TRIPWIRE ENTERPRISE 8.3 CONNECT. PROTECT. DETECT.

uuTripwire Enterprise has long been viewed by the industry as one of the best security investments you can make. In 2012 SC Magazine noted that Tripwire Enterprise “extends the Tripwire legacy of excellent products” while two years prior acknowledged that Tripwire is “almost a generic term for spotting changes in critical files.” It’s no surprise then that Control #3 of the SANS 20 Critical Security Controls states, “centralized solutions like Tripwire are preferred over stand-alone solutions.” All of this adds up to award-winning IT security and SC Magazine Awards two years running.

PRODUCT BRIEF

TRIPWIRE®

ENTERPRISE

RISK-BASED SECURITY MANAGEMENT SOLUTIONS

Tripwire® Enterprise is a security con-figuration management (SCM) suite that provides fully integrated solutions for policy, file integrity and remedia-tion management. Organizations can use these solutions together for a full, end-to-end SCM solution, or use its file integrity monitoring or policy manage-ment solutions on their own to address today’s pressing security and compliance challenges, while building a foundation that positions them to address tomor-row’s. The suite lets IT security directors and CISOs rapidly achieve a founda-tional level of security throughout their IT infrastructure by reducing the attack surface, assuring system integrity and delivering continuous compliance. Plus, because Tripwire Enterprise integrates with additional security point solutions like SIEMs and change management tools, organizations can broaden their security worldview and gain even greater system state intelligence.

A key IT security solution, Tripwire Enterprise supports a connect, protect and detect strategy by:

» Connecting the hardening and integrity of information systems to the priorities, initiatives and risk man-agement needs of the businesses or missions they serve.

» Protecting information through an enterprise-class hardening system that

provides a consistent, objective view of overall security posture across all devices and systems.

» Detecting deviations from known and trusted, hardened states, and by high-lighting the anomalies that indicates threats or breaches.

TIGHTLY INTEGRATED CONTROLS FOR CONTINUOUS END-TO-END SCM Each of Tripwire Enterprise’s three solu-tions is uniquely suited to its individual task. In combination, they create a for-midable enterprise-class SCM solution.

» Policy Manager as a standalone solu-tion assures continuous compliance. But as part of Tripwire’s SCM suite, it reduces the attack surface through enterprise-wide system hardening of file systems and desktops as well as network devices and databases, across numerous platforms and protocols. Tripwire Enterprise makes this possi-ble through agent-based and agentless continuous configuration assessment against over 300 policies, standards, regulations and vendor guidelines. Policy Manager also offers complete policy customization, waiver and exception management, automated remediation options, and granular policy scoring with thresholds, weights and severities. It does all this while providing proof of compliance and

 

 

JUNE, 2013

Tripwire Enterprise 8.3—Connect. Protect. Detect.2

making policy status highly visible and actionable.

» File Integrity Manager is the world’s best file integrity monitoring solution that checks across large heterogeneous environments and provides instant visibility into key configuration vul-nerabilities to assure system integrity across the enterprise. It increases operational efficiencies by reducing configuration drift and unauthorized change. Used on its own, it assures system integrity, but used in conjunc-tion with Policy Manager, it provides change-triggered configuration assessment. This turns “passive” con-figuration assessment into a dynamic, continuous, and real-time defensive solution that immediately detects deviations from expected, secure con-figuration standards and hardening guidelines.

» Remediation Manager, an add-on component for Tripwire Policy Manager, provides guidance to security and compliance teams to repair drifted, misaligned security configurations while retaining role-based manage-ment, approvals and sign-offs for repairs. This helps operations teams more easily and efficiently get new sys-tems into a production-ready state and helps them keep systems in that state once they’re in production, even in the face of inevitable change and configu-ration drift.

INDUSTRY-LEADING IT SECURITY CAPABILITIES As part of an industry-leading security platform, Tripwire Enterprise can lever-age these components to meet key IT security needs.

» Tripwire VIA™ Asset View helps organizations manage their Tripwire-monitored assets through their unique business lens by assigning tags that cat-egorize them based on notions of risk, priority, relevance and organizational

alignment. Security teams can filter these tags to support dynamic views of IT assets in business contexts—for example, to “cloud-based web servers that host the organization’s e-commerce capabilities.” Plus, because tags can be assigned to multiple assets simultane-ously, it’s quick and easy to onboard groups of similar assets.

» Tripwire VIA Data Mart, a Tripwire Enterprise add-on, extracts, abstracts and transforms raw security data (like configuration policy test scores, critical change information, and third-party security data) into “business intelligence.” Security team members at all levels can use this intelligence with standard business intelligence and reporting tools to see security information from the unique perspec-tive they require.

