CDM )) SOLUTION BRIEF

Visibility, Inventory
and Control
Identify and Mitigate Risk through the CDM Program

Federal Departments and Agencies (DAs) can continuously identify risk

FORESCOUT SOLVES FOR:

within federal network environments, prioritize risk based on potential impact
and mitigate the most severe risks first through the Continuous Diagnostics
and Mitigation (CDM) program. CDM provides capabilities and tools toDAs in a phased approach to meet these goals. The first of these phases
focuses on the foundational ability to know what’s on the network, otherwiseknown as asset management. Forescout currently delivers this capability fornearly all federal agencies as the preferred solution for CDM hardware asset

Real-Time Visibility. Gain automated,
real-time visibility of endpoints as they
connect to your network, including sniffer
devices that do not utilize an IP address.

Active Asset Management. Establish amanagement (HWAM).

real-time inventory of devices, hardware,

Notably, in the CDM framework, data collection, asset management andlevels, open ports, peripheral devices,

operating systems, applications, patch

risk management processes happen continually, not periodically, across theusers and more.

environment. As new data about the IT environment becomes available, thePolicy-Based Access Control. Limit

CDM system ingests endpoint and contextual data, responds by elevating

network access to authorized users andsecurity thresholds and adapting network policies and controls accessdevices with or without 802.1X.

actions in a perpetual feedback loop. This iterative process is critical when
mitigating vulnerabilities or responding to cyber incidents. In dynamic
network environments where connected endpoints, running applications andconfigurations constantly change, mitigating risk is most successful whencybersecurity tools work collaboratively with “one source of truth.” Forescout

Continuous Monitoring. Assess thesecurity and compliance posture ofendpoints in real time, both pre- and postconnection.

provides that “truth” – complete asset visibility in real- or near-real time.

Automated Remediation. Automate

Improve Risk Detection and Response
Capabilities with Forescout

by auto-updating endpoint configurations,To achieve CDM goals, organizations must invest in real-time asset

Compliance Reporting. Produce real-discovery and vulnerability management; automated, intelligence-driven
response mechanisms; and continuous feedback of data into an enterprisemanagement system. Furthermore, the system needs to be easily deployedwithin your existing IT framework and integrate with chosen tools.

www.forescout.com/solutions/compliance/

remediation of noncompliant endpoints
patches and updates, and install, activate,
or disabling applications or peripherals.

time compliance reports and shorten
Detection Interval Latency by initiatingcompliance scans as hosts connect,
rather than waiting for time-based scans.

salesdev@forescout.com

1toll free 1-866-377-8771

CDM )) SOLUTION BRIEF

Required capabilities for CDM
The Forescout platform provides real-time visibility and automated control of all networked assets.
CONTINUOUS VISIBILITY OF ALL ASSETS
Device Discovery, Profiling

INFORMATION INTEGRATION
Reporting, Bi-directional
Intelligence

ENDPOINT AUTHENTICATION &INSPECTION
Security Posture, Control
Validation

CONTINUOUS
DIAGNOSTICS AND
MITIGATIONENDPOINT REMEDIATION
User-guided, Automated,or via External System

NETWORK ENFORCEMENT
Allow, Block, Limit,Alert, Inform

VISIBILITY
Forescout’s real-time asset discovery and vulnerability management system uses a combination of passive andactive discovery and monitoring techniques to detect and profile systems on the network, independent of operating
system or form factor. Active discovery techniques probe the network to track down idle devices. Passive discovery
techniques monitor traffic to see which devices are active. Together, these methods allow full and constant visibilityof IT assets. As soon as someone installs or reconfigures a device on the network, the Forescout platform detects
the change and assesses the device. Visibility is especially important for unmanaged endpoints because existing
endpoint management systems are typically blind to this class of devices.
The Forescout platform provides complete and continuous visibility of all endpoints, and through this discovery,
it provides users with rich data about the device, users, configurations and more (see figure on next page). This
information can be used to drive and inform data-driven security policies and actions.

2

www.forescout.com/solutions/compliance/

salesdev@forescout.com

toll free 1-866-377-8771

CDM )) SOLUTION BRIEF

Continuous asset discovery and profilingThe Forescout platform yields rich data about a variety of endpoints (IT, IoT and OT) without requiring software agentsor previous device knowledge.

WHO OWNSYOUR DEVICE?

