Agent-based product supports proxy functionality.
NetIQ’s Vulnerability Manager is an agent-based product. Data is collected in the central Microsoft SQL Server database and accessed by administrators through a console application. A Web-based interface is available for viewing reports.
We installed Vulnerability Manager and deployed Unix and Windows agents across our test network, a process handled easily via a console wizard. NetIQ also supports proxy functionality, where an agent on one server connects to other servers to collect data. The agent then reports to the central server, helping cut down on network traffic and open firewall ports required in the communications path.
Policies are defined by creating security checks and grouping them into compliance templates. NetIQ includes the standard regulatory (for example, HIPAA and Sarbanes-Oxley) and organizational (such as the National Institute of Standards and Technology) templates, but it’s also possible to create policies from scratch, a straightforward process in general that could use a little more documentation to be completely smooth. Our tests showed that once a policy is defined, policy checks run directly against the system complete very quickly.
NetIQ stands out among its competitors in that after users run many compliance checks, they can look at the list of available reports and easily identify which report they want to view. The list includes detailed information about each report, such as name, description and date completed. To run delta reports, you choose two reports of the same type and select its “run delta” option.
To stay up-to-date on checks that change frequently, NetIQ includes saved lists for more automatic baseline rule checks. This feature is helpful for checking a list of services that should be running or packages that should be installed on a given set of machines.
Access control – the ability to limit users to specific actions or systems monitored by the product – is very detailed, definable down to specific tasks for operating system type.
Another notable difference with this NetIQ product is that it plugs into the TruSecure (now part of Cisco) vulnerability alerting feed. Vulnerability Manager uses this information about possible exploits to create corresponding compliance checks across the network. Vulnerability information is refreshed through scheduled updates with the NetIQ AutoSync service, the same method through which policy templates are refreshed. Only the Symantec and NetIQ products have autoupdate functions.
NetIQ includes an audit trail of system activities within its administrator console, but shows limited information. Users will see a new user account was added and by whom, but they don’t know which account it is, for example. NetIQ support informed us that all detailed data resides in the database and could be queried if needed.
Autoremediation is available, but very limited. NetIQ executives say the company focuses on helping organizations maintain separation of duties and will integrate with partners for remediation activity.
Previous: Introduction | Next: Symantec >