» Tripwire VIA Tag Integration Framework lets organizations use the descriptive metadata assigned to assets through other IT systems as Asset View tags that can be used in Tripwire Enterprise. That saves time tagging assets, and ensures that their classifica-tion reflects the business environment.

» Tripwire’s integration framework allows Tripwire Enterprise, Tripwire Log Center® and Tripwire IP360 to integrate with each other through common workflows, context, and analytics.

ENTERPRISE SUPPORTTripwire Enterprise supports agent-based and agent-less assessment and monitor-ing across:

» All major file systems and desktops: Windows, Red Hat, SUSE, Solaris, etc.

» Directory Services: Active Directory, e-Directory, etc.

» Network Devices: Firewall configurations, routers, IPS and IDS configurations, etc.

» Databases: Oracle, MS SQL, Sybase, DB2, etc.

uuTripwire, the original host-based intrusion detection system (HIDS) that detected macro changes to files and folders, was co-developed by Gene Kim, security guru and co-author of The Visible Ops Handbook. Redeveloped into Tripwire for Servers and later Tripwire Enterprise, it rapidly became the recognized standard for change audit—even being mentioned by name in the VISA Card Information Security Program (CISP) specification, the precursor to the PCI standard. Years spent honing this ability has resulted in a solution that detects even the finest-grained changes. Now, as an industry-recognized SCM solution, Tripwire Enterprise helps large multi-national enterprises manage their configuration integrity.

Tripwire Enterprise 8.3—Connect. Protect. Detect. 3

READY TO DIG DEEPER?

Visit www.tripwire.com for the following datasheets

»Policy Manager »Data Mart

»Remediation Manager »Asset View

» Integrity Manager » Tripwire Integrations

»Report Catalog

BRIAN HONAN, BH CONSULTING

LAYERED SECURITY

PROTECTING YOUR DATA IN TODAY’S THREAT LANDSCAPE

IT SECURITY AND COMPLIANCE AUTOMATION SOLUTIONS

WHITE PAPER

BRIAN HONAN, BH CONSULTING

LAYERED SECURITY

PROTECTING YOUR DATA IN TODAY’S THREAT LANDSCAPE

IT SECURITY AND COMPLIANCE AUTOMATION SOLUTIONS

WHITE PAPER

BRIAN HONAN, BH CONSULTING

LAYERED SECURITY

PROTECTING YOUR DATA IN TODAY’S THREAT LANDSCAPE

IT SECURITY AND COMPLIANCE AUTOMATION SOLUTIONS

WHITE PAPER

FEATURES AND BENEFITSSingle Point of Control for All IT Configurations

Tripwire Enterprise provides centralized control of configurations across the entire physical and virtual IT infrastructure, including servers and devices, applications, and multiple platforms and operating systems.

ChangeIQ for Intelligent Real-time Change Assessment

ChangeIQ capabilities intelligently assess changes in real time, determining whether they moved a system out of compliance, prioritizing remediation efforts and reducing overall risk.

Built-in Integration with Tripwire Log Center

Tripwire Enterprise integrates with Tripwire Log Center out of the box. The integration enables users to correlate change and event information to transform raw data into actionable knowledge. It also provides a centralized view of date center security.

Workflow Tools for Managing Failed Configurations

The Remediation Manager module provides role-based workflow tools that let users approve, deny, defer or execute remediation of failed configurations.

Integration with Change Management Systems

Because Tripwire Enterprise integrates with leading Change Management System (CMS) solutions, as change happens Tripwire Enterprise automatically reconciles detected changes against change tickets and change requests.

Virtual Infrastructure Monitoring Tripwire Enterprise integrates with VMware vCenter to provide control over virtual infrastructure (VI), auto-discovering new instances of VI and automatically monitoring and reporting on changes to VI.

Support for Faster, Easier Audit Preparation

Tripwire Enterprise dramatically reduces the time and effort for audit preparation by providing continuous, comprehensive IT infrastructure baselines along with real-time change detection and built-in intelligence to determine the impact of change.

Support for Maintaining a Secure, Compliant State

Tripwire Enterprise combines configuration assessment with real-time File Integrity Monitoring to detect, analyze and report on changes as they happen and keep configurations continually compliant. This immediate access to change information lets IT fix issues before they result in a major data breach, audit finding or long-term outage.

Automated IT Compliance Process Tripwire Enterprise automates compliance with the industry regulations and standards organizations are now subject to—from PCI, to NERC, SOX, FISMA, DISA and many others.

