SOLUTION BRIEF

Agent-BasedVulnerability Management
When and How to Use Vulnerability Management Agents

Tripwire IP360
Quick Facts

When should your security strategy include agent-based monitoring? It»» The complete ABVM
solution for organizations
and agencies

agent-based monitoring offers superior support and protection across»» Uses the standard
Tripwire IP-based
licensing structure

based and agentless vulnerability management solutions both separately»» No additional hardware
required»» Using agents incurs noadditional charge»» Provides granular risk
prioritization reporting»» For use in on-premises,
cloud and hybrid
environments»» Overall footprint <100 MB»» Consumes <2% of CPU
resources

can be difficult to discern when and how to incorporate agents into yourvulnerability management processes. There are several instances in whichyour networks. But that doesn’t mean you need to opt for a 100 percent
agent-based approach, either. There are several benefits to using agentand jointly.
Traditionally, Tripwire’s vulnerability
management solution functioned ina fully agentless capacity covering hybrid environments, including
on-premise, cloud and container-based
environments. That is until now. With
the release of Tripwire® IP360™ 9.0,
Tripwire’s world-class solution adds its
time-tested agent technology to further
expand its functionality. Tripwire IP360
9.0 provides agent-based vulnerability
management (ABVM) for organizations
and agencies with the most granular risk prioritization visibility on themarket—while still leveraging the benefits of agentless scans.

Agent-Based vs. AgentlessIf you’re only using agentless scanningfor vulnerability management, you might
not be getting a complete picture of thevulnerabilities on your network. Agents
provide deeper visibility and systemefficiency than agentless scanning inseveral critical areas, such as network
load, scanning without credentials,
assets using dynamic IPs, and of course,
cloud images that have short lives.
Using agents deepens the scope of yourvulnerability management assessments.
But that doesn’t mean you should do

FOUNDATIONAL CONTROLS FORSECURITY, COMPLIANCE & IT OPERATIONS

away with agentless vulnerability scans.
There are certain situations in which
agentless scans can discover vulnerabilities that agent-based scans cannot.

3. Integrated Event Assessment

Agent-based vulnerability management
provides additional functionality to solve
hurdles associated with agentless scanning. Let’s take a look at six VM hurdles
you can overcome by implementing
agents your organization or agency.

Determining how often to assess thevulnerability state of your assets is nota simple task. You need to balance therisk of missing new vulnerabilities that
may be introduced, with the requirement
to avoid unnecessary network load that
may impact the performance of yoursystems. The Tripwire IP360 agent canhelp you be more focused in your vulnerability assessment efforts by taking
an integrated and event-driven approach
to VM. For example, you can combine theconfiguration management capabilities
of Tripwire® Enterprise with the Tripwire
IP360 agent to automatically initiate avulnerability scan when an actionableconfiguration or file system change
is detected on an asset. This ensures
you assess the vulnerability impact ofsystem changes immediately when theyoccur and reduces the requirement forfrequent scans of your networks.

1. Access Credentials

4. Increased Efficiency

For example, agentless scans canlocate what’s not stored on your devices
themselves, such as SSL certificates.
Powerful vulnerability management(VM) means mixing and matching youragent-based and agentless strategies—
it should never be a matter of choosing
one over the other. You’ll achieve yourrichest assessment with a combinationof both agentless and agent-based VM.

Six Practical ABVM Use Cases

Running a comprehensive and accurate
agentless vulnerability scan is impossible without credentialed access to every
host. Keeping the required credential
information up to date and secure canbe a daunting and expensive task, andagentless credentialed scans can bottleneck around credentials if the scan
encounters devices it can’t access.
Agents bypass this issue altogether by
already being present on the device, andtherefore not requiring credentials.

2. Built-in Cloud Asset Security
Scanning for vulnerabilities in yourcloud environments can be a challenge.
Remote scanning isn’t always an option
for images in Amazon Web Services(AWS), for instance. When you’re using
ABVM with your AWS, Azure or Google
Cloud images, you can build the agent
directly into your images—giving you
greater peace of mind knowing yourcloud assets remain secure. You caneven have the agent immediately scan a
new virtual asset when it is started, tobe certain your cloud deployments arealways safe and secure.

Installing agents on your endpoints
reduces overall network traffic sinceno network-based scanning is required
to discover and assess the state of theassets on your network. Should you
choose to combining agentless andagent-based processing for the mostcomplete vulnerability assessment of
your endpoints, the collection of therequired data is significantly more efficient since much of the information has
already been collected and reported by
the agent.

