Tools for Compliance

[TheVMinator]

I am aiming at eventual HIPAA and SOC 2 compliance.  Right now from a tools perspective I have only Nessus, a scanning tool.  As far as tools that I may need to invest in, what are the areas and best tools in those areas that I need to look at, to have a shot at HIPAA + SOC 2.

Has anyone tried to quantify the areas that you need purchase tooling and/or develop automated reporting around in order to faciliate the process of driving toward compliance standards such as these and can help me quantify what is needed as represented below?

Area	Tool Example	What is the level Importance/Non-Importance for Compliance (Recommended, Important, Essential, or Overkill?)
Scanning of ESXi hosts and vCenter Server and reporting results	Nessus (is this enough by itself to address scanning or is another tool needed?)
Configuration Management Tool	(VMware Configuration Manager, others?)
Security Analytics Tool for logs and events	(example -  Log insight plus security pack or Splunk) -
Tool for authentication / password vault	Hytrust or similar
(add other areas / tools I missed here...)

[Netwrix]

You can also look at our Netwrix Auditor for VMware, it tracks who made what changes, when, where, including snapshots and other things. Works with vSphere and individual ESX(i) hosts. Integration with SIEM supported.

HIPAA compliance with Netwrix reference documentation.

[Texiwill]

Hello,

Auth: HyTrust, Xceedium, Thycotic, etc. Lots that can help here, some will record, others will not.

Compliance checking: Catbird (covers most if not all of them), HyTrust (depends on what), VMware vCM + its add on packages, etc.  I personally like HyTrust and Catbird for this. Now VMware may be working on new stuff as well. I even wrote my own script to check against the hardening guide. You really want to meet that for the Virtual Environment (VE). For the VMs that is different. Is the VE in scope if the management is segregated from the VMs? What is the scope of your compliance? That is paramount to understand first. Remember compliance is NOT security.

Best regards,
Edward L. Haletky
VMware Communities User Moderator, VMware vExpert 2009, 2010, 2011,2012,2013,2014

Author of the books 'VMWare ESX and ESXi in the Enterprise: Planning Deployment Virtualization Servers', Copyright 2011 Pearson Education. 'VMware vSphere and Virtual Infrastructure Security: Securing the Virtual Environment', Copyright 2009 Pearson Education.

Virtualization and Cloud Security Analyst: The Virtualization Practice, LLC -- vSphere Upgrade Saga -- Virtualization Security Round Table Podcast

[TheVMinator]

Compliance checking: Catbird (covers most if not all of them), HyTrust (depends on what), VMware vCM + its add on packages, etc.

OK - what do you think about Nessus for use in compliance checking?

I even wrote my own script to check against the hardening guide.

by chance is your script publicly available?

You really want to meet that for the Virtual Environment (VE).

For HIPAA - do I need to meet Reference Profile 2 on all points?

Is the VE in scope if the management is segregated from the VMs? What is the scope of your compliance?

Not sure how to go about determining this for HIPAA or SOC 2 - suggestions?  (There is a separate management cluster and networks for management VMs)

Thanks for the input!

[Texiwill · Accepted solution]

Hello,

Re: Nessus

It can be used but only sees a little of the VE, it however will see your VM environment. Compliance is really about the workloads. What they touch and whether what they indirectly touch. Start with figuring out the actual scope of the compliance.

Re: Script

Not really it however hits the highlights. I plan on making it available somehow.

Re: HIPAA

Where are your workloads in relation to everything. Generally I would say Yes, but how is HIPAA handled today? First check that with your compliance folks. Compliance is really about the workloads. What they touch and whether what they indirectly touch. Start with figuring out the actual scope of the compliance.

Best regards,
Edward L. Haletky
VMware Communities User Moderator, VMware vExpert 2009, 2010, 2011,2012,2013,2014

Author of the books 'VMWare ESX and ESXi in the Enterprise: Planning Deployment Virtualization Servers', Copyright 2011 Pearson Education. 'VMware vSphere and Virtual Infrastructure Security: Securing the Virtual Environment', Copyright 2009 Pearson Education.

Virtualization and Cloud Security Analyst: The Virtualization Practice, LLC -- vSphere Upgrade Saga -- Virtualization Security Round Table Podcast

[TheVMinator]

OK thanks again