Websense vs. PestPatrol

I would just like to get some opinions from those who've had experience with these programs...

When it comes to enterprise-wide spyware protection, which do you prefer? Websense or CA PestPatrol? I've been playing with evaluation versions of both and I'm having a hard time deciding which one to recommend for purchase.

I tried out PestPatrol, and it looks to a great job and scanning everyone on the network, especially with real time scans. However, the BIG problem I have with it is that each client machine has to cough up a massive amoung of memory to give to PestPatrol's remote services. Because of that, PestPatrol really slowed down our machines.

I'm impressed with Websense so far. Whereas PestPatrol is simply an antispyware solution, Websense is a comprehensive security package. However, I don't see much in the way of real-time spyware scanning like PP has. Websense seems to focus more on preventing malware from having access to the computer.

But I don't know much yet, since I've just been playing with the evaluation versions for the past couple of weeks.

Which program do you prefer and would recommend for an enterprise-wide solution?

Hi Angelic~ I don't think that there is a definitive answer to your question, as both products have a different approach.

Websense is an internet/web filter whereas PestPatrol is a more traditional malware scanner, and has a real time element.

I guess you will have to sit down and figure where your most likely attack vectors are. This will obviously depend on how your users use your systems?

I am no expert, but you might be able to emulate a lot of what websense does in your policies, routers and firewalls? Particularly if you install some executable blocker as well.

Whilst you are doing evaluations:

http://www.ewido.net/en/

A multipurpose malware scanner with interactive scanning capabilities

http://www.emisoft.com/en/software/free/

A specialist trojan and dialer scanner that will also catch some worms and spyware.

:D

Websense isn't designed to be a realtime spyware scanner. It's meant to show you exactly what's going on within your organization right down to the keystrokes entered by the end users. It's best used for policy enforcement.

However, I have found that Websense's protocol analyzer is extremely effective in identifying botnet infections. It also allows you to see how successful your spyware remediation has gone. You can look at the hitcounts and see if you're making any headway. This isn't a guarantee because we know that spyware will soon (if not already) be using encrypred connections over SSL to retrieve commands from the control server but again, Websense is a totally different solution than pest-patrol.

I'm the enterprise Websense admin (among other things) so if there is something specific you want to know, I'd be happy to answer.

Just a warning, websense blocks Maddox . :p

LOL. Yes, and it blocks a list of others like somethingawful.com and ebaumsworld.com

;)

theHorse13 beat me to it. Websense is not meant to be a "real-time" spyware scanner like Pest Patrol but with a little tuning it can be very effective in that approach. What we have done is keep an updated block list of known spyware IPs along with trending such as theHorse13 mentioned. Websense combined with the newest release of Norton Enterprise Antivirus 10.0 (provides spyware eradication) has been fairly effective for us.

Quote:

---

However, I have found that Websense's protocol analyzer is extremely effective in identifying botnet infections.

---

Looking at the real time analysis and web reporting for the first time, was the first time, I was able to get a clear snapshot of the overall posture of bots on the network. Excellent, worth the price of websense alone. Does Pest Patrol filter protocols as efficient as websense? Protocol based filtering/logging is another plus to websense. I also like the quota time function where you can loosen the strings a little but still effectively manage connections.

As mentioned even with Client Policy Manager (an option I did NOT pay for) Websense is not nearly an effective spyware prevention tool. I rely on McAfee for that at the present. But with wensense you KNOW who is infected and can act on those devices with amazing clarity as to what is going on.

I absolutely HATE websense... but that is from the end user's point of view.

I have no admin control over ours... :(
I just know its good at its job. (Though, I have figured out many ways around it.)

Mine isn't inline, there fore would be very easy to bypass.

I Love WEBSENSE!!!!!!!

A word of warning. Since it is a stateful packet inspector GET A BIG BOX. I have Websense / Cisco pix integration running on a quad Zeon PIII with 2.5 GB RAM.

The benefits are No IM, No streaming media (see attached), No EXE's, com's, bat's, key word blocking. And learning how to set new rules does not require a two week training class.

Of course I use a static address and set Websense to ignore all requests from my ip.

He is correct. Depending upon how much data you are collecting and what your userbase adds up to, you can find your Websense boxes hammered into the dirt. I have 3 big ass quad Xeon servers handling the load along with half a terabyte of storage for the logged data.

Try CounterSpy Enterprise (www.sunbelt-software.com)

Quote:

---

Websense boxes hammered into the dirt

---

There is a significant performance boost running the network sensors on Linux. ;)

My boxes are also in the ignore list on the sensors themselves. :D

Yep, we're in the process of migrating them over to a Linux platform. Unfortunately when we first setup the solution we had to use Win32 but now that we're in full control of Websense, Linux will be comin to town.

:)

So are there any hardware alternatives out there?