WHAT TYPE OF
DEVICE?

WHERE/HOWARE YOUCONNECTING?

• Employee• Corporate• Windows, Mac• Switch/Port/PoE• Configuration• Partner• BYOD• iOS, Android• Wireless/• Software• Contractor• Rogue• Virtual machine

Controller• Services

WHO AREYOU?

• Guest• Non-user devices,
IoT, OT

WHAT IS THE
DEVICEHYGIENE?

• VPN• Patches• IP, MAC

• Security Agent• VLANAUTOMATIONThe Forescout platform enforces and automates policy-based network and host controls through integrations withheterogeneous physical and virtual network infrastructure. Actions can be automated or administrator-initiated andgradually increased to minimize disruption while reducing the manual effort to enforce network access, improvede- vice compliance, implement network segmentation and accelerate incident response. The automated response
mech- anism can take inputs from the asset discovery and vulnerability management system. Based on thisinformation, plus an awareness of endpoint behavior, it generates a set of intelligent responses designed to reduce
enterprise risk.
The Forescout solution can direct the antivirus server to automatically update a noncompliant host and prompt thepatch management system to update the device’s operating system. It can also disable unauthorized software(See next page). Support for leading SIEM systems can provide endpoint configuration details, correlate access andcompliance violations and expedite incident response. And built-in reports help you monitor policy compliance,
support regulatory audit requirements and produce real-time inventory reports.
As federal agencies contemplate implementing Zero Trust principles, their needs are evolving beyond network
access control toward the concept of a policy decision point which considers authentication, authorization and device
posture in real time as access requests to enterprise resources are made; a CDM system can provide this information.1 The rich data that CDM provides allows agencies to control access to enterprise resources based on user profile(guest, employee, contractor), device properties, classification and security posture, thus moving DAs toward a ZeroTrust future.
3www.forescout.com/solutions/compliance/

salesdev@forescout.com

toll free 1-866-377-8771

CDM )) SOLUTION BRIEF

Customize control actions based upon the severity level
The Forescout platform includes a wide range of endpoint remediation actions based on the endpoint’s security posture.

MODERATESTRINGENT

NetworkNetwork

Move to guest network

Quarantine device (VLAN, Virtual FW)

Change wireless user role

Turn off switch port

Assign to self-remediation VLAN

Block wireless or VPN accessRestrict rogue devices/infrastructure

Use ACLs to restrict access

HostStart mandatory applications/process

AUTOMATE POLICYBASED CONTROL

HostTerminate unauthorized applications

Update antivirus/security agents

Disable NIC/dual-homed

Apply OS updates/patches

Disable peripheral device

External drive compliance

Trigger remediation actions/systems

ORCHESTRATION
Forescout enables bi-directional integrations with other common CDM tools such as antivirus, patch management
and security incident and event management (SIEM) systems to unify system-wide security management (See nextpage). Asset data and automated control actions can feed into other aspects of the CDM system to optimize theoverall system’s efficiency and effectiveness. This unique set of network, security and management interoperability
technologies extends the Forescout platform’s power to more than 70 third-party solutions, allowing the combined
system to accelerate response, achieve major operational efficiencies and provide superior security. For example,
the Forescout Extended Module for Splunk® enables Forescout and Splunk to share information and enable theForescout platform to take action if a security control is degraded or no longer in place (e.g., if a device is missing asecurity software patch, has a newly reported flaw or is suspected of contributing to a malware outbreak).
Further, Forescout helps IT managers achieve acceptable Detection Interval Latency (DIL) metrics by integrating withcompliance scanners to add event-based scanning functionality. Through this integration, the Forescout platform
triggers the compliance scanner when a host connects to the network. The addition of event-based scanning will
significantly improve your DIL metric. Integrations exist with leading vulnerability assessment (VA) scanners such asTenable® Nessus, BeyondTrust® Retina and Qualys®, with more under development.

4

www.forescout.com/solutions/compliance/

salesdev@forescout.com

toll free 1-866-377-8771

CDM )) SOLUTION BRIEF

Plug-and-play integrations orchestrate response
The Forescout platform integrates with a wide range of technology partners. According to policy, it shares real-time
visibility and compliance data with third-party solutions and can enforce network access or segmentation controls.

