NetIQ SCM 5.7
August 01, 2008
- Ease of Use:
- Value for Money:
- Overall Rating:
- Strengths: Solid feature set, risk-based scoring mechanisms to help prioritise remediation efforts
- Weaknesses: May get pricey
- Verdict: A good risk-based approach for managing known weaknesses in configurations, patches and other host-level vulnerabilities. Our Best Buy
The Secure Configuration Manager (SCM) is a combination of client server and web-based elements to help organisations manage workstation and server configurations. Its main component is a central administrative console that controls policy dissemination through software agents deployed to hosts running Windows, Unix, Linux and iSeries operating systems. Configuration management is also offered for Oracle, MS SQL, Sybase and other application systems.
The SCM server components are typically installed on Windows 2000 or 2003 and use a MS SQL 2005 database. Agents for individual hosts managed through SCM can be deployed by the console and can also be part of the reporting and monitoring process without an agent installed, they simply won't have policies pushed to them.
Unlike solutions that strictly push configuration files to network devices, there is a bit more overhead associated with managing agents installed on Windows, Unix and other operating systems. Overall, the performance was good, however. SCM works by comparing known vulnerabilities and threats with the configuration of the managed assets in the environment. Baselines are checked against a series of regulation requirements, best practice templates or your own policies. We liked SCM's solid number of features and that it is based on risk out of the box.
NetIQ's offering goes beyond a simple gap analysis of your assets and whether they comply with predetermined policies. The value is enhanced by the ability to weigh the importance of the asset within your environment. Reports are then generated with risk scores based on that criticality in order to aid remediation efforts and prioritisation of tasks when your assets appear non-compliant.
The documentation is adequate, but we would have liked to see a few more screenshots.
Pricing for SCM starts at £559 per server that reports through SCM and includes basic support. Overall we find that this is pretty good value for organisations that really struggle with compliance and configuration management across multiple platforms.
SC Webcasts UK
Information Security Manager
Infosec People - Hammersmith, West London
Interim CISO (Chief Information Security Officer) - Cyber Security Director
CYBER EXECS - London (Central), London (Greater)
Junior Penetration Tester, Hertfordshire, to £35k + benefits
Infosec People - England, Hertfordshire
Cyber Security Architect
CYBER EXECS - London (Greater)
SOC Analyst, Aldershot, £47-56k + package
Infosec People - Hampshire, England, Aldershot
Sign up to our newsletters
SC Magazine UK Articles
- Tesco Bank allegedly ignored warnings of hack from Visa
- Investigatory Powers and Digital Economy Bills could threaten economy
- Updated: A million German routers knocked offline by failed Mirai botnet attack
- Gooligan ad fraud malware infects 1.3M Android users, installs over 2M unwanted apps
- Microsoft update left Azure Linux virtual machines open to hacking
- SC Awards Europe 2016 winners announcements!
- ISIS radicalises 'lone wolves' through strong social media presence
- Updated: How will Brexit affect the cyber-security industry in UK and Europe?
- 9.2 million medical records for sale on darkweb
- Microsoft Office 365 hit with massive Cerber ransomware attack, report
- Researchers hack Visa cards in six seconds
- The information security implications of M&A deals
- Cyber-security must reflect risk not just regulation
- ICYMI: Tesco warned; IP Bill threatens economy; German routers offline; Azure trojan; Gooligan fraud
- Data centres are on the move - where will they end up?