BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

How To Leverage MS SharePoint for UVM Reports

Posted September 8, 2011    Morey Haber

One of the most important facets regarding security is escalating data to the proper individuals in a timely manner. This is generally done using reports or some form of email alerts. In the context of reports, securing and proper distribution of the contents is just as important as the data contained within. In other words, making sure sensitive scan data is hosted and secured correctly against improper distribution or misrepresentation.

The user community has driven the ease of use of this process by making reports fully available in an email or an email with a hyperlink that secures the content for the proper trusted audience. Recently, the user community has been requesting yet another vehicle for hosting reports in a simple and secured fashion for additional team members (such as executive management and auditors) that extends beyond traditional notifications. Publishing reports to a portal.

The most common portal integration request is for Microsoft SharePoint. Retina Insight is a data warehouse solution that aggregates long term unified vulnerability management data for assessments, attacks, malware, assets, compliance, risk, and regulatory initiatives in a single location. Reports follow a role-based access model and can be generated ad-hoc, saved, or scheduled for automated generation and delivery. The scheduling function is specifically called “Subscriptions.” Subscriptions in Retina Insight allow direct integration into Share point by either (A) emailing reports to a share point SMTP mail daemon or (B) publishing the reports to a UNC share for directory and file-based publishing. Here is how they work.

First, after selecting any report within Retina Insight, a user can set the relative filter parameters and Smart Group. Then, they click “Subscribe” as illustrated below.

Next, the user needs to decide which integration method they want to use, either via email or shared folder. This forms the basis for SharePoint integration.

(A) Retina Insight email integration to SharePoint.

  1. As documented in this Programming4US article (http://programming4.us/enterprise/3454.aspx) a user simply needs to enable the receipt of SMTP email via Sharepoint and set the appropriate permissions to receive .eml content. It is important to note, that to avoid internal Spam and misuse, security settings should only permit postings from Retina Insight or other security tools.
  2. Select “Deliver the report through e-mail” and Select Next.
  3. Next, the user then completes details regarding the report title, SharePoint email address, etc. and then selects Next (illustrated below).
  4. Finally the user selects (not illustrated) the reoccurring schedule for the report and the Subscription will generate a new report and email it to SharePoint for publication.

    (B) Retina Insight UNC Share integration to SharePoint.

    1. By default, you can access SharePoint document libraries via a UNC share if the system is properly setup (\\server\sharepointsite\doclibname) or you can follow this Microsoft TechNet Article on how to Connect Web Sites to UNC Network Shares (http://technet.microsoft.com/en-us/library/cc768023.aspx). The later can be used to host saved reports remotely via UNC share for SharePoint.
    2. An important consideration for the shares is there visibility. You may want to create any of them, local to the SharePoint Server or remotely, hidden by suffixing the share name with a “$” to add an additional layer of security.
    3. Next select “Deliver the report through a shared folder” and Select Next.
    4. Then, the user then completes details regarding the report title, UNC address, file format for the report (PDF, Word, Excel, etc.), permissions, and if the file should be overwritten or incremented on the target. (Illustrated below)
    5. Once the permissions have been entered, the user can select “Test” to verify the UNC share will accept file writes.
    6. Finally the user selects Next (not illustrated) and they can set the reoccurring schedule for the report. It will then be automatically written to the UNC share SharePoint for publication.

     

    Disseminating critical security data is key to any modern Internet enabled organization. By the way, that is just about every business today. Having reports available only to security teams is no longer enough. Having summarized data for executives, regulatory information available to finance and auditors, and patch information available to administrators helps every team perform their functions at optimal levels. Retina allows these reports to operate outside of the island of traditional security and be available to everyone through solid third-party integration into Microsoft SharePoint.

    For more information on how eEye can help raise unified vulnerability management awareness in your organization, please click here. “Knowledge is Power” (-Francis Bacon) and good security information in the right hands can help secure your business from modern day threats.

    Leave a Reply

    Additional articles

    Sudo_logo

    Don’t Create a Different sudoers File for Each System

    Posted May 20, 2015    Randy Franklin Smith

    What if you have multiple Linux and/or Unix systems? Sudo management can become onerous and unwieldy if you try to manage a different sudoers file on each system. The good news is that sudo supports multiple systems.

    password-safety

    What Does Microsoft Local Administrator Password Solution Really Do?

    Posted May 19, 2015    Morey Haber

    LAPS is a feature that allows the randomization of local administrator accounts across the domain. Although it would seem that this capability overlaps with features in BeyondTrust’s PowerBroker Password Safe (PBPS), the reality is it is more suited for simple use cases such as changing the local Windows admin account and not much more.

    Tags:
    , ,
    webinar_ondemand

    On Demand Webinar: Securing Windows Server with Security Compliance Manager

    Posted May 14, 2015    BeyondTrust Software

    On Demand Webinar: Security Expert Russell Smith, explains how to use Microsoft’s free Security Compliance Manager (SCM) tool to create and deploy your own security baselines, including user and computer authentication settings.

    Tags:
    , ,