WHITE PAPER (TRIPWIRE)

Improve Your
Cybersecurity Posture: NIST

Continuous Monitoring Using Security Configuration
Management, Critical Change Control, Vulnerability
Management And Log Management

Fortra White Paper

Improve Your Cybersecurity Posture: NIST

There isn’t an industry that hasn’t been affected by cyber

In this paper we summarize the NIST framework—reflecting

threats, and the broadcast industry is no exception. In Aprilon the most current FCC guidance—and addressing the2015, France’s TV5Monde was attacked, resulting in elevengoals and methods to achieve better cybersecurity. Weof its channels going dark and its social media outlets

then present options for automating these complex andcommandeered to display pro-Islamic State messages. Thisburdensome processes using Fortra's solutions Tripwire®

was preceded by an attack on WBOC in Salisbury, Maryland,Enterprise, Tripwire IP360™ and Tripwire LogCenter®.

where their Twitter account and website were hacked andthe site’s content also replaced with images supporting
ISIS. While both examples were politically motivated, that’s
not to imply that’s the only reason for an intruder to hackinto a broadcaster—consider simply breaking the ability
to broadcast, accessing customer (including credit card)
information or stealing/ransoming intellectual property areother criminal MOs. Of particular concern is a disruption
to the Emergency Alert System (EAS), especially during acoordinated physical attack—the results of which could becatastrophic public safety threats. This is a wake-up callto the broadcasting sector that it is not only vulnerable
to disruptive cyber intrusions and attacks, but that those
attacks could have a severe impact on society.
Consider threat vectors. While Internet Protocol-based(IP) services deliver huge benefits in being able to transfer

The result will be an action plan for your organization to startor enhance your current cybersecurity posture by leveraging
the NIST Cybersecurity Framework.

WHAT IS NIST?

Mandated by the United States Federal Government in 2013
for their agencies, NIST is intended to offer guidance on
how to minimize cyber risks to infrastructure and enhance
the ability to respond effectively to a cyber event. The NIST
guides are somewhat daunting, but they provide a complete
description of how organizations can set up an IT system,
define its risks and apply appropriate controls to address
those threats. Furthermore, in an effort to make the guidance
more accepted by the wide variety of organizations, the
NIST guides are being re-written with guidance from civilian,
military and intelligence communities. The FCC’s initiative iscontent quickly across locations without feed lines andan example.

without using traditional fiber transport, there’s inherent

As a result of President Obama’s executive order inrisk as IP platforms offer a vast range of threat vectors.
Communication and media providers like broadcast, cable,
wireless, wireline and satellite have increasingly adopted IP
technology in their production operations and they all havewebsites, increasing their vulnerability. Protective measuresthat include people, process and technology must be
implemented, maintained and, as attacks constantly evolve,
continuously improved.

FCC Guidance

A working group (WG4) of the FCC’s Communications
Security, Reliability and Interoperability Council (CSRIC)
initiative has issued basic security recommendations for
operators, participants and manufacturers to better protect
their systems, based on the National Institute of Standards
and Technology (NIST) Cybersecurity Framework. The
WG4 report provides common sense guidance based onrecommendations from industry cybersecurity experts,
narrowed down to what it means to broadcasters.

2013, NIST also released its Cybersecurity Framework(CSF) for Improving Critical Infrastructure Cybersecurity.
The framework is a voluntary, risk-based approach to
cybersecurity that enables organizations of any nature
to apply strong cybersecurity measures to secure criticalinfrastructure. The NIST CSF refers to other security standards
such as NIST 800-53, COBIT 5 and ISO 27001. CSF does
not provide templates on how to deploy the framework.
The framework starts with functions organized by basic
cybersecurity activities aligning with existing methodologies.
The Framework provides a common taxonomy andmechanism for organizations to communicate theircybersecurity risk and plan.

How to Approach NIST with Tripwire

So how can security automation solutions such as Tripwire
products help your organization? First let us give you an
overview of the products, then a more specific solution
example to see how Tripwire can help you support youralignment to the NIST Cybersecurity Framework.