Reports and Dashboards for Enterprise-wide Visibility

Tripwire ships with numerous pre-defined reports that provide real-time scoring of compliance posture, including rate of change and other important trends. Report drilldowns, linking, and dashboards provide comprehensive overviews of security and compliance for any organizational level.

Classification of Assets with Asset View

Tripwire Enterprise Asset View lets you classify assets with business-relevant tags such as risk, priority, geographic location, regulatory policies, and more.

Import Metadata from Existing Systems into Asset View with the Tag Integration Framework

The Tag Integration Framework lets you automatically bring metadata associated with assets in other IT systems into the Asset View as tags. That saves time tagging assets and quickly aligns your Tripwire-monitored assets with your business environment.

Tripwire Enterprise 8.3—Connect. Protect. Detect.4

FROM MACRO VIEWS TO MICRO DETAILS

uu ORGANIZE AND MANAGE your assets in a way that reflects your business priorities

uu VIEW CHANGE AND CONFIGURATION from any perspective necessary

uu ZOOM INTO DETAILS that distinguish new threats from accidents and common

+

+

+

Tripwire Enterprise 8.3—Connect. Protect. Detect. 5

REPORTSERP Changes By Severity

Date: 7/17/09 4:19 PMPromotion Approval ID: Not appliedChange window: Not appliedUse strict package match: NoDisplay criteria at end: NoElement Exists: Not appliedNodes: ERP, esx4se.pdxse.tripwire.com, onlinecollab.srv1.tripwir

e.comNode name: Not appliedNode Properties: Not appliedRules: AllRule name: Not appliedElement name: Not appliedElement Properties: Not appliedVersion Properties: Demo Data Equals YesChange types: Added, Modified, RemovedSeverity range: AllCurrent versions only: NoTime range: All timePackages: Not appliedSeverity sections sort: Severity, descendingDetails table sort: Count, descendingDetails table (2nd) sort: Name, descending

High Severity

Name Type Last Change Time Count

DEMOSERVER.PDXSE.TRIPWIRE.COM Windows Server 11/7/08 1:31 PM 2

Severity Total: 2

NERC Scoring for Windows

MS Windows Server 2003 DM - NERC v2

Compliant

Node Score Waived Tests

WIN-COMPLIANCE2.PDXSE.TR IPWIRE.COM

77.19 0

WIN-COMPLIANCE3.PDXSE.TR IPWIRE.COM

77.19 0

WIN-COMPLIANCE4.PDXSE.TR IPWIRE.COM

77.19 0

WIN-COMPLIANCE5.PDXSE.TR IPWIRE.COM

77.19 0

Average

Node Score Waived Tests

ams.win2k3.dc1.tripwire.com 76.51 0

ams.win2k3.dc2.tripwire.com 76.51 0

ams.win2k3.dc3.tripwire.com 76.51 0

ams.win2k3.dc4.tripwire.com 76.51 0

ams.win2k3.dc5.tripwire.com 76.51 0

ams.win2k3.dc6.tripwire.com 76.51 0

ERP Changes By Group

Date: 7/17/09 3:34 PMPromotion Approval ID: Not appliedChange window: Not appliedUse strict package match: NoDisplay criteria at end: NoElement Exists: Not appliedNodes: Authentication, Database Backend, Networking Infrastruc

ture, Servers, VMware ESX HostsNode name: Not appliedNode Properties: Not appliedRules: AllRule name: Not appliedElement name: Not appliedElement Properties: Not appliedVersion Properties: Demo Data Equals YesChange types: Added, Modified, RemovedSeverity range: AllCurrent versions only: NoTime range: All timePackages: Not appliedDetails table sort: Total, descendingDetails table (2nd) sort: Name, ascending

uuTripwire Enterprise provides nearly 40 reports, with additional in development. More samples and the full Report Catalog are available on our website.

» Baseline Elements » Change Process Compliance » Change Rate » Change Variance » Change Window » Changed Elements » Changes by Node or Group » Changes by Rule or Group » Changes by Severity » Compliance History » Composite Changes » Detailed Changes » Detailed Test Inventory » Detailed Test Results » Detailed Waivers » Device Inventory » Elements » Frequently Changed Elements » Frequently Changed Nodes » Inventory Changes » Last Node Check Status » Missing Elements » Monitoring Policy » Nodes with Changes » Reference Node Variance » Remediation Assessment » Remediation Work Order Details

» Scoring » Scoring History » System Access Control » System Log » Task Report » Test Result Summary » Test Results by Node » Unchanged Elements » Unmonitored Nodes » Unreconciled Change Aging » User Roles All Object Types

