BindView RMS
BindView's solution is a more extensive security tool that goes beyond simple scanning. But if scanning is your main goal, you'll need to install several modules for a truly comprehensive solution.
BindView's vulnerability scanners take the form of bv-Control modules that plug in to the BindView RMS suite, which provides a separate RMS Console and Information Server. The bv-Control modules, which you must purchase separately, include queries and reports specific to a variety of platforms and products. For this review, I tested the RMS Console and Information Server 7.30, bv-Control for Windows 7.35, bv-Control for Internet Security 7.25, and the BindView Compliance Center 1.50. You'll also need SQL Server to store the configuration and scan information. BindView RMS provides an MMC snap-in to manage the main components and a Web console to manage the Compliance Center. BindView's RapidFire service provides program updates.
Due to the scope and complexity of the product, the installation process took longer and required more configuration than the other scanners I tested. Because of the need to run scans from multiple modules, a complete, internal/external BindView scan run also took considerably more time to finish than the other scanners needed.
At their core, most bv-Control modules consist of groups of queries. These queries provide a single gathering point for most of the internal security data you'll need about your network. The bv-Control for Windows module includes queries to enumerate shares, events, users, processes, and domains. Other queries perform domain, printer, machine, session, share, and storage analyses. Still others collect data for documentation, disaster recovery, or defined security best practices. The bv-Control for Windows module includes nearly 500 queries in all, and you can use these to achieve nearly all the functionality that the other scanners provide (e.g., managing patches, enumerating shares, listing users who have Administrator privileges, determining whether auditing is disabled). However, you must create a task list or use the Compliance Center to group these queries into regular and repeatable scans consisting of multiple queries.
The bv-Control for Internet Security module differs from the other modules in that it uses intrusive techniques and no credentials to attack your network as an intruder would. BindView recommends using the module to look into your network from the outside; this external view complements the other modules' internal focus. The module uses security checks (e.g., FTP servers, integrity, permissions, SNMP, Trojan horses, Web servers) developed by BindView's security-research team, RAZOR Rapid Response Team, and categorized into collections (e.g., SANS Priority One) that you can use to initiate a scan. This module supports network mapping, scanning and analysis, reporting, exporting, updating, and password-integrity checking.
After running bv-Control for Windows, you can view the resulting data in a variety of flexible formats, including data grids, graphs, and reports. In many cases, you can remediate problems on the spot by using the product's ActiveAdmin feature. You can review the results of a bv-Control for Internet Security scan by using the module's built-in report viewer, which Figure 6 shows. The module produces an HTML report that summarizes found vulnerabilities as High, Medium, or Low and provides a highly technical description and remediation information as well as links to other useful references. You can sort the results according to device, drill down into the results, and view charts of the data. This module also features autofix capabilities for certain vulnerabilities. Both modules let you view historical data. Together, the two modules provide robust information about your network's overall security. Remember, however, that you need to manage the results separately--you can't produce a compiled remediation report.
The BindView Compliance Center is a separate tool that leverages the bv-Control modules to assess your network against best practices. This nonintrusive, agentless Web portal uses a database of compliance information--for Windows users, the Technical Standards for Center for Internet Security's (CIS's) Level-1 Benchmarks for Windows 2000 1.1.7--to compare your network against a library of predefined technical standards. You can create an acceptable configuration (a gold standard), then compare target systems with that standard. However, you must purchase the database, which has a hefty price tag.
See associated table
Which Scanner Is for You?
For a pure vulnerability scanner, my top pick is Retina, with its solid, focused approach. The product's well-designed, efficient UI makes it easy to get down to business and begin scanning for vulnerabilities immediately; its powerful scanning engine and comprehensive database get results. If you're looking for a full security- and policy-management solution, BindView RMS is the most robust solution. If your main goal is regulation compliance, check out NetIQ Vulnerability Manager (just be aware that if an auditor requests a hard copy, you won't be able to customize the product's reports). If you're on a budget, Nessus is free and gives you an amazing amount of scan data, but unless you already understand quite a bit about UNIX or the product, be ready to spend time getting it up and running. If you aren't comfortable with your knowledge level--or with Nessus's intrusive techniques--try the reasonably priced SNSI, which provides detailed remediation steps for most vulnerabilities. If you already have some scanning functionality and are simply looking for additional capabilities, GFI LANguard N.S.S. would make a great addition to your toolkit, although I wouldn't use it as a dedicated vulnerability scanner because of its limited detection abilities. Whichever tool you decide on, remember: Any scanner's value can be realized only if you heed its recommendations and remediate at-risk computers as soon as possible.
)
)
)
Register
Anonymous User January 27, 2005 (Article Rating: