BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Advanced Architectures with the Retina Protection Agent

Posted May 31, 2013    Morey Haber

One of the extended features of Retina CS is the Retina Protection Agent. This component is licensed with Retina and allows for users to assess hosts for vulnerabilities using a local scanning agent verses a network scan. This forgoes the need of a traditional SaaS or on-premise vulnerability assessment solution to perform a scan outside of the corporate campus. This requirement is very common among clients that need a PCI DSS Report or a traditional vulnerability assessment report for mobile Windows devices. A traditional authenticated network scan does not work because the local firewall would need to be disabled, remote file and print sharing exposed to the Internet, and the device powered on at a fixed IP address at the same time of the scan. All of these can lead to a complete disaster since the device defensive’s are essentially turned off. There is really no way around this type of assessment even if you host an appliance in-house and try to scan backwards across a VPN connection. The results just do not come out well and a getting a reliable report from all device in scope becomes problematic.

BeyondTrust has a solution for this problem. The architecture below is for the Retina Protection Agent and Retina CS using a hardened UVM50 appliance:

RPA-screenshot

Windows XP, 7, Vista, or 8 laptops are loaded with the Retina Protection Agent (which co-exists with your existing security solutions including anti-virus) and performs a local vulnerability assessment on a scheduled basis. The scan is non intrusive and does not impact the performance of the system. The results are encrypted and sent to the appliances within the corporate DMZ. From there, users can view complete details regarding the asset and generate reports for regulatory compliance and asset inventory. If the device is offline, the results are held and forwarded in a throttled fashion when a connection can be established. Audit updates can be sent directly from BeyondTrust or from the same appliance in order to make sure your critical reports are up to date.

BeyondTrust has solved the problem of remote vulnerability assessment using agent technology. These agents can be used on desktops or servers; anywhere a scan of a Windows device would fail using a network vulnerability assessment technology. This overcomes STIG hardening, firewalls, disabled accounts, and even remote systems for complete vulnerability management.

Our zero gap coverage for vulnerability assessment includes network scanners, agents, cloud resources, and even mobile devices. We can help provide the information you need to maintain regulatory compliance with your assets and users. Learn more!

Tags:
, , , ,

Additional articles

Cavalancia-Headshot - Medium

Making Windows Endpoints the Least of your Worries

Posted September 2, 2015    Nick Cavalancia

We’re all concerned that someday an external hacker will try to gain access to your company’s critical data and systems. The problem? Your endpoints – both your workstations and servers – bypass (and often leave) the safety and security of your environment daily.

Tags:
, ,
powerbroker-difference-2

Why Customers Choose PowerBroker: Low Total Cost of Ownership

Posted September 2, 2015    Scott Lang

In a survey of more than 100 customers, those customers indicated that BeyondTrust’s low powerbroker-difference-2total cost of ownership was a competitive differentiator versus other options in the privileged account management market.

Tags:
, , ,
Larry-Brock-CISO

Passwords: A Hacker’s Best Friend

Posted September 1, 2015    Larry Brock

After all the years of talk about biometrics and multi-factor authentication, we still have passwords and will likely have them for a long time. Because many “high risk” systems require complex passwords (zk7&@1c6), most people that use them believe their passwords are secure. But they aren’t.

Tags:
, ,