case study Vesta
The cost savings is substantial, said
James Summers of the ability to shorten
the audit process by nearly 70%. Tripwire
is great because you can walk the assessor
through multiple parts of the PCI Standard
in one place. And because it is the one
tool everyone in the industry uses, audi-
tors accept it immediately; I don t have to
spend extra time defending my choice to use
Tripwire.
For these reasons, Summers says, If you
are going to spend money on any one tool to
help reach PCI compliance, buy Tripwire.
With Tripwire, it is quick and easy to show
auditors how process controls are working.
With its advanced reporting and built-in PCI
assessments, Tripwire provides confirmation
that the necessary controls are at work and
that administrators know if an unauthor-
ized change has occurred at the moment it
occurs. Most importantly, Tripwire provides
the essential information auditors always
want to see: what changed, by whom, when
and why.
Approaching each audit as an independent
event with its own set of unique controls
would be overwhelming. Instead, Summers
has implemented a holistic security policy
largely based on the ISO 27001 and PCI
Standards and enhanced with his practical
experience that meets not only the needs of
different auditors, but concurrently benefits
the business and its clients. Tripwire is an
essential part of his approach and provides
the automated controls that assure Summers
and his team that security policy is being
followed across the enterprise.
TRiPwiRe iN ACTiON
Working with James Summers is Vesta secu-
rity engineer, Ryan King. King manages
all Tripwire reports and responds to any
alerts to questionable changes. King s job
is to reconcile these changes with Vesta s
change management system to ensure that
all changes adhere to policy. When an unau-
thorized change is found, King investigates
to ensure appropriate action is taken.
Tripwire catches everything. It is always
watching and because it is automatic, no one
can side-step Tripwire. It is great at making
sure that employees follow the change pro-
cess, said King.
One of the new capabilities King appreci-
ates most is Tripwire s support for Active
Directory. With Active Directory monitor-
ing, Vesta has complete oversight of who
is making changes within a critical part of
the IT environment. Because King can now
verify Active Directory activity and main-
tain a trusted audit trail, he has been able
to expand the scope of people s roles and
extend them broader rights. This ability to
trust, but verify enables Vesta to move
faster, get more work done, and resolve mis-
takes quickly should they occur.
Tripwire Enterprise s Active Directory
features give you more information than do
many utilities designed expressly for this
purpose, said King.
In addition, Vesta is using Tripwire
Enterprise s configuration assessment to
evaluate each system s compliance to both
the benchmarks from the Center for Internet
Security (CIS) and internal Vesta security
policies. Vesta likes that they are able to
compare configuration policies against their
systems with the same solution that audits
its systems for change. Says King, with
Tripwire doing both jobs, we only have one
agent on the server performing both tasks,
plus we are spared the time and expense
of buying and managing two software
packages.
With Tripwire active across the infrastruc-
ture, Vesta knows exactly what changed and
should an outage or service degradation
occur, can quickly rule change in or out as a
causal factor, and if change related, quickly
identify and remediate the responsible
change. With this new capability, Vesta has
decreased its mean-time-to-repair by hours
and has increased its uptime to 99.95%.
tripwire has been with
us all the way. From our
account team to support, I
give tripwire solid marks
across the board. In the three
years we ve been a tripwire
customer, we ve talked to
the support team less than
a handful of times. tripwire
just works.
ryan KIng
security engineer,
Vesta
