IN THE BOARDROOM™ with...
Mr. James Van Bokkelen
President
Sandstorm Enterprises, Inc.

SecuritySolutionsWatch.com: Thanks for joining us today, James. Please give our audience an overview of your background and your role at Sandstorm Enterprises.

James Van Bokkelen: Sandstorm is the third startup I've been involved with; the first was PTC, a touch-tone/voice response company, the second was FTP Software, a pioneer in putting PCs on the Internet, that went public on NASDAQ in 1993. FTP was a fun place - rapid growth, good cash flow and a lot of high-energy interaction with customers and other Internet software developers. I participated in several important Internet standards efforts and learned a lot about protocols, supportable software and interoperability.

Sandstorm was my introduction to the IT security arena. We founded the company in 1998, with a focus on "Tools with Sharp Edges", new software and technologies to cover some of the gaps in the then-state-of-the-art. Now, in 2006, we've got two products with a pure security focus, and two more general purpose tools with many security applications.

SecuritySolutionsWatch.com: Sandstorm's NetIntercept is a network forensics and analysis appliance that inspects data entering and leaving the organization via the Internet. Please give us an overview of NetIntercept, other offerings in Sandstorm's product line and the key competitive advantages which are offered.

James Van Bokkelen: PhoneSweep was our first product. Before it came out in 1998, people needing to secure their perimeters against rogue modems had to use the same low-level wardialing tools as their attackers. We excelled in ease of use, robustness, throughput, reporting and tech support, and captured most of the market in a year or two.

Our telephone honeypot, Sandtrap, was an offshoot of the PhoneSweep technology, and it was another first: There's no other commercial tool for detecting and trapping wardialers.

NetIntercept is aimed at a broader audience: A second-generation network analysis tool, it lets you work with connections and sessions between machines on the network, rather than individual packets. It is a superior choice for a security professional who needs to pursue illicit activity or analyze the aftermath of an attack.

LANWatch has the longest history of any of our products, as it goes back to NetWatch, the first graphical Ethernet packet monitor developed at MIT in 1983. Sandstorm purchased it primarily to use as a packet viewer for NetIntercept, but we offer it as an independent product as well.

SecuritySolutionsWatch.com: We understand you've had several impressive winsin the U.S. Government sector. Without divulging any confidential or sensitive information, can you tell us about 1 or 2 success stories?

James Van Bokkelen: With PhoneSweep, it's more a question of which governments and agencies aren't using it. We're the go-to people, and telephone scanning is a recommended practice. Only a few groups have the "not invented here" mentality that would keep them from coming to us. With NetIntercept, it's not just the U.S. Government: we've sold NetIntercept in a number of countries. Some sites are doing event analysis; others are doing routine monitoring of traffic. International customers have a completely different perspective on accidental leaks of confidential information than our commercial customers: there are more leaks; many of their personnel know it, and there's much more at stake.

SecuritySolutionsWatch.com: What about wins at the State and Local level?

James Van Bokkelen: Below the national level, there isn't the same focus on security. Our PhoneSweep sales are concentrated in money-handling departments like taxation and pension management. NetIntercept sales to states, cities and counties are mostly being used operationally, and to detect and investigate abuse of resources and harassment.

SecuritySolutionsWatch.com: Sandstorm Enterprises also serves security consulting firms. Can you provide some examples of these relationships?

James Van Bokkelen: Most consulting firms, big or small, offer telephone scanning services. They don't advertise the details, but they almost always deliver with PhoneSweep. The product's template driven report system was designed for customization by consulting firms, and it's been very successful in that regard.

NetIntercept isn't widely owned by consulting firms, because traffic archiving, event analysis and routine monitoring are site-specific and done on an ongoing basis, rather than engagement by engagement. But we have quite a few sites where the security function has been outsourced to a contractor who runs NetIntercept for their customers.

SecuritySolutionsWatch.com: Let's turn to the enterprise verticals for a moment. Are there success stories in the finance, healthcare, and other verticals you'd like to mention?

James Van Bokkelen: It's a rare financial firm that doesn't either own PhoneSweep, or hire a consulting firm for periodic sweeps. We've also sold a lot of NetIntercept there, primarily for event analysis; those firms have enough at stake that they can't just trust a signature-driven IDS to catch everything that matters. Healthcare, high-tech and manufacturing firms in competitive markets have similar types of concerns.

SecuritySolutionsWatch.com: We noticed the following favorable mention about NetIntercept in "Digital Evidence and Computer Crime" (2nd Edition, 04), "NetIntercept's graphical user interface allows the examiner to select criteria for filtering such as source and destination IP addresses within a certain time period. Also, NetIntercept interprets protocols rather than simply making assumptions based on default ports." That's a pretty impressive endorsement. Any comments? Are there any nominations, awards or other press mentions you'd like to talk about?

James Van Bokkelen: We earned that: NetIntercept's competition shows you a web page by passing captured HTML to a browser. We capture the connections that fetch the page contents and correlate them to the HTML. We showed the author that we had the advertising images from the original page view, while competitors fetched new ones.

PhoneSweep got a lot of press when it was first introduced, but since it's become an industry standard, it hasn't been quite as newsworthy. Still, we usually get a few mentions when we release new features. For example, we have recently released new versions of NetIntercept, PhoneSweep, and Sandtrap, with good results.