Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Unified Vulnerability Management – From The Cloud to Agents

Posted June 23, 2011    Morey Haber
I have written a few articles regarding comments from analysts and found a recent one that needs more visibility. In a recent paper, the analyst stated that any enterprise vulnerability assessment deployment should have at least 2 of 3 following technologies deployed for full coverage while performing a vulnerability assessment:
  1. Network Based Vulnerability Assessment Scanner – This is a traditional network based vulnerability assessment scanner.
  2. Agent Based Vulnerability Assessment Scanner – For devices that air gapped, mobile, hardened or do not permit a network based scan, agent based technology provides the solution to gather the required information.
  3. Passive Network Traffic Analysis – Using tools like a sniffer, traffic is decoded and vulnerabilities identified based on packet contents.

What was intriguing about this piece is that no vulnerability assessment vendor in the market place actually can do all three items within their own solution set. In fact, the leading vendors (in terms of revenue) only do one item and only two vendors can do two (eEye is one of the two).

These facts lead to some interesting questions regarding vulnerability assessment coverage, especially around regulatory compliance. Let’s take PCI for example. All assets that have sensitive card holder data need to be assessed for vulnerabilities. Traditionally administrators think of this as the card holder network and generally secured in the data center. In reality, this includes mobile devices team members use to take sales orders and executives that may have sensitive financial information in relationship to SOX or GLBA. A traditional network based vulnerability assessment solution is not enough to cover these devices. The targets are not reliably connected to the network nor have the privileges or open firewall settings to allow a network based authenticated scan into the device. This is why the analyst recommends item #2.

Item #3 makes perfect sense as well but in reality only works for non encrypted traffic. In addition, the deployment requires sensors on uplinks and on all wide area network branches for proper coverage. For an enterprise, this represents a very large quantity of devices that can only assess a very small fraction of the traffic being sniffed on the wire. If the environment uses open source products, the false product rate generally is quite high since patches using the source in embedded solutions do not always modify the revision of headers and banners in order to stay in sync with the open source release.

This brings me back to the general statement made in the beginning of the blog. The analyst recognizes that proper coverage for vulnerability assessment is more than a network scanner. It is much more than a cloud based solution with appliances probing your network. That architecture can only see devices when they are connected to the network. So, ask yourself the following questions:

  • What about all the devices that are not reliably connected? 
  • What about the devices that are hardened and opening ports and firewalls to run a scan are just not an acceptable risk?
  • Do mobile devices have any sensitive data? How are you monitoring their vulnerabilities?
  • Do you have two of the three assessment techniques in place today?
  • eEye can provide complete coverage for vulnerability assessment with network scanners and host based vulnerability assessment agents. We are the only vendor with both solutions natively integrated into a single console for complete management, control, and reporting of vulnerabilities from a single pane of glass. This analyst understands the threats that clients are truly experiencing and that with the expansion of cloud computing and mobile devices, a network scan alone is not enough. A more comprehensive approach is required and eEye has that solution.

    For more information on Retina, please contact eEye by clicking here.

    Leave a Reply

    Additional articles


    Answering the age-old question, ‘What’s plugged into my network?’

    Posted October 9, 2015    Alejandro DaCosta

    “What’s plugged into my network?” is a question I hear frequently from security administrators. And, really, it’s no surprise why. No longer do we have to account just for the physical servers in our datacenters, workstations and a few network devices. Now we need to keep track of roaming laptops, dynamic virtual systems, off-site cloud deployments and BYOD.


    Closing the Vulnerability Gap

    Posted October 7, 2015    Brian Chappell

    Managing vulnerabilities is a significant challenge for many organizations. The main difficulties with managing this manifest in two key areas. The first is that the list isn’t static. The second is priority.


    Scottrade Breach: Identified by Federal Officials

    Posted October 5, 2015    Morey Haber

    Late afternoon on October 2nd, news leaked out of another large security breach, now at Scottrade. The identity count of records, in the millions again (4.6 million is the latest). This breach comes on the second day of national CyberSecurity month, the first being Experian/T-Mobile breach.