SafeStone Entering Cross-Platform Security Arena

by Alex Woodie

SafeStone is developing the AxessIT suite because it sees a need in the market for a role-based application control solution that directly applies a company's security policies to its IT infrastructure. This RBAC solution will span many modules that customers will be able to mix and match to fit their needs. Users will like this mix-and-match approach, company officials predict, because existing RBAC solutions from competitors require users to purchase the entire suite at a heavy premium.

In addition to the Web-based single sign-on solution, called AxessIT Web, SafeStone says the additional modules to be released in the future will include Resource Manager, Policy Manager, Role Manager, User Manager, Delegation Manager, Audit Manager, Password Manager, Digital Certificate Manager, Customized Communication modules, and a Director Services module.

AxessIT Web Version 2.5 is a Web-based access control gateway designed for single sign-on access to Web applications and simplified administration of user accounts. The application is based on source code that SafeStone acquired in an OEM agreement with Seven Mountains Solutions . Seven Mountains recently went out of business, and SafeStone has since purchased all the rights to the source code, SafeStone officials said.

Almost any application that can be Web-enabled can be accessed through AxessIT Web, including 5250, 3270, or Unix emulation programs that are delivered through a Web browser; 32-bit Windows desktop programs that have been Web-enabled through Citrix Windows server middleware; Java-based apps delivered through a Web application server such as IBM WebSphere or BEA WebLogic; enterprise information portals; and many more. AxessIT Web can be configured to access multiple applications through a single browser-based log-on screen, thereby simplifying access and reducing the complication associated with having to remember different user names and passwords.

AxessIT Web is also designed to reduce the administrative overhead of maintaining user accounts and licensing agreements. Administrators can classify users based on their role--employee, customer, supplier, or business partner--or create teams of users and allocate their privileges based on that team's roles and responsibilities. The software also provides reporting functionality that gives systems administrators details about who is accessing which applications, and allows them to compare those details against various types of licensing agreements, for particular applications. (See SafeStone's white paper on AxessIT Web .)

SafeStone is currently preparing the second AxessIT module, called AxessIT Resource Manager, for beta tests. It appears that AxessIT Resource Manager will function as the core component, upon which the remainder of the AxessIT suite will be built. The software runs on "hardened" Microsoft Windows 2000 servers (where Windows 2000 is configured for optimum security during the set up) and makes extensive use of the Java 2 Enterprise Edition framework.

The core difference between AxessIT Web and AxessIT Resource Manager appears to be the level of access provided into target operating systems and applications. SafeStone's literature for both products extensively refers to the RBAC features of both. However, whereas AxessIT Web concentrates on controlling the access of the individual user from a central squeeze point, or gateway, AxessIT Resource Manager will feature agent-like clients that deploy to target systems such as OS/400 systems or Windows application servers. These clients appear to be aimed at allowing systems administrators to manage user accounts and provision resources according to the security policies chosen as the best fit for that particular platform. (See SafeStone's white paper on AxessIT Resource Manager .)

The beta version of AxessIT Resource Manager, Version 1.0, will feature "agents" for OS/400 and Windows NT/2K. Agents for AIX, Linux, and OS/390 are also in the works but will not be available with the beta release.

SafeStone was formed in 2000 following the acquisition of CCT by SoftScreen. CCT was one of the first software vendors to roll out an application that augmented the built-in security of OS/400, which it called DetectIT, and SoftScreen was its London-based distributor for DetectIT. Following the acquisition of CCT, SoftScreen changed its name to SafeStone.

SafeStone says it has about 1,500 users of DetectIT, split fairly evenly between Europe and the United States. Company officials say its American operations, which are based in Princeton, New Jersey, have been growing rapidly in the last few months. For more information about the company, visit www.safestone.com .