Whenever I see the term "CMDB" thrown about, my bs detector activates.
According the RSA use case video, the enVision solution will:
- Magically "discover" your IT environment by drawing upon your CMDB. Sure.
- Magically get messages from your vulnerability scanner what exploits your server is vulnerable to
- Process your IDS logs and magically correlate attacks with the vulnerabilities mapped in steps 1 and 2
Not knowing anything about enVision outside of what that video presented, I'm concluding that it's bogus enterprise software that typically gets sold to CIOs who are in the middle of ITIL projects, and that remains on the shelf in 90% of the time. Why?
- CMDB is the great white whale of the ITIL high priests. Whatever database you have to track things, I'm sure that it isn't a CMDB.
- After you spend a few years figuring out what RSA defines as a CMDB, how is this tool actually going to find anything? (A: You're going to write lots of scripts and do lots of work. Or hire lots of RSA consultants)
- How do you correlate whatever your vulnerability scanner is reporting with the crap from you CMDB? (A: You're going to write lots of scripts and do lots of work. Or hire lots of RSA consultants)
- How do you then automatically correlate attacks against vulnerabilities that were in turn associated with crap from your CMDB? (A: You give up before this stage.)
There's too many moving parts... assuming that the product could work, the resources required to make that happen probably exceed the cost of having someone sit at a desk at stare at syslog output 24x7.