Fortra.com

Page 2Fortra White Paper

Improve Your Cybersecurity Posture: NIST

Tripwire Endpoint Detection Response

and many others). Tripwire provides more than 650 out-

critical end point detection and response (EDR) capabilities.

file and configuration settings on most operating systems

Tripwire provides an integrated suite of solutions to deliver
These include detecting security incidents, containing theincident at the endpoint, investigating security incidents andremediating endpoints.
Each solution from Tripwire or another security provider hascore competencies in different areas in the information
security space; integrating these competencies helps solve
security and compliance problems. Gaining additional
context from other solutions enables more informed andbetter decisions. Automation helps apply intelligence anddelivers more effective security operations. Organizations
can respond faster with precision while also driving security
costs down. Tripwire’s integrations with a wide array ofvendors bring a range of benefits and use cases by distinct
categories: Threat Intelligence, Network Security, Securing
Industrial Control Systems (ICS), Analytics and Security
Incident & Event Management (SIEM), IT Service Management(ITSM) and Integrated Access Management (IAM).

of-the-box, customizable policies that instantly assessand devices. Tripwire Policy Manager pinpoints efficiencies,
speeds remediation and dramatically lowers the costs ofproving compliance. This process of Security Configuration
Management is one of the most important cybersecurity
disciplines and is critical to any mature IT organization.

Tripwire IP360

Tripwire IP360 provides complete visibility into theenterprise network including all networked devices andtheir associated operating systems, applications andvulnerabilities. It’s an ideal foundational control for effective
security risk management. Tripwire IP360 uses advanced
analytics and a unique quantitative scoring algorithm
based on several factors—including the vulnerability
score and business-relevant asset value—to prioritize thevulnerabilities for remediation. The result is actionable datathat enables IT security teams to focus on the tasks thatwill quickly and effectively reduce overall network risk with

Tripwire’s Solutions

the fewest possible resources. By employing the built-in

the core Tripwire solutions.

IT organizations can now enable EDR for the network, which

Tripwire Enterprise

based on system changes and potential business impact

Tripwire Enterprise, Tripwire IP360 and Tripwire LogCenter are

Tripwire Enterprise consists of two primary functional
capabilities: first, providing the ability to detect and filter
authorized and unauthorized changes in critical files andconfigurations across your network, and second, the ability
to assess and report whether your IT assets are configured
in a manner compliant with your organization’s adopted
compliance policies (like FISMA).
File Integrity Monitoring is a key requirement of IT security.
Subtle system changes associated with breaches, theft
and all types of malicious behavior can activate a “tripwire”
in monitored endpoints that then alerts the organization.
Tripwire’s best-of-breed File Integrity Monitoring detects
critical changes to a system, determines who made thechange and when, what actions occurred before or after, andif the change was authorized—exactly the type of informationand detail necessary to identify new risks and threats.
Tripwire Policy Manager continually assesses IT control
configurations against dozens of policies and standards(such as DISA STIGs, NIST/FISMA guidelines, PCI DSS, ISO,

Fortra.com

integration between Tripwire Enterprise and Tripwire IP360,
provides the ability to automatically adjust security controls
thereby significantly reducing overall enterprise cyberthreat risk.

Tripwire LogCenter

Tripwire LogCenter is a log and event management
product that provides enterprise-class log aggregation,
event assessment and control. Tripwire LogCenter helps
organizations comply with the NIST CSF (and other)requirements to maintain complete and accurate logs
by providing agent-based, lossless capture and retentionof logs—even in the face of network outages and othercommunication interruptions. Tripwire LogCenter event
analysis further enables organizations to identify acoordinated attack across diverse devices, capture full
log and forensic data, and inform system managers withdashboards, notifications and alerts. Its tight integration
with Tripwire Enterprise enables customers to look at
critical or suspicious changes to a device and then pivot toassociated log events, and vice versa. Log investigation may
be done right at the Tripwire Enterprise console to streamline

Page 3Fortra White Paper

Improve Your Cybersecurity Posture: NIST

compliance and security efforts. In addition, Tripwire

applications, including the application used to process and

LogCenter can correlate on changes detected by Tripwire

store sensitive information.

Enterprise based on authorization or impact to security policy.
This real-time capability can cut the time to detect andinvestigate a security event from weeks or months to minutes.

