CyberCop Scanner Getting Started Guide

CyberCop Scanner in Active Security
Your Security Policy
(You decide what is important
and how to respond)
McAfee
HelpDesk
Gauntlet
Firewall
CyberCop
Scanner
(Proactively scanning
internal network
for vulnerabilities)
Event Orchestrator
(Accepts all alerts, compares
with security policy, then
initiates responses)
Administrator
alerts
Figure 1-2. The Active Security suite.
The above figure illustrates the following principles:
• Your network security policy determines everything Active Security does.
• Your network administrator runs one or more copies of CyberCop Scanner to
examine your network for vulnerabilities.
• One or more copies of Event Orchestrator listen to CyberCop Scanner and, when
vulnerabilities are detected, automatically dispatch your custom predetermined
responses — which may involve sending an alert to the administrator or running
a Visual Basic script.
• Some responses can be delegated to external actors, including Gauntlet Firewall
and McAfee HelpDesk.
The two remaining Active Security components, the Net Tools PKI Server and the
Active Security Setup Panel, aren’t sensors, arbiters, or actors. Instead, they support
the sensors, arbiters, and actor components by making it possible for them to
communicate securely.
IMPORTANT: The purpose of Active Security is to implement your network
security policy. Do not activate any of the Active Security features until you
have formulated a network security policy.
CyberCop Scanner Getting Started Guide 1-5