Tripwire Configuration Auditing & Control

Many IT organizations are adopting change and configuration management (C/CM) tools to help them improve audit preparedness, reduce risk, and improve their abilities to manage change. These tools are terrific preventive and corrective measures. They help automate processes, simplify software deployment, and reduce the time it takes to administer system configurations.

However, these tools and processes can be circumvented without anyone knowing. To assure that preventive and corrective measures against unauthorized changes are in place and effective, you need detective controls. These controls continually monitor systems to discover unauthorized changes or process failures, and alert the appropriate IT staff. This is change auditing.

Auditors increasingly want to see independent change detection and verification – capabilities that demand more than basic change and configuration management technologies can deliver. As an important component of compliance and security efforts, change auditing occurs independently of the individuals approving and making changes, closing any gaps in your change management processes. Configuration audit and control can reconcile detected changes against tested, authorized changes, providing alerts when change is unauthorized. And it can objectively report all change activity, enabling IT to prove the effectiveness of their controls. With configuration audit and control capabilities in place, security and compliance processes can be enforced and any attempts to circumvent them will be identified.

Tripwire Configuration Audit and Control Capabilities

Tripwire solutions deliver all three critical configuration audit and control capabilities:

• Detect: They provide independent change detection across network servers, desktops, routers, switches, firewalls, and load balancers. Tripwire's independence segregates the detection from the people and technologies that initiate change, capturing all automated, manual, authorized, unintentional and malicious changes.
• Reconcile: They reconcile detected changes with change approval and release management processes. By accessing information contained in leading change management tools, Tripwire solutions enable rapid reconciliation to quickly determine which changes were authorized and which weren't.
• Report: They provide independent reporting of actual changes across the breadth of the infrastructure and reconcile them with authorized and intended changes. Tripwire reports provide independent, verifiable audit logs of all actual change activity to accelerate troubleshooting, inform corrective actions, document compliance, and enforce change management policies and accountability.

Automation Improves IT Productivity

Of course, configuration audit and control can be performed manually. However, for most organizations, the monitored infrastructure is too large and change activity too frequent to effectively monitor changes manually. As a single point of control for detecting change across the enterprise, Tripwire enables IT organizations to automate change detection, reconciliation and reporting, freeing them to focus on high-priority changes and receive the detailed reporting data they need for assessing performance and proving compliance.