Tripwire Enterprise 8.3—Connect. Protect. Detect.6

BROAD, DEEP SUPPORT FOR COMPONENTS IN THE IT STACK Whether IT needs to keep watch over mission-critical servers or the entire

IT infrastructure—including virtualized environments and applications—

Tripwire Enterprise provides the capability to assess, validate and enforce

policies and detect all change, no matter the source. Tripwire supports the

following components in the IT stack:

PHYSICAL INFRASTRUCTURE

VIRTUAL INFRASTRUCTURE

APPLICATIONS

DIRECTORY SERVICES

DATABASES

FILE SYSTEMS AND DESKTOPS

HYPERVISORS AND VMS

NETWORK DEVICES AND VSWITCHES

TRIPWIRE ENTERPRISE FOR APPLICATIONS

Mission-critical applica-tions are at the top of the IT infrastructure and enable the daily activities

like email, web-based applications, and other critical applications that keep orga-nizations moving forward. Tripwire Enterprise for Applications provides compliance policy management and file integrity monitoring capabilities to help ensure that supported applications are configured properly for security, compli-ance, and optimal performance and availability. In addition to out-of-the-box policies for applications such as Microsoft Exchange and IIS server, Tripwire Enterprise lets IT easily create policies for other business applications, including custom applications.

TRIPWIRE ENTERPRISE FOR DIRECTORY SERVICES

Tripwire Enterprise for Directory Services provides independent compliance policy management for

LDAP-compliant directory server objects and attributes, such as LDAP schema, password settings, user permissions, net-work resources, group updates, and security policies. Tripwire bases these assessments on CIS, NIST, DISA, FISMA, NERC, FDCC and other indus-try standards and regulations to help ensure organizations get their directory servers into a secure and compliant state. The component accelerates its deploy-ment with pre-configured Active Directory, Sun Java System Directory Server and Novell eDirectory default set-tings that can be fully customized to specific enterprise environments.

TRIPWIRE ENTERPRISE FOR DATABASES

Tripwire Enterprise for Databases works in con-junction with Tripwire’s File Systems component to

help organizations get their Oracle, Microsoft and IBM database servers into secure, continually high-performing states. Tripwire does this by assessing configurations of schema objects, applica-tion and configuration files, security and configuration parameters, access settings, and user roles and permissions against

CIS, PCI and NIST guidelines for securi-ty. Once IT gets the database server into a known and trusted state, it keeps it there by ensuring all subsequent configuration changes are detected.

TRIPWIRE ENTERPRISE FOR FILE SYSTEMS AND DESKTOPS

Tripwire Enterprise for File Systems and Desktops assesses the configurations of physical and virtual

server and desktop file systems, includ-ing security settings, configuration parameters, and permissions. Tripwire bases its policies on settings recommend-ed by respected organizations such as CIS and NIST. When followed by Tripwire’s tunable change detection, IT has a single solution that ensures visibili-ty and accountability for all configuration control activity on a wide range of platforms. And Tripwire’s agents are designed to achieve configura-tion control across the enterprise with minimal impact on network bandwidth.

TRIPWIRE ENTERPRISE FOR VMWARETripwire Enterprise for VMware provides visibility across the VMware virtual infrastructure, enabling

continuous configuration control of vir-tual environments. This component provides out-of-the-box assessment tests for hypervisors, virtual containers, and vSwitches based on CIS security policies, DISA Security Technical Implementation Guides (STIGs), and VMware’s Infrastructure 3 Security Hardening guide. The included VirtualCenter inte-gration auto-populates the same hierarchy of VirtualCenters, Clusters, Data Centers, Folders, Resource Pools and hypervisors from VMware into Tripwire Enterprise, which enables auto-discovery, monitoring and reporting of changes among and within newly-created virtual infrastruc-ture objects.

Tripwire Enterprise 8.3—Connect. Protect. Detect. 7

TRIPWIRE ENTERPRISE FOR NETWORK DEVICES

Tripwire Enterprise for Network Devices assesses configuration settings of the broadest range of net-

work devices in the industry, including any device running a POSIX-compliant operating system. By testing configura-tions against industry-proven settings and

then following up with continuous file integrity monitoring that identifies out-of-compliance changes, this component helps organizations achieve and maintain continuous compliance with security, reg-ulatory, and operational measures. In addition, Tripwire generates an audit trail of all configuration control activities, so proving compliance in an audit is greatly simplified.

