Identifying Risks

Risk and Warnings are generated using Policies and Requirements located in the Policy Manager.  NP policies and requirements are automatically assigned to all devices when they are imported and run when network device configuration changes are identified.

The following default policies are provided for all Compliance modules:

• NP-Parser Policy – triggers from device configuration files
• NP Path Policy – triggers from the results of the path analysis
• NP Rule Policy – triggers from access rules

CiS Benchmarks are provides as part of the Best Practices Module

• CiS Benchmark for Check Point
• CiS Benchmark for Cisco
• CiS Benchmark for Palo Alto

Policy Management

Each policy is broken down into a set of requirements that are used to identify potential network risks.

By clicking on a specific Policy and Requirement, the details and Regex logic for the requirement is displayed.

Policies and Requirements are global in nature and changes made when within one workspace apply to all workspaces.  For example, if a Policy, Requirement or Device is deactivated in one workspace, that update applies to all workspaces. Default policies and requirements can be “Enabled or Disabled” by clicking the blue bubble and “Run” by clicking the “Run” button. Default policies and requirements cannot be edited or deleted.

CiS Benchmark

In addition to the NP-Policies, portions of the CiS Benchmark has been provided for several manufacturers.  CiS Benchmarks provide a power set of secondary policies to help identify risk within your network.  CiS Benchmarks are disabled by default and must manually be enabled and assigned to devices. As noted above, changes to Policies, Requirements or Devices apply to all workspaces. CiS Benchmark Policies and Requirements can be deactivated but not edited or deleted.

Risk Assessment Grading

At any given time, a monitored device can have one or more open risks or warnings. This information is used by our Grading algorithm to provide each device with a letter grade. The quantity, criticality and type of open risks and warnings go into the calculation.

This grade informs the users which devices have the highest security or compliance risks. The lower the letter grade, the higher the risk.

The grade for each monitored device can be seen by clicking on a device on the topology map and reviewing the Risk Assessment Grading on the device menu. Clicking on the menu item displays the details that went into the grade.

An depiction of the data flow is as follows: