SCANNING THE HARD TO REACH PLACESTripwire PureCloud Enterprise & Tripwire PureCloud for PCI

July 30th, 2015

2

Challenges

“I need to assess exposure to external attacks.”

“Our organization has multiple locations across the globe, and needs a way to scan our entire network.”

“Our organization is about to acquire a company and I need to gauge the state of security in that environment.”

“Our organization shares sensitive information with partners. I need to assess the level of risk in these environments.”

3

Tripwire PureCloud

Extends the reach of Tripwire IP360 and Tripwire Security Intelligence Hub (SIH) to identify and manage risk to your organization, wherever your systems and data reside.

Covers specific scenarios for large enterprises: Perimeter Vulnerability Scanning Internal Vulnerability Management Public Cloud integration Web Application scanning PCI ASV scanning

4

Scalable & Flexible Deployment

Cloud-based ScanningHardware Appliances Virtual Appliances

5

Traditional Scanning Requires On-Premise Scanners

Dedicated physical/virtual appliance deployed on remote 3rd party network

Traditional Remote Network Scanning

Remote/3rd Party Network

6

PureCloud Scanning Service Model

- Uses Secure Connector (Windows service) for internal scans- No dedicated appliance required- Scans devices on the same subnet

7

PureCloud Enterprise Scenarios

Network perimeter scanning

Small branch office scanning

Mergers & acquisitions due diligence

Third-Party assurance

8

Network Perimeter Scanning

Solves the problem:

With Tripwire IP360, I can scan my internal networks but I need to also assess exposure to external attacks.

Scans internet-facing systems Detects vulnerabilities visible to outside attackers Assesses attack surface External audit prep (e.g. PCI) More thorough assessment than PCI

9

Branch Office Scanning

Solves the problem:

Our organization has multiple locations across the globe, and needs a way to scan our entire network. It is not cost effective to deploy and manage hardware in each location.

Scan smaller remote locations where security appliances are impractical Great for retail locations requiring internal scans for PCI Situations where site-to-site VPN unavailable Straightforward setup for non-technical skillset Manage scans remotely

10

Mergers and Acquisitions Due Diligence

Solves the problem:

Our organization is about to acquire a company.

I need to gauge the state of security in that environment.

Vulnerabilities are a indicator of the state of IT Harbinger of technical effort & cost to onboard PureCloud has a low installation profile Inexpensive & simple to provision Review results in PureCloud or Security Intelligence Hub (SIH)

11

Third-Party Assurance

Solves the problem:

Our organization shares sensitive information with partners. I need to assess the level of risk in these environments.

Economic drivers for sharing data & IP externally Manage risk of outsources & other 3rd party providers Assess & continuously monitor state of environment Comprehensive view of risk in Tripwire Security Intelligence Hub (SIH)

12

PureCloud results in Tripwire Security Intelligence Hub

13

PureCloud for PCITripwire is a PCI SSC Approved Scanning Vendor (ASV)

PCI Scanning allows you to assess your network for Payment Card Industry (PCI) Data Security Standards.

PCI Scans are initiated and managed using the PCI Scanning Dashboard in PureCloud, and they comprise two parts:

1. Asset Discovery Audit

2. Vulnerability Assessment.

14

Demo

15

Register for the next webinar

Mastering Advanced Security Profiling Language (ASPL)

Wednesday, August 5, 2015 - 11:00 AM - 12:00PM Pacific

Take a deep dive into Tripwire’s ASPL, or Advanced Security Profiling Language, and how to extend Tripwire IP360 discovery and profiling to your custom applications and/or policy monitoring. Attendees will learn how to: Create and delete custom ASPL vulnerability conditions Search for specific vulnerabilities within your environment Analyze conditions according to specific parameters Bind ASPL rules to applications and operating systems

Register: http://tripwire.me/1HkZYbU

16

Q&A

Questions? Submit them via the chat window

tripwire.com | @TripwireInc

THANK YOU