BeyondTrust

Security In Context

Bringing you news and commentary on solutions and strategies for protecting your critical IT infrastructure.

PowerBroker for Windows Rule Creation with Retina CS

Post by Morey Haber February 20, 2013

For any enterprise solution, manually creating rules can be a daunting task and repetitive exercise. This problem is even more complex when working with solutions that potentially touch every application within your environment. Consider the complexity of identifying every application that requires escalated privileges for a least privilege project. How can you identity every user application and the privileges they require to create the correct rules? Fortunately, PowerBroker for Windows comes with the Retina CS management console to collect privilege-related event log data from Assets. This data includes information about the applications being used, the privileges they require, and how they are launched, as well as information about which users have administrator privileges.

Using Retina CS, administrators can sort and filter this data into useful reports and generate PowerBroker rules for applications based on user needs for privilege elevation. This is a best practice approach for discovering applications and the construction of quick and concise rules for any user or computer.

After the solution is properly configured, Assets will forward application events to Retina CS using a web services connection and even perform throttled store and forward functions if the device is offline.  An admin can select events and use the Action Menu to perform the following functions:

* Generate Active X Rule
* Generate Hash Rule
* Generate Publisher Rule
* Generate MSI Rule
* Exclude Publisher
* Exclude Application
* Admin Rights Exclude Application

Then, administrators can filter the events, remove duplicates, sort on any column, and even export the events to a spreadsheet or text file from Retina CS. This is illustrated below:

RetinaCS

To build a new rule, an administrator simply clicks on the Action Menu and selects a Rule Type. The PowerBroker Rule dialog box is then displayed for creation of the new rule within GPME with all the required fields and context properly completed.

PBW-Rule-Dialog

As a best practice, BeyondTrust recommends creating a new collection to stage newly created rules before production deployment. This collection should not have an Action assigned but use Item Level Targeting to restrict the rule’s adoption to test machines or trusted users. Once the rule passes quality assurance, it can be copied into a production collection when change control schedules permit.

Finally, any applications that are marked for exclusion, either by publisher, application, or right, can be managed under the Configuration tab of Retina CS. This is illustrated below and represent common applications or operating system functions that do not need to be monitored or displayed in the standard event stream and reports.

EventStream-Reports

BeyondTrust recommends using Retina CS as the primary mechanism for creating new rules during an enterprise deployment in lieu of manually creating them.  In addition, BeyondTrust offers a sample Rule Library with hundreds of common rules that supplement this functionality to expedite you implementation. For more information on Retina CS, please click here. For PowerBroker for Windows, please click here.

Tags:
, , , ,

Leave a Reply

Additional articles

Vulnerability Expert Forum Highlights: April 2014

We had a great turnout for last week’s April 2014 Vulnerability Expert Forum (VEF) webcast. BeyondTrust Research experts, Carter and DJ, provided in-depth knowledge about the latest vulnerabilities and their potential impacts on network environments. Below are highlights from the Forum, plus an on-demand video of the presentation. Latest critical vulnerabilities, vendor patches, and zero-day…

Post by Chris Burd April 16, 2014
Tags:
, , , , ,
BI-5.1-user-asset-visibility-img

Understanding Who Has Access to What with BeyondInsight v5.1

Today, it’s my pleasure to introduce you to BeyondInsight version 5.1, the latest release of our IT Risk Management platform, which unifies several of our solutions for Privileged Account Management and Vulnerability Management. BeyondInsight v5.1 embodies BeyondTrust’s mission to give our customers the visibility they need to make smart decisions and reduce risk to their…

Post by Morey Haber April 15, 2014
Tags:
, , , , , , , , , , , ,

PowerBroker for Unix & Linux Now Available via Web Services

This week BeyondTrust released a fully functional Web Services interface (REST API) for its PowerBroker for Unix & Linux product.  With this new feature users of the solution will now be able to remotely and securely configure and retrieve data via the API.  The Web Services interface implemented by BeyondTrust is an industry standard that…

Post by Paul Harper April 10, 2014
Tags:
, , , , ,