Audit software access

Complying with CIP 003-05 R3 and R4

The table below summarizes how Bit9 helps utilities comply. Select each link to read more about the Bit9 feature.

File Integrity Monitoring and Control

Monitors and controls all non-executable data and configuration files. This feature includes the ability to create custom software rules that apply to specified files or paths. It optionally restricts modifications to a specific folder or folders matching a specification. This feature is helpful in applying access control on a file-by-file basis.

Integration with Microsoft’s Active Directory

Integration

The Bit9 Server smoothly integrates into an existing Microsoft Active Directory environment. The Bit9 Server sets access privileges for users of the Bit9 Console, assigns security policies to computers, provides user and computer metadata, and designates certain groups or users to be able to install software (and have it automatically approved) on Bit9 Security Platform-managed computers.

AUDITING

Event Tracking

Keeps an up-to-date database of file-related events, as well as other activities involving the Bit9 Server and managed computers. The data is viewable in predefined or custom reports. Set alerts to trigger based on certain events and then automatically export to Syslog for integration with security information and event management (SIEM) systems, data analytics programs, or to CSV files. Event tracking forms the foundation of an audit program.

Notifications and User-Initiated Approval Requests

Displays a notification to the user explaining blocked access. This feature is useful for auditing because it provides an optional file approval request method, enabling administrators to track and respond to requests directly in the Bit9 Console.

Event-Triggered Actions

Enables the creation of Event Rules, which are performed when a file- or computer-related event occurs. This feature includes the option of real-time alerts to report when a specific event occurred. Such events can be compiled, reported, and analyzed as part of regular audits, spot checks, or specific investigations.