BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Unified Vulnerability Management – From The Cloud to Agents

Posted June 23, 2011    Morey Haber
I have written a few articles regarding comments from analysts and found a recent one that needs more visibility. In a recent paper, the analyst stated that any enterprise vulnerability assessment deployment should have at least 2 of 3 following technologies deployed for full coverage while performing a vulnerability assessment:
  1. Network Based Vulnerability Assessment Scanner – This is a traditional network based vulnerability assessment scanner.
  2. Agent Based Vulnerability Assessment Scanner – For devices that air gapped, mobile, hardened or do not permit a network based scan, agent based technology provides the solution to gather the required information.
  3. Passive Network Traffic Analysis – Using tools like a sniffer, traffic is decoded and vulnerabilities identified based on packet contents.

What was intriguing about this piece is that no vulnerability assessment vendor in the market place actually can do all three items within their own solution set. In fact, the leading vendors (in terms of revenue) only do one item and only two vendors can do two (eEye is one of the two).

These facts lead to some interesting questions regarding vulnerability assessment coverage, especially around regulatory compliance. Let’s take PCI for example. All assets that have sensitive card holder data need to be assessed for vulnerabilities. Traditionally administrators think of this as the card holder network and generally secured in the data center. In reality, this includes mobile devices team members use to take sales orders and executives that may have sensitive financial information in relationship to SOX or GLBA. A traditional network based vulnerability assessment solution is not enough to cover these devices. The targets are not reliably connected to the network nor have the privileges or open firewall settings to allow a network based authenticated scan into the device. This is why the analyst recommends item #2.

Item #3 makes perfect sense as well but in reality only works for non encrypted traffic. In addition, the deployment requires sensors on uplinks and on all wide area network branches for proper coverage. For an enterprise, this represents a very large quantity of devices that can only assess a very small fraction of the traffic being sniffed on the wire. If the environment uses open source products, the false product rate generally is quite high since patches using the source in embedded solutions do not always modify the revision of headers and banners in order to stay in sync with the open source release.

This brings me back to the general statement made in the beginning of the blog. The analyst recognizes that proper coverage for vulnerability assessment is more than a network scanner. It is much more than a cloud based solution with appliances probing your network. That architecture can only see devices when they are connected to the network. So, ask yourself the following questions:

  • What about all the devices that are not reliably connected? 
  • What about the devices that are hardened and opening ports and firewalls to run a scan are just not an acceptable risk?
  • Do mobile devices have any sensitive data? How are you monitoring their vulnerabilities?
  • Do you have two of the three assessment techniques in place today?
  • eEye can provide complete coverage for vulnerability assessment with network scanners and host based vulnerability assessment agents. We are the only vendor with both solutions natively integrated into a single console for complete management, control, and reporting of vulnerabilities from a single pane of glass. This analyst understands the threats that clients are truly experiencing and that with the expansion of cloud computing and mobile devices, a network scan alone is not enough. A more comprehensive approach is required and eEye has that solution.

    For more information on Retina, please contact eEye by clicking here.

    Leave a Reply

    Additional articles

    How To Implement The Australian Signals Directorate’s Top 4 Strategies

    Posted October 20, 2014    Morey Haber

    The Australian Signals Directorate (ASD), also known as the Defence Signals Directorate, has developed a list of strategies to mitigate targeted cyber intrusions. The recommended strategies were developed through ASD’s extensive experience in operational cyber security, including responding to serious security intrusions and performing vulnerability assessments and penetration testing for Australian government agencies. These recommendations…

    Tags:
    , , , ,
    asp-mvc

    Exploiting MS14-059 because sometimes XSS is fun, sometimes…

    Posted October 17, 2014    BeyondTrust Research Team

    This October, Microsoft has provided a security update for System.Web.Mvc.dll which addresses a ‘Security Feature Bypass’. The vulnerability itself is in ASP.NET MVC technology and given its wide adoption we thought we would take a closer look. Referring to the bulletin we can glean a few useful pieces of information: “A cross-site scripting (XSS) vulnerability exists…

    Tags:
    4bestpracticesaudits-blog

    Four Best Practices for Passing Privileged Account Audits

    Posted October 16, 2014    Chris Burd

    Like most IT organizations, your team may periodically face the “dreaded” task of being audited. Your process for delegating privileged access to desktops, servers, and infrastructure devices is a massive target for the auditor’s microscope. An audit’s findings can have significant implications on technology and business strategy, so it’s critical to make sure you’re prepared…

    Tags:
    , , , ,