By Editor
Cyber threats from cyber criminals are well known and largely defended against; not so for threats from inside the organization itself. ManageEngine works to protect organizations from this side of the firewall
Organizations spend inordinate amounts of money safeguarding their perimeter from without while doing little to secure the network from within.
Security threats from inside the organizations themselves can have as disastrous effects as hacking from cyber criminals. This is especially true for banks and other financial institutions. That is where strong IT management policy and internal controls come in, with ManageEngine providing the tools to help protect these IT resources.
Among others, ManageEngine IT security solutions complement network management and IT operations. One such product from ManageEngine is the Privileged Password Management solution ‘Password Manager Pro’. Servers, databases, network devices and web applications of modern enterprises are all accessed and controlled by administrative passwords. Unfortunately, according to Bala Venkatramani, Marketing Manager, IT Security Solutions at ManageEngine, a lot of companies put administrative passwords in plain view-in texts; excel sheets, even on printouts. And then these passwords are all shared with all the members of the team. “This is where our product comes in,” explained Bala. “We provide a product to securely store the passwords in a centralized repository and share the passwords with members of the team on a need basis. We make sure all these members do not have free access to everything. Access is based on their jobs and responsibilities and then everything is properly audited, for instance who accessed what, and where.”
Even then, networks have to be monitored on a regular basis to make sure that security controls and best practices put in place are scrupulously followed. ManageEngine EventLog Analyzer is an agent-less log analytics and compliance reporting software solution. Organizations can centrally collect, archive, analyse and generate reports based on machine-generated logs obtained from heterogeneous systems, network devices and applications. The latest version of EventLog Analyzer (v8.5) offers file integrity monitoring, which lets organizations monitor their critical folders and files in real time to prevent sensitive data from being compromised and to fulfil regulatory compliance requirements.
“We have network monitoring applications as well as solutions to scan the network and proactively report on network vulnerabilities. ‘Security Manager Plus’ protects the network from security threats and malicious attacks through vulnerability scanning, open ports detection, patch management, Windows file/folder/registry change management,” said Bala.
Cross product integration is something customers want and ManageEngine is focusing on, according to Bala. All ManageEngine products have been architected on the same Java platform and are using common communication mechanism and data storing techniques, which make cross product integration simple. Customers can buy any product individually from the company’s broad product portfolio. “We offer an integrated IT Management solution ‘IT360’, an end-to-end monitoring solution that provides a single dashboard view of IT,” said Bala.
ManageEngine has also embraced mobility with a range of mobile apps for many of the solutions for instance to monitor what is going on in the network. Customers can get alerts on the smartphones and even take remedial actions through the same platform. “This year we are focused on mobile applications and making even more of them available,” said Bala.
Social media is proving the most convenient vehicle for hackers nowadays. 12% of the world’s population is said to be on social media, according to reports. Through social media networks, attackers want to siphon off login information of an employee through which they can get access to the entire organization’s network and steal date from these organizations. “The main problem is that a lot of people use the same password they use for social media, for banking access as well as internal IT resources,” explained Bala. “Through a simple phishing expedition, the attackers are able to get the administrative password using which they can gain access into the entire network.” Recent cases of this type of cybercrime include LinkedIn where hackers gained access into the LinkedIn database and stole millions of passwords of members as well as other private information.
ManageEngine Password Manager comes in handy in such circumstances. The reason why people use the same password is that they cannot remember all these passwords. So they need a secure mechanism. Ideally, people should use unique passwords in all their applications and all the IT resources. However, this is not practical at all without the right tool. “We provide the software to store passwords securely in a central repository without the need to remember all the passwords. IT managers can then follow all the IT best practices like periodically changing the password, assigning unique passwords to all the IT resources so that organizations can follow best practices,” said Bala.
And Password Management is not just about strong passwords, Bala said. A lot of security breaches happen at the password management level. “So, automating the entire life cycle of privileged password management is imperative, which enforces password management best practices company-wide. We have now released a separate version of Password Management for managed service providers, an industry-first. This is meant to strengthen our security product portfolio.”
For IT management to work in the modern office, the ability to react in real time is crucial. “We refer to ourselves as a real-time IT company. The reports that our solutions provide focus on real-time alerts to the IT administrator so they can take remedial actions immediately,” said Bala. The EventLog Analyzer for instance is constantly monitoring user activities on the network. It will notice failed log-in attempts and immediately alerts the IT administrator that someone is trying to access some resource. The IT manager can then immediately block that user from accessing the data. Another product ‘Firewall Analyzer’ provides instant alerts on possible network attacks and security breaches in the network.
The DeviceExpert on the other hand keeps monitoring for changes happening to the configurations of organization’s network devices, where even a minor or unintentional errors can result in a lot of vulnerabilities to the network. “DeviceExpert checks for changes in the network devices and alerts administrators immediately on any unauthorised changes so that they can immediately roll back those changes,” said Bala.
The real value of ManageEngine lies in providing highly affordable solutions, according to Bala. “We have a convenient pricing mechanism for instance through an annual subscription. Such options make our products very attractive for SMEs. We also have a distributed edition in most of our products that appeal to big enterprises as well-thus we are able to strike a balance between SMBs and the enterprise.”
Prominent in ManageEngine’s marketing strategy is a proposition dubbed “90:10” 90:10, Bala explained, is the company’s promise to offer 90% of all features you can find in other competitors’ products for just 10% of the price. “We compare with other big vendors feature-by-feature while making sure that our prices remain affordable,” Bala said.