Avecto Ltd, the leader in Windows privilege management,
announced its support for Microsoft Event Forwarding to provide
centralized auditing of Windows desktops for least
privilege compliance. By leveraging Windows Remote Management
(WinRM) protocol Avecto Privilege Guard can now document
compliance-relevant events at desktops across the enterprise and
generate detailed reports to demonstrate compliance with industry
regulations.
"A growing number of organizations are looking to adopt a least
privilege approach, as it provides a number of benefits, including
increased desktop security and reduced operational costs," said
Mark Austin, CTO at Avecto. "The requirement to remove
administrative rights from users is frequently driven by external
or internal compliance initiatives, and in these situations the
auditing of privileged operations is very important. With the
addition of new WinRM support, Avecto is dramatically simplifying
desktop compliance for enterprises across industries."
A number of compliance regulations demand the implementation of
least privilege, including Federal Desktop Core Configuration
(FDCC), Government Connect and Payment Card Industry Data Security
Standard (PCI DSS). Least privilege is also recommended by other
regulations, such as Sarbanes Oxley (SOX) and Health Insurance
Portability and Accountability Act (HIPAA).
The Avecto Privilege Guard solution enables companies to adopt
the principle of
least privilege, by removing admin rights from users
and assigning privileges directly to applications, based on policy
settings, which are centrally managed through Active Directory
Group Policy. All privileged applications are audited to the
Windows event log, providing detailed information on the
application and the policy where it was defined. By leveraging
Microsoft WinRM, important events may be forwarded to a centralized
server, allowing compliance reports to be generated. For more
advanced reporting the forwarded events may be further consolidated
with Microsoft System Center Operations Manager (SCOM) or a SQL
Server database.
WinRM is Microsoft's implementation of WS-Management Protocol, a
SOAP based, firewall-friendly protocol, which provides a common way
for systems to access and exchange management information across an
IT infrastructure. WinRM is a standard component of Windows 7, as
it was introduced in Windows Vista, and it may also be installed on
Windows XP desktops.
A free solution guide is available from Avecto on setting up and
configuring WinRM for event forwarding at /resources.
