CAST assists in detecting intruders, computer viruses and malfunctioning programs with audit policies that track specified activities such as file access and failed log-in attempts. Instead of the tedious process of clicking through Windows NT's utilities to change the audit settings for a few files and registry keys on one PC at a time, CAST let us create a policy to simultaneously change those settings for all disks, directories and registry keys on several PCs. This operation took only a few seconds. However, distributing these policies to networked PCs has to be done through another company's software distribution application, which is somewhat tedious. And once we had policies installed on several PCs, scanning the resulting event logs for suspicious activity was like looking for a needle in a haystack.
Companies can solve the latter problem by using another vendor's event-log analysis tools.
To analyze CAST's results, we used Geneva Software Inc.'s AlertPage Enterprise 4. CAST comes with a helpful set of predefined auditing policies, and administrators can also create their own. Predefined policies include ones that audit application execution, hacker attempts and attempts to access restricted files. The software is easy to use because it puts Windows NT's powerful but well-hidden auditing features in one place. To get to the auditing dialog box in Windows Explorer, an administrator has to find the file or directory to be audited, select its Properties page, select the Security tab and click on the Auditing button.