1. User Responsibility A “How To” Guide for SecurityCenter

2. User Responsibility Feature Often in an IT environment, it can be unclear who is responsible for managing and patching certain systems on the network SecurityCenter 4.8 and later supports grouping systems into assets and assigning Users to be responsible for those assets

3. User Responsibility Feature User Responsibility featureThis guide explains how to set up and use SecurityCenter’s User Responsibility feature to assist in tracking User responsibilities and understanding how well vulnerabilities on network systems are being managed

4. User Responsibility Feature Procedure: 1. Add or create assets 2. Assign Users to be responsible for assets 3. Use dashboards and reports to track User responsibilities and vulnerability management

5. Add Assets To add an asset from the SecurityCenter app store feed, within SecurityCenter select Support > Assets Click the “Add” button Select the desired asset and click “Add It Now”; Repeat to add more assets Click the “Finished” button

6. Create Assets For User responsibility, an organization will likely want to create custom groupings of systems via Static or LDAP Query assets To create a custom asset, within SecurityCenter select Support > Assets Click the “Add” button Click “Create Custom Asset” Set the asset Type, Name, and system information Click the “Submit” button

7. Assign User Responsibility A SecurityCenter User can be assigned responsibility for an asset when the User is created, or by editing the User

8. Assign User Responsibility Assign the asset for which the User is responsible on the “Access” tab o Can only assign a single asset, but that asset can be any type, including a combination asset of multiple other assets o “All Available Ranges” assigns responsibility for all systems the User can see, i.e., everything in the defined ranges of the User’s Group

9. User Responsibility Dashboard The User Responsibility dashboard will assist in tracking User responsibilities and understanding how well vulnerabilities are being managed o This dashboard can be located in the SecurityCenter feed by selecting category Monitoring and then selecting tag user responsibility

10. User Responsibility Dashboard User Responsibility SummaryDashboard makes use of the User Responsibility Summary tool, which displays Users and the vulnerability info of the asset for which each User is responsible Note: If multiple Users are responsible for the same asset, the Users will be displayed in a list in the Users field in the output

11. User Responsibility Dashboard Scanned Hosts Per UserScanned Hosts Per User component makes use of the User Responsibility tool and filters on Plugin 19506 (Nessus Scan Information) Plugin 19506 returns one result for each scanned host, enabling this component to display a count of scanned hosts for which each User is responsible

12. User Responsibility Dashboard Scanned Hosts Per User – To drill down to obtain information on the specific systems for which a User is responsible: 1. Click on the Browse Component Data button 2. Click on the desired User (For Flash interface, click in the Total or Vulnerabilities column for the User) 3. Change tool from Vulnerability Summary to IP Summary Flash HTML 5

13. User Responsibility Dashboard Exploitable Vulnerabilities Per UserExploitable Vulnerabilities Per User component makes use of the User Responsibility tool and filters vulnerabilities with an Exploit Available This component displays the count of exploitable vulnerabilities on all systems for which each User is responsible

14. User Responsibility Dashboard Exploitable Vulnerabilities Per User – To drill down to obtain detailed vulnerability information on the systems for which a User is responsible: 1. Click on the Browse Component Data button 2. Click on the desired User (For Flash interface, click in the Total or Vulnerabilities column for the User) 3. If desired, change tool to Detailed Vulnerability List; to obtain remediations, change tool to Remediation Summary Flash HTML 5

15. User Responsibility Dashboard Patches Available >30 Days Per UserPatches Available >30 Days Per User component makes use of the User Responsibility tool and filters vulnerabilities that had a Patch Published more than 30 days ago This component displays the count of patches that have been available for more than 30 days for vulnerabilities on all systems for which each User is responsible

16. Network Mapping Report makes use of the User Responsibility tool within an IP iterator to show the User(s) responsible for each hostNetwork Mapping Report In a Report Display User(s) responsible for host Iterate over IPs

17. Customization by User Responsibility Responsible UsersAny vulnerability-based dashboard or dashboard component can be customized for specific responsible User(s) by using the Responsible Users filter option Note: Multiple Users can be selected

18. User Responsibility SecurityCenter 4.8 and later supports grouping systems into assets and assigning users to be responsible for those assets User Responsibility featureUsing dashboards and reports based on the User Responsibility feature will assist an organization in tracking User responsibilities and understanding how well vulnerabilities on network systems are being managed

19. For Questions Contact Tenable Customer Support Portal