BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Advanced Architectures with the Retina Protection Agent

Posted May 31, 2013    Morey Haber

One of the extended features of Retina CS is the Retina Protection Agent. This component is licensed with Retina and allows for users to assess hosts for vulnerabilities using a local scanning agent verses a network scan. This forgoes the need of a traditional SaaS or on-premise vulnerability assessment solution to perform a scan outside of the corporate campus. This requirement is very common among clients that need a PCI DSS Report or a traditional vulnerability assessment report for mobile Windows devices. A traditional authenticated network scan does not work because the local firewall would need to be disabled, remote file and print sharing exposed to the Internet, and the device powered on at a fixed IP address at the same time of the scan. All of these can lead to a complete disaster since the device defensive’s are essentially turned off. There is really no way around this type of assessment even if you host an appliance in-house and try to scan backwards across a VPN connection. The results just do not come out well and a getting a reliable report from all device in scope becomes problematic.

BeyondTrust has a solution for this problem. The architecture below is for the Retina Protection Agent and Retina CS using a hardened UVM50 appliance:

RPA-screenshot

Windows XP, 7, Vista, or 8 laptops are loaded with the Retina Protection Agent (which co-exists with your existing security solutions including anti-virus) and performs a local vulnerability assessment on a scheduled basis. The scan is non intrusive and does not impact the performance of the system. The results are encrypted and sent to the appliances within the corporate DMZ. From there, users can view complete details regarding the asset and generate reports for regulatory compliance and asset inventory. If the device is offline, the results are held and forwarded in a throttled fashion when a connection can be established. Audit updates can be sent directly from BeyondTrust or from the same appliance in order to make sure your critical reports are up to date.

BeyondTrust has solved the problem of remote vulnerability assessment using agent technology. These agents can be used on desktops or servers; anywhere a scan of a Windows device would fail using a network vulnerability assessment technology. This overcomes STIG hardening, firewalls, disabled accounts, and even remote systems for complete vulnerability management.

Our zero gap coverage for vulnerability assessment includes network scanners, agents, cloud resources, and even mobile devices. We can help provide the information you need to maintain regulatory compliance with your assets and users. Learn more!

Tags:
, , , ,

Additional articles

PBPS-screenshot-blog aug2014

Failing the Security Basics: Backoff Point-of-Sale Malware

Posted August 22, 2014    Marc Maiffret

At the beginning of this month, US-CERT issued a security alert relating to a string of breaches that had been targeting Point of Sale (POS) systems. The alert details that attackers were leveraging brute forcing tools to target common remote desktop applications such as Microsoft’s Remote Desktop, Apple Remote Desktop, Splashtop and LogMeIn among others….

Tags:
, , , , , ,

Troubleshooting Windows Privilege Management Rules with Policy Monitor

Posted August 21, 2014    Jason Silva

When defining and testing PowerBroker for Windows rules for production or pilots, customers sometimes tell us, “I don’t think this policy / program is working.” This is usually a case of the policy not properly triggering because of the way the rule was created. A unique feature of PowerBroker for Windows compared to other solutions is a client-side…

Tags:
, , ,
darren-mar-elia

BeyondTrust Webcast: Darren Mar-Elia’s 4 Active Directory Change Scenarios to Track

Posted August 20, 2014    Chris Burd

In our latest webcast, we joined Darren Mar-Elia, CTO at SDM Software, to discuss best practices for Active Directory (AD) change management. Here are some key takeaways from the presentation, followed by a link to a full-length video of the presentation. Mar-Elia kicks things off with a critical insight: that the best AD change management…

Tags:
, , , , , , ,