Advanced Architectures with the Retina Protection Agent

One of the extended features of Retina CS is the Retina Protection Agent. This component is licensed with Retina and allows for users to assess hosts for vulnerabilities using a local scanning agent verses a network scan. This forgoes the need of a traditional SaaS or on-premise vulnerability assessment solution to perform a scan outside of the corporate campus. This requirement is very common among clients that need a PCI DSS Report or a traditional vulnerability assessment report for mobile Windows devices. A traditional authenticated network scan does not work because the local firewall would need to be disabled, remote file and print sharing exposed to the Internet, and the device powered on at a fixed IP address at the same time of the scan. All of these can lead to a complete disaster since the device defensive's are essentially turned off. There is really no way around this type of assessment even if you host an appliance in-house and try to scan backwards across a VPN connection. The results just do not come out well and a getting a reliable report from all device in scope becomes problematic. BeyondTrust has a solution for this problem. The architecture below is for the Retina Protection Agent and Retina CS using a hardened UVM50 appliance:

Windows XP, 7, Vista, or 8 laptops are loaded with the Retina Protection Agent (which co-exists with your existing security solutions including anti-virus) and performs a local vulnerability assessment on a scheduled basis. The scan is non intrusive and does not impact the performance of the system. The results are encrypted and sent to the appliances within the corporate DMZ. From there, users can view complete details regarding the asset and generate reports for regulatory compliance and asset inventory. If the device is offline, the results are held and forwarded in a throttled fashion when a connection can be established. Audit updates can be sent directly from BeyondTrust or from the same appliance in order to make sure your critical reports are up to date. BeyondTrust has solved the problem of remote vulnerability assessment using agent technology. These agents can be used on desktops or servers; anywhere a scan of a Windows device would fail using a network vulnerability assessment technology. This overcomes STIG hardening, firewalls, disabled accounts, and even remote systems for complete vulnerability management. Our zero gap coverage for vulnerability assessment includes network scanners, agents, cloud resources, and even mobile devices. We can help provide the information you need to maintain regulatory compliance with your assets and users. Learn more!