The FISMA Solution

For an organization to meet NIST-prescribed guidance, there
are a number of tasks and artifacts developed to determine
system risk and the controls (system configuration, settings,
utilities and tools) necessary to mediate the threats andvulnerabilities to that system. This is the essence of security,and it ties directly to authority to operate the system ina production setting. But secure setup of a system is notenough by itself. In addition to common threat vectors thereis the risk of control failure itself. If a critical control is lost,
how it that determined? What other controls can be put on
the key control?
Risk and security management has been trying to grapple
with this problem for a long time, and depending on theclassification or categorization of the system, the solution caninvolve a lot of dedicated manpower to validate that system

The next step is to choose the correct security controls forthe system based on the categorization for the system. Thistypically involves assessment with NIST 800-60 (Guide to
Mapping Types of Information and Information Systems
to Security Categorization) to help identify the risks to thesystem. It will also require a determination of special risks
and controls unique to the system. However, in the end, thistask will involve the selection of controls from the 18 control
families found in NIST SP 800-53.
Tripwire Enterprise, Tripwire IP360 and Tripwire LogCenter
all can assist in meeting NIST guidance by 1) providing a
specific security controls as found in the 800-53 control
families, 2) providing control assessment (continual
monitoring), 3) file integrity validation, and 4) providing
vulnerability management. Please refer to the NIST Tripwire
Enterprise, Tripwire IP360 & Tripwire LogCenter Controls
Matrix that follows.
The next step is to implement controls—when specificcontrols chosen are applied to the system. The result should

controls are effective and being maintained correctly.

be a report of all controls used in a system.

This is why new NIST SP 800-37 focus has been changed

This is when Tripwire products are configured to perform

towards the effort to develop controls and a plan to validatethat controls are effective and operating as planned.
Organizations must address risk and controls assessment
for all systems in the manner prescribed by NIST; related
tasks might include the assessment of overall system
configuration results in a system categorization, andsystem component inventory and boundary information(“Categorize the information system and the information
processed, stored, and transmitted by that system based on
an impact analysis”).
This is where Tripwire Enterprise, Tripwire IP360 and Tripwire
LogCenter can provide both prescribed controls and a means
to validate that overall controls are operating correctly.
Tripwire Enterprise can be used in this initial assessment
task to gather configuration information about the deviceson this system. That could include Windows, Unix and Linux
Servers, network devices and databases like SQL Server or
Oracle. To accomplish this, all devices would be scannedwith rules to check file inventory and system configuration.
Special rules can be used to baseline the state of custom

Fortra.com

as chosen controls (control and configuration monitoring),
or as part of a management controls such as Contingency
Planning (CP controls) which call for a method to validate
system file integrity on backup devices and media, orSecurity Assessment and Authorization (CA controls), where
Tripwire Enterprise is used as part of the auditors tools tovalidate the files have not changed and supports the SHA2
hash encryption algorithm. When Tripwire Enterprise is used
to monitor for Technical or Operational controls, the user
can choose to use an out-of-the-box policy, or develop
their own monitoring rules. In either case, Tripwire Enterprise
can provide reporting on all the controls it is monitoring on
multiple platforms.
The next step is to Assess Security Controls. This work
is typically when the first full assessment of a system isperformed, and the controls which are not working are
identified and put onto a tracking report.
Tripwire Enterprise’s Policy Manager was designed forthis step in the compliance process. Tripwire assessment
policy for NIST (customized or used out of the box) thenPage 4

Fortra White Paper

Improve Your Cybersecurity Posture: NIST

provides the bulk of the required reporting, including an

When a control fails, such as when a setting is changed

ability to track and report on failing configuration/controlsthat causes the system to be out of compliance, Tripwire

in a “waiver” feature that tracks the authorization andEnterprise alerts the system administrator with information

remediation schedule for each control (POA&M=Tripwire

on how to fix most problems (remediation advice) and

Report). Tripwire technology continually assesses the state ofallows the Tripwire Enterprise operator to request a waiverthe system controls and can be configured to alert security

which tracks the failure without affecting the NIST scoring.

personnel when or if configuration or control is lost. The

In addition, Tripwire IP360 offers ongoing vulnerability riskstate of the control environment is determined with detailed

assessment and prioritization, which allows the operator toreporting offering forensics and other relevant information.

respond according to policy.

