eEye EVA focuses in on network security

Solution makes vulnerability assessment manageable

Once REM Events Server and Events Manager are installed and the database access is working (which took us only a few seconds to complete on the test network), you're ready to install the Retina Scanner and Remote Manager software. You'll need one scanner and remote manager for each separate network, both of which are available on the same CD as the other EVA components. Once the software is installed, all you need to do is set up the scanning and reporting within the REM Event Manager. The REM Event Manager uses a stand-alone application to designate the database and Web servers, the Web server’s virtual directory, and authentication credentials for the database and Web server. Other reporting and scanning functions are set up from a Web browser; this can be local or on a separate host.

Once EVA is up and running, you can order a scan via the Events Manager browser interface of all of the networks you control. When we tried this, we were told that it might take a while, so we went to lunch. It wasn't a long lunch, but the scanning was complete before we returned.

The scan resulted in several discoveries. First, we found that just about every computer on our test network was in need of some kind of vulnerability fix. This wasn't a surprise, since we deliberately have different levels of software on our many machines. Second, an IDS (intrusion-detection system) we were testing at the same time had freaked out. Apparently it decided that all of the queries from EVA were attacks. We probably should have told the IDS about EVA and Retina.

Third, we found that Retina's attempts by to probe one of our Solaris boxes resulted in the box generating streams of report messages. But the Sun box didn't prevent EVA and Retina from getting the information it needed.

What defeated Retina, and thus EVA, was Zone Alarm. Retina simply could not find a Zone-Alarm-equipped computer, much less report on its vulnerabilities. This isn't exactly a significant failure, however, since Zone Alarm and other similar firewalls eliminate (or make irrelevant) many vulnerabilities anyway.

Still, if you really want to keep on top of your network, you probably should find a way to get past the personal firewalls in your enterprise. Even with an excellent product such as Zone Alarm (or its enterprise cousins) vulnerabilities remain, even if they're more difficult to exploit.

Using EVA after the scan is remarkably intuitive, considering you're managing the vulnerability tracking and remediation of myriad computers and other network devices. Each device with an IP address is listed separately and each vulnerability is listed within, ranked in order of severity. As you click on each vulnerability listing, you're told what the problem is, how serious it is, and what can be done to fix it. If EVA can fix the problem, such as one that required a change to a registry setting, it will do so. Otherwise, it will provide a link that will let you implement the fix, or it will tell you what the problem is and where to find the fix.

Via the Events Manager, you can assign staff members to fix vulnerabilities, then track the overall level of completion, down to the individual fix. You can even generate charts that show the reduction in threat to the entire enterprise due to your efforts to fix problems.