Our primary tool is called Enterprise Sentinel and has two components, a service level scorecard and a technology dashboard. Enterprise Sentinel is a system that performs the following functions:

• Identifies vulnerabilities and bugs for IT products from over 2100 vendors.
• Maintains a list of IT assets with associated vulnerabilities.
• Maintains a list of business rules for all assets.
• Provides a business focused risk scorecard, identifying areas of risk and severity levels to the business. The scorecard supports views by business function, by office and by application.
• Provides a technology dashboard to identify specific software and hardware that are vulnerable. The dashboard supports views by IT function, by device and by vulnerability.
• Provides a decision support methodology for risk mitigation options with associated benefits and drawbacks.
• Provides unlimited virtual views of both scorecard and dashboard that are personalized by job function. Virtual views are really the ability of any person at a client to have their own Enterprise Sentinel Home Page. Their Home page would reflect the IT infrastructure that falls under their business role.
• Supports a personalized alerting system that notifies appropriate people when risk status changes occur. It supports a full escalation process that is adaptable to align with a customer’s standard process.

The service level scorecard is a visualization of current IT related risk exposures organized by business unit and business function. The scorecard is fully personalized (by business unit, geography, function, etc.) and provides a compliance tool developed for use in an organization’s risk governance process. The scorecard helps govern the compliance of an organization’s information technology to its overall operating risk tolerance, standards and best practices.

The technology dashboard provides a deeper, granular view into the IT infrastructure, and delivers appropriate insight into where, what, how, and when actions are to be taken to reduce risk. The end result is that any authorized user, regardless of focus (business units, management, IT, security, etc.) will be able to understand and manage technology risk. The visualization aspect of both tools also offers Advanced Decision Support to ensure customers have correct, timely information to take appropriate actions based on the knowledge gained from our methodology and processes.

The toolset delivers a fully personalized view into the IT infrastructure from both business and technology perspectives. It is an industry unique tool that permits access rights control, so that each user sees an appropriate view of the environment (sample views might include: by operational unit, by location, specific applications, network infrastructure, etc.).

Infraguard

Department of Homeland Security

CERT

SANS

Mitre CVE