|
NIST / FIPS Solutions
The Standard
Government agencies supporting information systems will soon be required to meet the standards published in the Minimum Security Requirements for Federal Information and Information Systems document, also referred to as FIPS 200. These standards, currently published as recommendations by the National Institute of Standards and Technology in special publication 800-53, detail the specific implementation requirements to heighten security within government information systems.
NIST/FIPS controls are all part of a security effort in implementing the standards found in the Federal Information Security Management Act (FISMA). ScriptLogic also provides solutions to assist in FISMA compliance.
The Challenge
NIST 800-53 breaks its security controls into three classes: Management, Operational and Technical. These three classes essentially translate into the same basic security lifecycle controls as other compliance standards, where security implementation is broken into Planning, Implementation and Assessment phases. Establishing a security process that encompasses all three parts in a Windows-based network requires the use of third-party solutions.
The Solution
ScriptLogic solutions can assist in implementing the processes in all three of the NIST classes to bring every aspect of an organization’s Windows network into compliance in the areas of Active Directory, server and desktop security. ScriptLogic solutions specifically aid in the implementation of the following NIST objectives:
Risk Assessment – Search for security vulnerabilities in Active Directory (AD) with Active Administrator; on servers with Enterprise Security Reporter.
Planning – Define security requirements with proper documentation about your Windows network with Enterprise Security Reporter, Active Administrator, and Patch Authority Ultimate.
Certification, Accreditation & Security – Use reporting to conduct security assessments on the controls put in place in AD with Active Administrator and on servers using Enterprise Security Reporter.
Contingency Planning – Use Active Administrator to restore AD objects, AD security and Group Policies and Security Explorer to restore NTFS permissions to known-good states after a failure.
Configuration Management – Restrict user functionality on client machines with Desktop Authority and on servers with Security Explorer.
Maintenance – Perform remote maintenance on client machines using Desktop Authority’s Remote Management client.
System and Information Integrity – Protect the client machines against malicious code such as viruses and Spyware using Desktop Authority’s Patch Deployment for Desktops and Spyware Detection & Removal options, as well on both servers and client machines with Patch Authority Ultimate.
Access Control – Enforce AD security with Active Administrator’s Active Templates. Control client sessions and session lock-outs with Desktop Authority.
Audit & Accountability – Audit Active Directory management with Active Administrator's auditing and reporting features.
|
Compliance Center
