BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Generic Third Party Integration

Posted May 24, 2011    Morey Haber

There is an inherent value to vulnerability assessment and attack data beyond the security team. Making relevant data available to other solutions, departments, and team members can streamline the vulnerability management process and ensure the workflow is seamless between departments and management. In addition, having tight data integration makes it easier to document workflow processes required by most regulatory compliance initiatives. Take for example this simple diagram for Retina CS and a generic integration into the Windows Application Log.

Critical events can be filtered as they entered into the management console and forwarded to the Application Log. Any third party event log watcher can trigger from these events to perform addition actions or notify appropriate individuals. This simple process can be documented as follows:

  • Perform periodic vulnerability scans
  • Set a threshold for events to be replicated into the Windows Application Log
  • Have Log Management System “x” or Network Management System “y” monitor for these events
  • Perform an automated rule when these are detected. For example, open a help desk tick after correlating the data with a CMDB, send an alert to the system owner outside of the security department, or perform an automated action.
  • This type of generic integration can be used to tie virtually any system to eEye’s solutions and raise the value of the data being collected without the need for any custom code. In addition, eEye supports the following generic integration points into each of our solutions.

    Based on these, a client can do everything from custom control of the scan engine to direct access of the data warehouse and integrated alerting functions. Some custom integrations that have been performed by our clients include:

  • Extraction of data for companywide ticketing system using XML.
  • Export of results for supplemental information to an enterprise level asset inventory system.
  • Security notification of rogue devices and any other detected anomaly including new ports being opened, etc.
  • Custom web pages hosting resulting data including SharePoint
  • Allow users to initiate their own scans and view results.
  • To that end, eEye has embarked on an aggressive third party integration program (with our partners) the following out of the box integrations that go far beyond basic event log scraping.

    These solutions work seamlessly with eEye to raise the awareness of vulnerability assessment data and provide a streamlined workflow for your business requirements. For more information regarding eEye and our third party integrations, please click here.

    Additional articles

    VMware Hardening Guidelines-img3

    How to Audit VMware ESX and ESXi Servers Against the VMware Hardening Guidelines with Retina CS

    Posted February 27, 2015    BeyondTrust Research Team

    Retina CS Enterprise Vulnerability Management has included advanced VMware auditing capabilities for some time, including virtual machine discovery and scanning through a cloud connection, plus the ability to scan ESX and ESXi hosts using SSH. However, in response to recent security concerns associated with SSH, VMware has disabled SSH by default in its more recent…

    Tags:
    , , , ,
    dave-shackleford-headshot

    Privileged Passwords: The Bane of Security Professionals Everywhere

    Posted February 19, 2015    Dave Shackleford

    Passwords have been with us since ancient times. Known as “watchwords”, ancient Roman military guards would pass a wooden tablet with a daily secret word engraved from one shift to the next, with each guard position marking the tablet to indicate it had been received. The military has been using passwords, counter-passwords, and even sound…

    Tags:
    , , ,
    Privileged Account Management Process

    In Vulnerability Management, Process is King

    Posted February 18, 2015    Morey Haber

    You have a vulnerability scanner, but where’s your process? Most organizations are rightly concerned about possible vulnerabilities in their systems, applications, networked devices, and other digital assets and infrastructure components. Identifying vulnerabilities is indeed important, and most security professionals have some kind of scanning solution in place. But what is most essential to understand is…

    Tags:
    , , , , ,