The next step is to validate and authorize the system forConclusion

production use. While this is defined as a specific task,
it is really an ongoing process of evaluating risk and thepresent state of controls. And by using Tripwire Enterprise
Policy Manager, security personnel and the system owner
can maintain a “desktop” reporting feature that can show
them the continual, near real-time status of controls andcompliance at a glance.
The final step is to Monitor Security Controls. This typicallyinvolves an expensive effort to reassess changes to thesystem environment, frequent vulnerability scanning andalerting, ongoing security control assessment, taking
ongoing remediation actions on system control failures orchanges, making key updates, and reporting the combined

With solutions like Tripwire Enterprise, Tripwire IP360 and
Tripwire LogCenter, organizations can make the challenge
of becoming and maintaining a stronger cybersecurity
posture as outlined in the NIST Cybersecurity Framework
much easier and cost effective than trying to manage
the requirements manually. As we’ve seen, Tripwire
Enterprise and Tripwire LogCenter offer specific controls,
control monitoring and management control capabilities.
Additionally, Tripwire offers unique products that meet thevery nature of “continuous monitoring” as defined by NIST
800-37. And this concept is not new to Tripwire—it has been
the essence of the company since its formation.

information to authorities (such as FCC).

Fortra.com

Page 5Fortra White Paper

Improve Your Cybersecurity Posture: NISTNIST TRIPWIRE ENTERPRISE, TRIPWIRE IP360 & TRIPWIRE LOGCENTER CONTROLS MATRIXNIST 800-53A
Control Family

Control TypeAccess Control(AC)

Tripwire
Response*

Providesand/orSupports
and/orValidates

Tripwire Enterprise
Policy ComplianceManagement

Tripwire EnterpriseFile Integrity
Monitoring

Tripwire IP360
Vulnerability
Management

Technical

ProvidesSupports
Validates

Tripwire Enterprise
can be used forassessment of themany operating
system settings
that support manyof the AC controls
including AC-2
Account management, AC-6 Least
Privilege, and AC-7
Unsuccessful login
attempts

Tripwire Enterprise
can be used tocontinually monitor and validatethat files have notbeen changed onservers, devices orparticular applications or data
files. This is often
important for AC
control of mobile
users and remote
access devices.
(e.g. AC-19)

Audit andAccountability(AU)

Technical

ProvidesSupports
Validates

Tripwire Enterpriseis used to assess
AU controls which
are called for in
the description of
applicable controls.
These include AU-4,
Audit of Storage
Capacity, AU-5,
Response to Failure
as well as settingscalled for, example: AU-2(4) Audit
Privileged Functions
and AU-9 Protectionof Audit Information

Tripwire EnterpriseFile Integrity
Monitoring (FIM)
can be used toassist in Audit andAccountability offiles that should
not change orshould be compared between
systems to be identical. Unexpectedchange alerts cansignal breach or
malicious behavior.

Tripwire IP360
directly provides
AU-06(5) controls
with our proprietary advanced
threat intelligence
integrations bybringing vulnerability intelligence
into a single paneof glass with othercritical data.

Security
Assessment
andAuthorization(CA)

Management

Validates
Supports

Tripwire Enterpriseis often used as acontinual monitoring Audit tool tovalidate files andreports have notchanged between
compliance audits.
Tripwire Enterprise
supports theCA-2(1) control byuse of approved
encryption hashalgorithms SHA2 forthis function.

Tripwire IP360 can
support CA-08
control policies
with vulnerability
exposure.

Tripwire Log
Center Audit Log/
Event Analysis

Tripwire Log Centercan be used as thecontrol specified
AC-2(4) which
specifies that theorganization must
employ automatedmechanism forauditing access
control events,
including remote
access AC-17.

Tripwire Log Centercan be used as acore audit control - working to
specifically meetrequirements of
AU-2 thru AU-12.
Tripwire Log Center
also provides analytical capabilities
to compare audit
trails.

* The overall Tripwire response rating is based on the following criteria:• How much Tripwire enables the key intention behind the control• Greater weight to “provides functionality” for the control• The number of sub-requirements responded to• Harvey balls represent the amount of Tripwire response to the control requirement (25/50/75/100%)

Fortra.com

Page 6

Fortra White Paper

Improve Your Cybersecurity Posture: NISTNIST TRIPWIRE ENTERPRISE, TRIPWIRE IP360 & TRIPWIRE LOGCENTER CONTROLS MATRIXNIST 800-53A
Control Family

Control Type

Configuration
Management(CM)

Providesand/orSupports
and/orValidates

Tripwire Enterprise
Policy ComplianceManagement

Tripwire EnterpriseFile Integrity
Monitoring

Operational

Validates
Supports

Tripwire Enterprise
supports verification of key security
settings such as
CM-5 which calls
for Audit AccessRestriction enforcement, and CM-7
which calls for“Least Functionality.”
Tripwire Enterpriseverifies thesesettings within theoperating system,
and assures that
common attackable services are
disabled.

