McAfee EPOLICY ORCHESTRATOR 4.0.2 - Guia do Utilizador descarregar pdf (Página 34)

Benchmark profiles and their impact on managed

systems

Audits have benchmarks assigned to them. Many benchmarks contain profiles, which are named

sets of selected groups, rules, and valued targeted toward different computer system

configurations and threat risks. A profile can:

• Enable or disable one or more groups

• Enable or disable one or more rules

• Change the variables that are used within a rule, such as the minimum password length

Profiles are normally designed to apply to a particular set of systems. For example, a benchmark

could contain two profiles, one for Windows and one for UNIX. Alternatively, a benchmark might

contain "High Security", "Medium Security", and "Low Security" profiles.

Selecting a profile should be based upon the risk of the systems being audited. Systems

containing customer credit card information pose more of a threat to an organization if the data

is compromised than does a machine used to create company newsletters.

Benchmark labels and how they can aid in creating

audits

Labels provide a method for classifying a benchmark for aid in searches. Each benchmark can

have zero or more labels attached to it. Labels can describe the programmatic usage of a

benchmark, such as applying a label of MNAC to a benchmark designed for the McAfee Network

Access System extension. Labels can also describe the functionality of a benchmark, such as

applying a label of SOX to a benchmark designed to test compliance with Sarbanes-Oxley

standard. Labels are applied with the Benchmark Editor extension or are contained in

McAfee-supplied benchmarks.

When creating or editing an audit, the benchmark selection process provides a dropdown box

showing all of the available benchmark labels. This tool allows you to filter benchmarks based

on the label that you wish to use for your audit.

Audit frequency

Frequency defines how often data should be gathered. It is defined as "Audit results should be

no older than

nnn

time unit", where "nnn" is a number and "time unit" is "days", "weeks",

"months," or "years." For example, if the frequency for an audit is defined as 1 month and a

managed system has not been audited in more than 1 month, the system is out of frequency

and its status is unknown .

Audit whiteout and blackout periods

Audit whiteout periods are times when an audit may run on a system or group of systems. Audit

blackout periods are times when an audit may not be run.

Audits are not scheduled. For example, consider a benchmark that was last evaluated at 5:14

pm on Sunday May 6th. The frequency requirement states the information should not be older

Creating and Managing Audits

Benchmark profiles and their impact on managed systems

McAfee Policy Auditor 5.0 Product Guide34

1 2 ... 29 30 31 32 33 34 35 36 37 38 39 ... 95 96

Sem comentários

McAfee EPOLICY ORCHESTRATOR 4.0.2 - Guia do Utilizador Página 34