AlgoSec's firewall-rule tracking platform can now do the same for VPNs made by major vendors that terminate on network firewalls.

Its VPN Analyzer software can display rules for site-to-site and remote-access VPNs on a single HTML page and lets administrators drill down to see more detail about individual rules. VPN Analyzer can reveal the groups that have VPN rules defined for them and display a table of rules for a chosen group, for example. This ability to drill down is something AlgoSec says is difficult or impossible to do with tools provided by firewall/VPN vendors. (Compare security information management products.)  

The software is compatible with firewall/VPN gear from Check Point, Cisco and Juniper Networks, which combined represents most of the firewalls being sold.  

VPN Analyzer lets administrators sort groups and rules in multiple ways, checking which groups individuals are members of, displaying all members of a given group, and the like.

The software can flag and eliminate users whose access has expired but for whom rules still exist, as well as list users who are defined in the firewall/VPN but for whom no rules are defined. Cutting out this dead wood cleans up definition databases and makes it simpler to understand policies that are in effect, AlgoSec says.

Customers can also receive a risk assessment of traffic coming through VPNs. Many organizations allow network access through VPN tunnels and assume it is secure, AlgoSec says. With VPN Analyzer, they can scan VPN traffic and flag types that may represent security threats.