor deployment planning tool, AirMagnet Enterprise 5.0 is an impressive enterprise-caliber wireless security product. Pricing starts at $8,995.
This review done by Sandra Kay Miller for Information Security Magazine.