Tripwire Enterprise
FIM is a bestpractice control
for obtaining theessential baseline
configuration
called for in the CM
control set. Once
this baseline is
obtained, Tripwire
Enterprise canbe configured towatch specificapplications forchange meeting
the requirements
around CM.

Contingency
Planning (CP)Operational

Supports

Identification
andAuthentication(IA)

Technical

Validates,
Supports

Fortra.com

Tripwire
Response*

Tripwire IP360
Vulnerability
Management

Tripwire Log
Center Audit Log/
Event Analysis

Tripwire Log Centercan be used toautomate andenforce access
restrictions on
audit logs as wellas supporting theauditing for changeis access restrictionchanges - example
CM-5(1-2)

Tripwire Enterpriseis often used tosupport file integrity operations forContingency programs, being able
to validate the files
on contingency
systems (CP-2) andbackups (CP-9).
Tripwire Enterprise
supports theAuthentication settings are correctlyset, such as IA-5 orIA-9 Authenticator
management
controls, and IA-7,
Cryptographic
moduleconfiguration.

Because many
operating systems
use files to maintain identification
and authentication
information forusers, devices andother controls, theTripwire Enterprisefile integrity monitoring of these files
can be a pivotal
monitoring control
to the unauthorized escalation ofprivilege.

Page 7

Fortra White Paper

Improve Your Cybersecurity Posture: NISTNIST TRIPWIRE ENTERPRISE, TRIPWIRE IP360 & TRIPWIRE LOGCENTER CONTROLS MATRIXNIST 800-53A
Control Family

Control Type

Incident
Response (IR)Providesand/orSupports
and/orValidates

Tripwire Enterprise
Policy ComplianceManagement

Tripwire EnterpriseFile Integrity
Monitoring

Tripwire IP360
Vulnerability
Management

Tripwire Log
Center Audit Log/
Event Analysis

Operational

ProvidesValidates
Supports

Tripwire Enterprise
supports key andrecommended
Incident monitoring settings aremaintained andin accordancewith NIST and NSA
recommendations,such as IR-5.

Tripwire Enterprise
FIM is also used asa manner to verify
and detect network
device changes tothe configuration
files that control
most routers.

Tripwire IP360
can support theenforcement ofcustomer defined
IR-06(2) control
policies andprocedures bymonitoring for vulnerability exposure

Tripwire Log Centercan provide tracking of security
events including
incidents. Tripwire
Log Center also
provides formethod of collection and correlationof incident information to help forensic
type analysis.

Maintenance(MA)

Operational

Validates
Supports

Tripwire Enterprise
policy supports
the validationof key controls
in Maintenancesettings such asMA-3 which calls forcertain diagnostic
application services disabled, orsettings for remoteadministration.

Tripwire Enterprise isoften used to support the verificationof no change to key
files and systems
for the support ofmaintenance activities performed byremote access,and can be set
to inform systemowners of allchange to systems
during a maintenance phase.

Media
Protection (MP)Operational

Validates
Supports

Tripwire Enterprise
policy supports
the validation of
restrictive accesssettings and audit
controls withinmost operating
systems to support
controls such as
MP-2 Media Access.

Physical andEnvironmental(PE)

Operational

Validates
Supports

Fortra.com

Tripwire
Response*

Tripwire Log Center
performs auditof media storage
areas and audit ofattempted accessand granted
access.

Tripwire IP360 andcan support theenforcement ofcustomer defined
PE-03(6) control
policies andprocedures bymonitoring for vulnerability exposurefor penetration
testing.

Page 8Fortra White Paper

Improve Your Cybersecurity Posture: NISTNIST TRIPWIRE ENTERPRISE, TRIPWIRE IP360 & TRIPWIRE LOGCENTER CONTROLS MATRIXNIST 800-53A
Control Family

Control Type

Planning (PL)Management

Supports

Personnel
Security (PS)Operational

Validates
Supports

Risk
Assessment(RA)

Management

Fortra.com

Tripwire
Response*

Providesand/orSupports
and/orValidates

Tripwire Enterprise
Policy ComplianceManagement

Tripwire EnterpriseFile Integrity
Monitoring

Tripwire IP360
Vulnerability
Management

Tripwire Log
Center Audit Log/
Event Analysis

Tripwire Enterprise,
can support theenforcement ofcustomer defined
PL-08(1) control
policies andprocedures bymonitoring for user
account attributechanges, systemaccess, and systemchange.

