BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Generic Third Party Integration

Posted May 24, 2011    Morey Haber

There is an inherent value to vulnerability assessment and attack data beyond the security team. Making relevant data available to other solutions, departments, and team members can streamline the vulnerability management process and ensure the workflow is seamless between departments and management. In addition, having tight data integration makes it easier to document workflow processes required by most regulatory compliance initiatives. Take for example this simple diagram for Retina CS and a generic integration into the Windows Application Log.

Critical events can be filtered as they entered into the management console and forwarded to the Application Log. Any third party event log watcher can trigger from these events to perform addition actions or notify appropriate individuals. This simple process can be documented as follows:

  • Perform periodic vulnerability scans
  • Set a threshold for events to be replicated into the Windows Application Log
  • Have Log Management System “x” or Network Management System “y” monitor for these events
  • Perform an automated rule when these are detected. For example, open a help desk tick after correlating the data with a CMDB, send an alert to the system owner outside of the security department, or perform an automated action.
  • This type of generic integration can be used to tie virtually any system to eEye’s solutions and raise the value of the data being collected without the need for any custom code. In addition, eEye supports the following generic integration points into each of our solutions.

    Based on these, a client can do everything from custom control of the scan engine to direct access of the data warehouse and integrated alerting functions. Some custom integrations that have been performed by our clients include:

  • Extraction of data for companywide ticketing system using XML.
  • Export of results for supplemental information to an enterprise level asset inventory system.
  • Security notification of rogue devices and any other detected anomaly including new ports being opened, etc.
  • Custom web pages hosting resulting data including SharePoint
  • Allow users to initiate their own scans and view results.
  • To that end, eEye has embarked on an aggressive third party integration program (with our partners) the following out of the box integrations that go far beyond basic event log scraping.

    These solutions work seamlessly with eEye to raise the awareness of vulnerability assessment data and provide a streamlined workflow for your business requirements. For more information regarding eEye and our third party integrations, please click here.

    Additional articles

    Sudo_logo

    Don’t Create a Different sudoers File for Each System

    Posted May 20, 2015    Randy Franklin Smith

    What if you have multiple Linux and/or Unix systems? Sudo management can become onerous and unwieldy if you try to manage a different sudoers file on each system. The good news is that sudo supports multiple systems.

    password-safety

    What Does Microsoft Local Administrator Password Solution Really Do?

    Posted May 19, 2015    Morey Haber

    LAPS is a feature that allows the randomization of local administrator accounts across the domain. Although it would seem that this capability overlaps with features in BeyondTrust’s PowerBroker Password Safe (PBPS), the reality is it is more suited for simple use cases such as changing the local Windows admin account and not much more.

    Tags:
    , ,
    webinar_ondemand

    On Demand Webinar: Securing Windows Server with Security Compliance Manager

    Posted May 14, 2015    BeyondTrust Software

    On Demand Webinar: Security Expert Russell Smith, explains how to use Microsoft’s free Security Compliance Manager (SCM) tool to create and deploy your own security baselines, including user and computer authentication settings.

    Tags:
    , ,