SRE

P

SE
ON

AS

KNOW & MANAGE YOUR ASSETS
SE

T

M

A

G

EN

PL

SE

M

ENFORCE COMPLIANCE

IAKNC

ORE

NETW

REDUCE BLAST RADIUS

ENT

INC

EMID

AGEN

N

T

AUTOMATE THREAT RESPONSETATIONDEVICECOM

EASE OF DEPLOYMENTThe Forescout platform is available as either a virtual or physical appliance that deploys seamlessly within yourexisting network, without typically requiring infrastructure changes. The Forescout appliance installs out-of-band,
avoiding latency or potential for network failure, and can be centrally admin- istered to dynamically manage tens or
hundreds of thousands of endpoints from one console.

CDM Capabilities and Program Criteria2
CONTINUOUS DIAGNOSTICS &MITIGATION CRITERIA

Asset
Discovery &Classification

Discover unauthorized or unmanaged
hardware on a network, discover
unauthorized or unmanaged software
configuration in IT assets on a network.

FORESCOUT

Forescout discovers network devices in real time andmaintains a comprehensive database of hardware andsoftware assets. You can search and organize the inventory
by various hardware and software attributes and generateinventory reports.

5

www.forescout.com/solutions/compliance/

salesdev@forescout.com

toll free 1-866-377-8771

CDM )) SOLUTION BRIEF

Assessment

Assess the security posture of endpoints
resulting in an accurate and timely
software inventory. This is essential tosupport awareness and effective controlof software vulnerabilities and security
configuration settings.

The Forescout platform assesses the security postureof IT, IoT and OT endpoints in your environment. This isespecially important for unmanaged devices because
existing management systems are typically blind to thesedevices. It performs a wide range of compliance checks,
including monitoring for required software, software/patch
versions, device configuration and endpoint vulnerabilities.
It integrates with other host-based agents/tools and VA
scanners to obtain additional compliance info.

Authentication& AccessControl

Prevent, remove and limit unauthorizednetwork connections/access to prevent
attackers from exploiting internal andexternal network boundaries and thenpivoting to gain deeper network accessand/or capture network resident data
in motion or at rest. Manage accountaccess, security-related behavior,credentials and authentication.

The Forescout platform can block or restrict access tounauthorized devices as well as devices that become
noncompliant while connected to the network. It is eventdriven and reassesses an endpoint when a configurationchanges in its operating system.

Automated
Mitigation &Remediation

Prevent exploitation of the system by
consciously designing it to minimize
weaknesses and building the system tomeet that standard to reduce the attack
surface and increase the effort required toreach the parts of the system that remain
vulnerable.

Upon detecting compliance violations, the Forescout
platform can respond based on the severity of theviolation by simply alerting or notifying the IT staff orauto-remediating, quarantining or blocking noncompliant
endpoints. It can also interface with a third-party systemsuch as patch management.

Situational
Awareness

An accurate and timely endpoint status
is essential to support awareness,
effective control and reporting of any
organizational security issues in thenetwork.

The Forescout platform provides comprehensive situationalawareness by identifying endpoints on the network andintegrating with other security management systems
such as endpoint lifecycle management products, asset
management systems, databases, SIEM, VA and antivirus
products, resulting in real-time endpoint intelligence andsecurity posture awareness. It supports SIEM systems toprovide endpoint configuration details, correlate access anddetect compliance violations.

1] Scott Rose et al., NIST Special Publication 800-207: Zero Trust Architecture,
page 7, 10, 34-35, August 2020.

Don’t just see it.
Secure it.

2] U.S. Department of Homeland Security (DHS), Continuous Diagnostics and Mitigation (CDM)
Resources, Last accessed January 2021.

TMContact us today to actively
defend your Enterprise of Things.

www.forescout.com/solutions/compliance/Forescout Technologies, Inc.
190 W Tasman Dr.
San Jose, CA 95134 USA
Toll-Free (US) 1-866-377-8771
Tel (Intl) +1-408-213-3191Support +1-708-237-6591

salesdev@forescout.com

toll free 1-866-377-8771

Learn more at Forescout.com© 2021 ForeScout Technologies, Inc. All rights reserved. Forescout Technologies, Inc. is a Delawarecorporation. A list of our trademarks and patents is available at https://www.forescout.com/
company/legal/intellectual-property-patents-trademarks. Other brands, products, or service names
may be trademarks or service marks of their respective owners. Version 02_21

6