Tripwire IP360
and Tripwire
Configuration
ComplianceManager cansupport theenforcement ofcustomer defined
PL-08(1) control
policies andprocedures bymonitoring for vulnerability exposure.

Tripwire Log Centercan support theenforcement ofcustomer defined
PL-08(1) control
policies andprocedures bymonitoring for user
account attributechanges, systemaccess, systemchange, and log /event data.

Tripwire Enterprise
can support PS-05
control policies
with critical systemchange and systemaccess data on
monitored hosts
Tripwire Enterprise,
Tripwire Log
Center, Tripwire
IP360 and Tripwire
Configuration
ComplianceManager (CCM)
can support theenforcement ofcustomer defined
RA-03 control
policies andprocedures bymonitoring for user
account attributechanges, systemaccess, systemchange, vulnerability exposure, andlog/event data

Tripwire Log Centercontains out of thebox tests, rules, andreporting to validate PS-05 control
policies
Tripwire IP360 candirectly provide
RA-05 controls bymonitoring for thevulnerability exposure of a system

Page 9Fortra White Paper

Improve Your Cybersecurity Posture: NISTNIST TRIPWIRE ENTERPRISE, TRIPWIRE IP360 & TRIPWIRE LOGCENTER CONTROLS MATRIXNIST 800-53A
Control Family

Control Type

System andServices
Acquisition (SA)Management

System an
Communications
Protection (SC)Technical

System andInformation
Integrity (SI)

Operational

ProgramManagement(PM)

Management

Fortra.com

Tripwire
Response*

Providesand/orSupports
and/orValidates

Tripwire Enterprise
Policy ComplianceManagement

ProvidesValidates
Supports

Tripwire Enterprise,
Tripwire Log Center,
and Tripwire
Configuration
ComplianceManager cansupport theenforcement ofcustomer definedSA-04(1, 2, 5, 8)
control policies
and procedures bymonitoring for user
account attributechanges, systemaccess, systemchange, log andevent data

Provides,Validates,
Supports

Tripwire EnterpriseFile Integrity
Monitoring

Tripwire Enterpriseprovides policy that
support verificationof security settings
that support SC
family protections.
These include SC-3
controls on security
functions of the OS,
SC-4 which protect
secure sharedresources, andSC-7 which include
hardened network and routing
methods.

Tripwire Enterprise
FIM can be used
to assist in thecontinual monitoring of security
configuration of
any applications.
Assuring that applications remain in
a secure, operational state that
protects confidentiality, integrity andavailability.

Tripwire Enterprise
policy support SI
Family controls
such as SI-9,
the support of
information input
restrictions controls.

Tripwire Enterprise
FIM supports themonitoring of SI
Family controls
through theverification of configuration files for
SPAM protection,
Error handling andother key files thatshould not change
until needed.

Tripwire IP360
Vulnerability
Management

Tripwire Log
Center Audit Log/
Event Analysis

Tripwire IP360 andcan support theenforcement ofcustomer defined
SA-09 (1), SA 11(2),SA 11 (6), SA 12(7),SA 15(2,4,5) control policies andprocedures bymonitoring vulnerability exposure

Tripwire Enterprise,
Tripwire Log Center,
and Tripwire
Configuration
ComplianceManager cansupport theenforcement ofcustomer definedSA-04(1,2, 5,8)
control policies
and procedures bymonitoring for user
account attributechanges, systemaccess, systemchange, log andevent data

Tripwire IP360
can support theenforcement ofcustomer defined
SI-02(1–3) control policies andprocedures bymonitoring forthe vulnerability
exposure

N/A

Page 10Fortra White Paper

Improve Your Cybersecurity Posture: NIST

About Fortra
Fortra is a cybersecurity company like no other. We’re creating a simpler, stronger future for ourcustomers. Our trusted experts and portfolio of integrated, scalable solutions bring balance andFortra.com

control to organizations around the world. We’re the positive changemakers and your relentless ally toprovide peace of mind through every step of your cybersecurity journey. Learn more at fortra.com.

© Fortra, LLC and its group of companies. All trademarks and registered trademarks are the property of their respective owners.

(fta-tw-wp-0123-r1-hm)