SOX Vulnerability Assessment & Audit Prodcuts
Home > IT Answers > Security > SOX Vulnerability Assessment & Audit Prodcuts
WintelEngr
0 pts.
0
Q:
SOX Vulnerability Assessment & Audit Prodcuts
Security management, Features/Functionality, McAfee, Symantec, Vulnerability Assessment & Audit, Vendors, Product/Service evaluation, Internet Security Systems, StillSecure, NetIQ, Consul Risk Management, eEye Digital Security, Harris, Nessus, Qualys, Vigilante
Are there reviews showing SOX Vulnerability Assessment & Audit products? NetIQ seems to show up in a number of security categories(SOX, Mtg, Assessment, Patching), how does it compare to the other products?

Thanks for any help & pointers you can provide!
Cheers
ASKED: Nov 17 2004  3:42 PM GMT
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
RELATED QUESTIONS
0
Mikelearth
0 pts.
0
A:
 RATE THIS ANSWER
0
Click to Vote:
  •   0
  •  0
  • AddThis Social Bookmark Button
Although we've done the initial audit manually, I've been looking for some help in managing compliance. NetIQ, Legato and Configuresoft are the three possible solutions I've found so far.

Of the three, Configuresoft seems to be the most complete. It not only logs any changes, you can set policies on your 'Sox' servers which prevent permission changes unless a 'Sox' administrator approves them. They all do a fair job with their compliance reporting. All of them do a fair job of general vulnerability testing as well.

I haven't selected a solution yet, so it would be best to do your own evals. Good Luck! ...and if you find something else that works even better, be sure to write! 8-)
Last Answered: Nov 17 2004  5:19 PM GMT by Mikelearth   0 pts.
  •   
0
0
RSS - Discussions Help
Discuss This Answer:
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _



_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

thepete   0 pts.  |   Nov 18 2004  8:57AM GMT

In security products, you often will find they are offering you solutions to problems you don’t know you have (or had). It is no different here. First find out what you really need, such as through a thorough security test, and then apply the right solution where appropriate. A security test will also act as a quarterly reporting tool. Finally, don’t confuse a security test with a penetration test or IT audit. Look at the OSSTMM at <a href="http://www.osstmm.org/" title="http://www.osstmm.org/" target="_blank">http://www.osstmm.org/</a> and the security metrics used in SOX quarterly reporting at <a href="http://www.isecom.org/securitymetrics.shtml" title="http://www.isecom.org/securitymetrics.shtml" target="_blank">http://www.isecom.org/securitymetrics.sh…</a>. You will find even a very useful security metrics reporting tool called SecurityNOW! from CIOview there which is really worth looking at.

Once you’ve done that, then go back and match the things that are missing from your security to the appropriate product.

 
0