eEye EVA focuses in on network security

To say that keeping on top of your OS updates is a pain is to vastly understate the nature of the problem. If you're responsible for an enterprise with even a few dozen servers, plus a few appliances, some routers and switches, and a firewall or two, you have a huge management problem. Applying all of the necessary patches -- assuming you can figure out which patches you need and which are actually available -- can tax your staff to the breaking point. Worse, with larger enterprises, the problems mushroom.

Free IT resource Virtualization Insights from Top Experts - Learn how virtualization gets real! Sponsored by Dell Free IT resource TechNet: More ways to know it, share it, and keep it running. Sponsored by Microsoft eEye Enterprise Vulnerability Assessment eEye Digital Security, eeye.com/ Deploy  8.1 criteria score Ease-of-use 8 Implementation 8 Innovation 8 Interoperability 9 Scalability 9 Security 8 Suitability 7 Support 8 Training 8 Value 8 Business Case: This solid solution identifies, manages, and fixes vulnerabilities while keeping personnel resources in check. Technology Case: EVA consolidates vulnerability assessment from many individual networks into a single management point for the enterprise, allowing monitoring and remediation even with a limited staff. Pros: + +Makes eEye’s Retina software easily managed across the enterprise + +Handles nearly every operating platform, including some routers, switches, and appliances Cons: - -Management console is Windows only - -Does not currently find vulnerabilities on Macintosh platforms Cost: Retina: $6,520 for 250 IP addresses; Retina Remote Manager: $1,995 per Retina Scanner; REM Events Server: $4,995; REM Events Manager: $9,995 (includes five manager accounts) Platforms: Management server Windows NT/2000. Requires a separate server with an ODBC compliant database Bottom Line: This network security management solution consolidates vulnerability assessments from multiple networks into a single management point, helping to identify and to remediate vulnerabilities while keeping staff resources in check. About our Reviews and Scoring Methodology

Meanwhile, of course, you're being taken to task by everyone from the board to random magazine pundits for not having every patch installed within milliseconds of when it's announced. Then, when a worm shows up and wreaks havoc on your network, everybody's pointing fingers -- at you.

eEye Digital Security's popular Retina Network Security Scanner is quite capable of keeping an administrator apprised of vulnerabilities on a single network. But there was never a way to extend Retina's capabilities to the enterprise — until now.

eEye's EVA (Enterprise Vulnerability Assessment) ties individual Retina scanners together, allowing all of them to be managed from a single station. In fact, EVA will allow you to handle up to 65,000 individual IP addresses in your enterprise.

EVA draws its vulnerability scanning smarts from the Retina scanner. Retina Remote Manager makes it each scanner capable of communicating with the enterprise manager. Tying everything together is the REM (Remote Enterprise Management) Events Server. This product consolidates the information from the Retina scanners, manages security certificate distribution and event logging. The server is designed to communicate with the REM Events Manager.

The REM Events Manager, the fourth component of EVA, provides the EVA user interface. It also handles the reporting for the consolidated enterprise data, or from any individual scanner. Further, the Events Manager handles the process of delegating tasks to other administrators. It can reduce workload by automating the process of distributing reports to the affected organizations or locations according to predetermined scopes, rules or levels of authority. Conveniently, the Events Manager is a Web-based application, so you can reach your management console from nearly anywhere.

Finally, there's also a REM Event Client, which is a middleware bridge between the Events Manager and the Retina Remote Manager.

Assuming you already have a database server running on your network, deploying EVA is fairly simple. Everything comes on one CD, and you install the various parts in order, following the directions on the screen. The biggest inconvenience is typing in long lists of characters in groups of four to activate the license. This boring process seems to be the current way of making sure the product isn't pirated.

Once REM Events Server and Events Manager are installed and the database access is working (which took us only a few seconds to complete on the test network), you're ready to install the Retina Scanner and Remote Manager software. You'll need one scanner and remote manager for each separate network, both of which are available on the same CD as the other EVA components. Once the software is installed, all you need to do is set up the scanning and reporting within the REM Event Manager. The REM Event Manager uses a stand-alone application to designate the database and Web servers, the Web server’s virtual directory, and authentication credentials for the database and Web server. Other reporting and scanning functions are set up from a Web browser; this can be local or on a separate host.

Once EVA is up and running, you can order a scan via the Events Manager browser interface of all of the networks you control. When we tried this, we were told that it might take a while, so we went to lunch. It wasn't a long lunch, but the scanning was complete before we returned.

The scan resulted in several discoveries. First, we found that just about every computer on our test network was in need of some kind of vulnerability fix. This wasn't a surprise, since we deliberately have different levels of software on our many machines. Second, an IDS (intrusion-detection system) we were testing at the same time had freaked out. Apparently it decided that all of the queries from EVA were attacks. We probably should have told the IDS about EVA and Retina.

Third, we found that Retina's attempts by to probe one of our Solaris boxes resulted in the box generating streams of report messages. But the Sun box didn't prevent EVA and Retina from getting the information it needed.

What defeated Retina, and thus EVA, was Zone Alarm. Retina simply could not find a Zone-Alarm-equipped computer, much less report on its vulnerabilities. This isn't exactly a significant failure, however, since Zone Alarm and other similar firewalls eliminate (or make irrelevant) many vulnerabilities anyway.

Still, if you really want to keep on top of your network, you probably should find a way to get past the personal firewalls in your enterprise. Even with an excellent product such as Zone Alarm (or its enterprise cousins) vulnerabilities remain, even if they're more difficult to exploit.

Using EVA after the scan is remarkably intuitive, considering you're managing the vulnerability tracking and remediation of myriad computers and other network devices. Each device with an IP address is listed separately and each vulnerability is listed within, ranked in order of severity. As you click on each vulnerability listing, you're told what the problem is, how serious it is, and what can be done to fix it. If EVA can fix the problem, such as one that required a change to a registry setting, it will do so. Otherwise, it will provide a link that will let you implement the fix, or it will tell you what the problem is and where to find the fix.

Via the Events Manager, you can assign staff members to fix vulnerabilities, then track the overall level of completion, down to the individual fix. You can even generate charts that show the reduction in threat to the entire enterprise due to your efforts to fix problems.

It is, in fact, the reports EVA produces that make it unusually useful. Yes, you can focus on a single endpoint, but you can also produce meaningful reports that reflect the entire enterprise, reports that you can use to drill down as needed. As a result, EVA becomes more than just useful for the enterprise; it becomes an asset. The fact that it will assess virtually any device on the network (unless it's a Mac, and eEye will have Mac support soon, the company says) makes it a valued asset. This is a product worth having.