To say that keeping on top of your OS updates is a pain is to vastly understate the nature of the problem. If you’re responsible for an enterprise with even a few dozen servers, plus a few appliances, some routers and switches, and a firewall or two, you have a huge management problem. Applying all of the necessary patches can tax your staff to the breaking point. Worse, with larger enterprises, the problems mushroom.
eEye Digital Security’s popular Retina Network Security Scanner is quite capable of keeping an administrator apprised of vulnerabilities on a single network. But there was never a way to extend Retina’s capabilities to the enterprise - until now.
eEye’s Enterprise Vulnerability Assessment (EVA) ties individual Retina scanners together, allowing all of them to be managed from a single station. In fact, EVA will allow you to handle up to 65,000 individual IP addresses in your enterprise.
EVA draws its vulnerability scanning smarts from the Retina scanner. Retina Remote Manager allows each scanner to communicate with the enterprise manager. Tying everything together is the Remote Enterprise Management (REM) Events Server. This product consolidates the information from the Retina scanners, manages security certificate distribution and event logging. The server is designed to communicate with the REM Events Manager.
The REM Events Manager, the fourth component of EVA, provides the EVA user interface. It also handles the reporting for the consolidated enterprise data, or from any individual scanner. Further, the Events Manager handles the process of delegating tasks to other administrators.
Finally, there’s also a REM Event Client, which is a middleware bridge between the Events Manager and the Retina Remote Manager.
Assuming you already have a database server running on your network, deploying EVA is fairly simple. Everything comes on one CD, and you install the various parts in order, following the directions on the screen. The biggest inconvenience is typing in long lists of characters in groups of four to activate the licence.
Once REM Events Server and Events Manager are installed and the database access is working, you’re ready to install the Retina Scanner and Remote Manager software. You’ll need one scanner and remote manager for each separate network, both of which are available on the same CD as the other EVA components. Once the software is installed, all you need to do is set up the scanning and reporting within the REM Event Manager. The REM Event Manager uses a standalone application to designate the database and Web servers, the Web server’s virtual directory, and authentication credentials for the database and Web server.
Once EVA is up and running, you can order a scan via the Events Manager browser interface of all of the networks you control. When we tried this, the scan resulted in several discoveries. First, we found that just about every computer on our test network was in need of some kind of vulnerability fix. This wasn’t a surprise, since we deliberately have different levels of software on our many machines. Second, an intrusion-detection system (IDS) we were testing at the same time had freaked out. Apparently it decided that all of the queries from EVA were attacks.
What defeated Retina, and thus EVA, was Zone Alarm. Retina simply could not find a Zone-Alarm-equipped computer, much less report on its vulnerabilities. This isn’t exactly a significant failure, however, since Zone Alarm and other similar firewalls eliminate many vulnerabilities anyway.
Still, if you really want to keep on top of your network, you probably should find a way to get past the personal firewalls in your enterprise.
Using EVA after the scan is remarkably intuitive, considering you’re managing the vulnerability tracking and remediation of myriad computers and other network devices. Each device with an IP address is listed separately and each vulnerability is listed within, ranked in order of severity. As you click on each vulnerability listing, you’re told what the problem is, how serious it is, and what can be done to fix it.
Via the Events Manager, you can even generate charts that show the reduction in threat to the entire enterprise due to your efforts to fix problems.
It is, in fact, the reports EVA produces that make it unusually useful. Yes, you can focus on a single endpoint, but you can also produce meaningful reports that reflect the entire enterprise, reports that you can use to drill down as needed. As a result, EVA becomes more than just useful for the enterprise; it becomes an asset.