Compliance is a natural extension of a vulnerability analysis tool. Normal vulnerability scanning includes searching for unpatched systems, unprotected directories, and other errors in configuration.
Compliance is a natural extension of a vulnerability analysis tool. Normal vulnerability scanning includes searching for unpatched systems, unprotected directories and other errors in configuration.
Compliance typically adds a set of arbitrary checks that are specific to a particular regulatory regime. For example, a compliance policy might require that a DVD-ROM on a system can only be used by someone logged in locally. That's not really a vulnerability; it's just someone's idea of a particular security policy.
All of the products we tested except for Lumension Scan have a significant compliance component. For some, compliance scanning is also an extra cost or separately licensed option.
In vulnerability analyzers, "compliance" has two main parts: one is defining compliance policies and checks, and the second is generating reports with the specific checks that are called for by the regulatory regime. Because compliance is an entirely separate vulnerability analysis discipline with very different requirements, you should carefully consider the role of compliance testing and reporting before picking a vulnerability analyzer.
The requirements for compliance testing will change depending on the regime you're trying to support, and the feature set is usually more focused on policy auditing and less on getting individual systems securely configured. For example, everyone knows that patching production systems doesn't happen within a few hours of Microsoft's latest update. Compliance reporting is more about reporting on how long it took for you to bring systems back up to specification, than it is helping you figure out which systems need those patches.
If compliance is on your mind as part of a vulnerability analyzer acquisition, we think you should look carefully at eEye, McAfee, Qualys, and SAINT. In our quick look, we were most impressed by McAfee's compliance policy creation tools, and SAINT's ability to quickly import and edit standardized compliance policies based on the three "standard" formats.
Cisco fears competition to its Hyperflex hyperconverged platform and kicks Nutanix out of it's Solution...
A review of 19 companies that offer free cloud storage
By forcing Windows 10 on users, Microsoft has lost the tenuous trust and credibility users had in the...
One of the defendants agreed to forfeit $20.9 million in proceeds from the scam.
CASB products provide a variety of security measures, including access control, firewall, identity...
CIOs can achieve cost savings and productivity gains from the convergence of development, IT ops and BI...
Google's mélange of messaging apps is about to get even more chaotic. The company plans to shift its...