5. Dynamic IP Endpoints
Asset reconciliation can be a challenge
for organizations using dynamic IP
for their endpoints, making it difficult
to obtain an accurate asset inventory
and to track the vulnerability state of agiven asset over time. Agents provide
endpoints with universally-unique IDs(UUIDs) that can always be used to identify an asset, providing more accurate
asset inventories and allowing you to
consistently track vulnerability scoring
trends over time.

6. Occasionally-connected Devices

Not all devices are always connected tothe network. Laptops may be offline forextended periods, and agentless scans
can miss these devices if they are notconnected to the network at the time ofthe scan. This leads to an incomplete
asset inventory and vulnerability
assessment—which can pose serious
security risks. But with an agent,vulnerability assessment will take placeas scheduled whether the device isconnected to the network or not. Then,
when the device is connected to any
network serviced by Tripwire IP360, it
will report the results of thatassessment for review and action,
keeping your assets secure—any time,anywhere.

Tripwire IP360
VM for Complex Environments
Whether your organization or agency
uses on-premises, cloud or hybridsystems, Tripwire IP360 provides
comprehensive asset discovery andinventory. Take advantage of the most
granular risk scoring and prioritization
reporting on the market in order toaddress vulnerabilities quickly and thoroughly. It also allows you to combine thefindings of agentless and agent-basedscans to paint the most complete pictureof your environments.

Tripwire Axon-based technology
Tripwire IP360 uses lightweight Tripwire
Axon® agents. Tripwire Axon is a unified,modular platform that provides deep
insight and flexibility to the Tripwire
portfolio. Its resilient and secure design
supports offline and connected data
while maintaining a small footprint.
Tripwire Axon provides the technologicalfoundation for ABVM. The agent is acompact, native component that works
with a variety of enterprise operatingsystems. It executes rules delivered
through regular Tripwire IP360 content
updates to identify and score vulnerabilities on the asset, and to inventory theapplications and system characteristicsof the host.

This information is conveyed across asecure and resilient messaging fabricto Axon Access Points (AAPs) deployedwith each Tripwire IP360 Device Profiler.
The AAPs receive and forward this data
to the Axon Access Point Gateway on theIP360 VnE, where the data collected by
the agents is aggregated and stored to aVnE database.
The agent-collected data is then further
assessed using Advanced Security
Profiling Language (ASPL) rules developed by the Tripwire Vulnerability andExposure Research Team (VERT). VERTcontinuously identifies emerging vulnerabilities, creating unique detection
signatures that are regularly updated
to deliver unprecedented vulnerability
discovery coverage.

results obtained by network scanning,with the exception that the information
is flagged in these reports to indicatethat it was derived from agent-collecteddata.

The output of this process is a set of
identified vulnerabilities for the asset,
each scored using both Tripwire’s
proprietary scoring system and theCommon Vulnerability Scoring System(CVSS). These scores, along with thedetailed scan results, are represented
in vulnerability audits and other reports
in the same manner as vulnerability

Summary
Robust vulnerability management
security strategies implement both
agent-based and agentless VM, as bothmethods offer different advantages.
Organizations and agencies use Tripwire
IP360 to build a customized scanningand vulnerability management processthat foster better efficiency and tighter
security.

Fig. 1 Reap the benefits of both agentless and agent-based scanning. Agentlessscans are augmented with previously collected agent data to improve the efficiency
and speed of the scan. Each vulnerability is flagged to indicate if the data wasgenerated from the agent or by remote access to the host.

Ready for a Demo?

Fig. 2 The Axon Agents widget provides the status of the agent, the date and time itlast checked in and last scanned, and the most recent vulnerability score. For any
selected agent, you can drill down into the most recent scan report for the asset.
You can also initiate an immediate agent scan.

Let us take you througha demo of Tripwire IP360
and answer any questions
you have. Understandhow Tripwire’s suite ofsecurity and vulnerability
management products andservices can be customized
to your specific IT security
and compliance needs.
Visit tripwire.com/contact/
request-demo/Tripwire is a leading provider of security, compliance and IT operations solutions for enterprises, industrialorganizations, service providers and government agencies. Tripwire solutions are based on high-fidelity
asset visibility and deep endpoint intelligence combined with business context; together these solutions
integrate and automate security and IT operations. Tripwire’s portfolio of enterprise-class solutions
includes configuration and policy management, file integrity monitoring, vulnerability management,
log management, and reporting and analytics. Learn more at tripwire.com
The State of Security: Security News, Trends and Insights at tripwire.com/blog
Follow us on Twitter @TripwireInc » Watch us at youtube.com/TripwireInc©2018 Tripwire, Inc. Tripwire, Log Center/LogCenter, IP360 and Tripwire Axon are trademarks or registered trademarks of Tripwire, Inc.
All other product and company names are property of their respective owners. All rights reserved.

SBABVM1a1806