BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

PowerBroker for Windows – Solution Deployment

Posted October 11, 2012    Morey Haber

PowerBroker for Windows (PBW) is designed to integrate directly into your corporate Active Directory (AD) structure without modifying your existing schema. In the asset labeled “1” below, an administrator simply loads a Group Policy Option (GPO) snap-in onto an asset that uses the Microsoft Management Console (MMC).  The administrator can then create policies and rules that are stored in the AD domain labeled “2”.  An administrator can also access the management console (Retina CS labeled “3”) via a web interface to run reports or create additional rules based on collected events from the environment.

As domain assets log on (servers, workstations, or remote clients labeled “4”) they receive policy from the domain controller that is processed by the PBWagent. This agent is installed on each device and can be distributed through a software delivery solution or even through GPO itself. This enforces privilege identity management rules on the endpoint and sends status events back to Retina CS for additional reporting, trending, and rule creation.

In a traditional deployment, your organization needs to consider deploying the following three components:

  1. PBW Agents on Servers, Desktops, and Remote Clients
  2. PBW GPO Snap-In for Rules on Administrator Workstations
  3. Retina CS Management Console for Reporting and Event Management (optional).

PBW Agents are lightweight MSI installers, under 30MB, that can be pushed down to assets using everything from logon scripts to GPO. The GPO snap-ins should only be deployed where needed for policy creation. And,Retina CS (available soon for PBW) is generally a one-time server installation (software, virtual, or appliance) for management. It can also be deployed as multiple servers in atiered architecture for enterprise clients if needed.  Below is an example of this approach.

For more information on how to take advantage of PowerBroker for Windows and Retina CS within your environment, please click here. BeyondTrust is the thought leader for integrating privilege identity management and vulnerability assessment in a single solution.

Tags:
, , , , , , , ,

Additional articles

{c4eae211-3ca2-4f8e-b2b9-6df0e970aab1}_g.markhardy

The “insider” threat. Is it real, or is it being blown out of proportion?

Posted March 4, 2015    G. Mark Hardy

A lot depends on whether or not you’ve been compromised. And therein lies the problem. Cyber threats are often ignored until they cause some damage, at which point management looks for people to blame and gives all kinds of attention to fixing the problem – until the next crisis in accounting or warehousing or staffing comes along.

Tags:
, , ,
webinar_chalk

Webinar March 4th: Recreating the Carbanak Breach & Techniques for Mitigating Similar Attacks

Posted March 3, 2015    Lindsay Marsh

Join BeyondTrust Research and Development team for an in-depth live webinar that will explore the attack vectors used in the Carbanak Bank Breach and share successful mitigation techniques needed to prevent this type of attack.

Tags:
, ,
VMware Hardening Guidelines-img3

How to Audit VMware ESX and ESXi Servers Against the VMware Hardening Guidelines with Retina CS

Posted February 27, 2015    BeyondTrust Research Team

Retina CS Enterprise Vulnerability Management has included advanced VMware auditing capabilities for some time, including virtual machine discovery and scanning through a cloud connection, plus the ability to scan ESX and ESXi hosts using SSH. However, in response to recent security concerns associated with SSH, VMware has disabled SSH by default in its more recent…

Tags:
, , , ,