BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Reporting Snapshots and Saved Views

Posted June 7, 2011    Morey Haber

I would like to tell you about a new feature recently added to Retina Insight. It may sound so simple but it solves a huge problem for businesses that like to perform ad-hoc reports.  If your one of those companies that likes to run reports ad-hoc, when you want, and review it compared to older reports saved electronically the same way, read on.

So here is the problem. Often users run ad-hoc reports on a data set that is constantly changing due to new events and identified vulnerabilities. When they run the report one day, the output may have a given number of vulnerabilities and running it the next day, a new and different tally. Users can traditionally fix this by specifically choosing the scan job to generate the report and save the results. This does not however allow reports to be generated with relative dates (last 30 days for PCI) since this is a moving relative date range. Reports will inherently change day after day as they are executed and ad-hoc reports become relative to the date they where executed. So how do you run a report with a relative period and save them in context with only the data available for that date? This is where the new feature comes in – Saved Views and Save Snapshots. First, let me define each of them:

Saved Views – When setting up a report, a user can selected various criteria including the chart type, relative date range, and devices in scope (Smart Groups) to include in the report. Once they have made all the selections, just the way they like them, a Save button is available to store the reporting filters exactly the way they like them for future reports. This is a Saved View.

Saved Snapshots – After a report is generated, a Saved Snapshot stores the data permanently “as is” into the database. The report is now electronically stored in its original format (not downloaded as a PDF) for retrieval and interaction using data specifically generated from the relative dates and scans selected with full drill down capabilities. Essentially, it is a snapshot of the report stored in the database from the date and time it was run and never changes based on any new or purged data for its rendering.

So why is this so important for ad-hoc report users?  First, when generating a report, you can setup it up to run every time the way you like it. Second, once you generate it, the report can be can stored electronically in its native format for future viewing or even exporting later into a different format. After you store several Saved Snapshots, you will a have running library to reference old reports and a guide to where you have been, and where you are potentially going. Having them all stored online, or even published to MS SharePoint using the “Subscribe” button provides the historical transparency  you need to meet many regulatory initiatives and best practices for data security. It answers that question, “didn’t we see that before?” or even “do you have that old report?”

For more information on Retina Insight, please click here. This new feature can save you endless hours thumbing through old reports (PDFs) and track historical data from the date it was generated. Any clients that need to be able to provide historical reporting on the fly, especially from ad-hoc reports, will benefit from these new features.

Additional articles

Are Your Data Security Efforts Focused in the Right Area?

Posted January 28, 2015    Scott Lang

Vormetric Data Security recently released an insider threat report, with research conducted by HarrisPoll and analyzed by Ovum. Based on the survey responses, it is apparent that there is still a great deal of insecurity over data. However, the results also show that there may be misplaced investments to address those insecurities. I will explain…

Tags:
ghost

GHOST Vulnerability…Scary Indeed

Posted January 28, 2015    BeyondTrust Research Team

A vulnerability discovered by Qualys security researchers has surfaced within the GNU C Library that affects virtually all Linux operating systems. The vulnerability lies within the various gethostbyname*() functions and, as such, has been dubbed “GHOST.” GHOST is particularly nasty considering remote, arbitrary code execution can be achieved. In an effort to avoid taxing DNS lookups, glibc developers introduced…

Tags:
,
dave-shackleford-headshot

Your New Years Resolution: Controlling Privileged Users

Posted January 27, 2015    Dave Shackleford

Is 2015 the year you get a better handle on security? The news last year was grim – so much so, in fact, that many in the information security community despaired a bit. Really, the end-of-the-year infosec cocktail parties were a bit glum. OK, let’s be honest, infosec cocktail parties are usually not that wild…

Tags:
, , ,