TRIPWIRE ENTERPRISE CONSOLE—SUPPORTED PLATFORMS AND BROWSERS

» Solaris, Windows, Red Hat Enterprise Linux, SUSE Linux Enterprise » Firefox, Netscape, Internet Explorer

TRIPWIRE ENTERPRISE FOR APPLICATIONS—SUPPORTED APPLICATIONS

» Microsoft IIS » Microsoft Exchange Server 2003 » Oracle Database 10g

TRIPWIRE ENTERPRISE FOR DIRECTORY SERVICES—SUPPORTED APPLICATIONS

» Windows Active Directory » Sun Java System Directory Server » Novell eDirectory

TRIPWIRE ENTERPRISE FOR DATABASES—SPECIFICATIONS

ORACLE 9I, 10G & 11G

Schema Objects

» Functions » Indexes » Procedures » Tables » Triggers » Views » Packages and package bodies » Sequences » Stored outlines » Synonyms » Types and type bodies » Libraries » Database Links » Clusters

Database Objects

» Directories » Tablespace

Security

» System Privileges » Object Privileges » Audit Parameters

Access Settings

» Users » Profiles » Roles

Software Files

(using file system monitoring rules)

MICROSOFT SQL SERVER 2005, 2008 & 2012

Schema Objects

» Tables » Indexes » Triggers » Views » Stored Procedures » Functions » User-defined types

Database Objects

» Configuration Parameters » Databases

Security & Access Settings

» Logins » Server Roles » Database Users » Database Roles

Software Files

(using file system monitoring rules)

IBM DB2 8.2 & 9.5

Schema Objects

» Functions » Aliases » Indexes » Packages » Procedures » Schemas » Schema Groups » Sequences » Tables » Triggers » User Defined Types » Variables » Views

Database Objects

» Bufferpool » Configuration Parameter » Database Partition Group » Event Monitor » Histogram Template » Service Class » Tablespace » Threshold » Work Action Set » Work Class Set » Workload

Security

» Audit Policy » Security Label Component

Security Access Settings

» Groups » Roles » Users

Software Files

(using file system monitoring rules)

PLATFORM SUPPORT & SPECIFICATIONS

TRIPWIRE ENTERPRISE FOR FILE SYSTEMS AND DESKTOPS—SPECIFICATIONS

Agent platform support

» AIX » CentOS » HP-UX » Oracle Enterprise Linux » Red Hat Desktop Linux » Red Hat Enterprise Linux » Solaris SPARC, x86 & x64 » SUSE Linux Enterprise Server » Windows Server 2003 & 2008 » Windows Desktops, incl. XP, Vista & 7

UNIX system properties monitored

» File adds, deletes, modifications » Audit tracking » File existence » ACL (Access Control List) » Installation package data » User ID of owner, group ID of owner » File and directory type, and file size » Access, modification and change timestamp » Growing attribute

Virtual environment support

» VMware ESX & ESXi » VMware vSphere » Solaris Zones

Windows system properties monitored

» File adds, deletes, modifications » Registry keys and values » Event tracking » Installation package data » Flags: archive, hidden, offline, temporary, system, compressed

» Access, write and create time » File and directory type, and file size » Owner, Group, DACL, SACL, read-only » Number and hashes of alternate data streams » Growing attribute

Agentless support for file systems

» POSIX-compliant operating systems (through Tripwire Enterprise for Network Devices node)

TRIPWIRE ENTERPRISE FOR VMWARE—SUPPORTED HYPERVISORS

» VMware ESX & ESXi » vCenter Server

TRIPWIRE ENTERPRISE FOR NETWORK DEVICES—SUPPORTED VENDORS & DEVICES

» Cisco IOS, CatOS, PIX OS & ASA » Cisco VPN 3000 Series Concentrator » Cisco Catalyst 1900/2820 Switch » Alcatel OmniSwitch » Bluecoat » Extreme

» F5 BigIP » Foundry FastIron & ServerIron » HP ProCurve Series » Juniper M/T Series » Marconi ForeThought » NetScreen

» Nokia IPSO » Other devices using the included Universal Device Kit

Agentless support for file systems

» POSIX-compliant operating systems

Visit www.tripwire.com for detailed platform version support

PLATFORM SUPPORT & SPECIFICATIONS (CONTINUED)

©2013 Tripwire, Inc. Tripwire is a registered trademarks of Tripwire, Inc. All other product and company names are property of their respective owners. All rights reserved.

uu Tripwire is a leading global provider of risk-based security and compliance management solutions that enable organizations to effectively connect security to the business. Tripwire delivers foundational security controls like security configuration management, file integrity monitoring, log and event management, vulnerability management, and security business intelligence with performance reporting and visualization. uuu

LEARN MORE AT WWW.TRIPWIRE.COM OR FOLLOW US @TRIPWIREINC ON TWITTER.

TEPB830r 201309