How Can We Help?
Agent
In cybersecurity, an “agent” refers to some form of software installed on a device or server to perform some security related task(s). These agents can monitor system activity, scan for vulnerabilities, enforce security policies, and take actions like applying patches or rebooting systems. They act as a local security presence, providing detailed, real-time insights into the security of a device.
- Agent-Based Security:
This approach uses software agents installed directly on endpoints to monitor system operations, file usage, processes, and network connections.
- What they do:
Agents collect security-related data, including system metrics, security events, and application logs. They can also enforce security policies, like blocking unauthorized access or applying security updates.
- Benefits:
Agent-based security provides real-time monitoring and control, allowing for immediate responses to security threats.
- Considerations:
Despite being effective, agent-based security can have performance impacts on the device. This is due to the additional processing required. It also requires installation and management on each device.
- Agentless vs. Agent-Based:
Agentless security, in contrast, uses network and cloud tools to monitor devices without installing software agents. This approach focuses on scalability and simplicity but may have limitations in real-time monitoring and detail. Here’s more on the topic from Palo Alto Networks
- Example:Network Access Control (NAC) solutions can be agent-based or agentless. Agent-based NAC requires users to install agent software on their devices to communicate information about the device to the NAC software. Agentless NAC solutions scan the device without installing agents.
Definitions of cybersecurity agent
A program acting on behalf of a person or organization.
SOURCE: SP 800-95
NIST Definition – A program acting on behalf of a person or organization.
Sources: NIST SP 800-95 from Web Services Glossary – W3C Working Group Note 11 February 2004
A host-based IPS program that monitors and analyzes activity and performs preventive actions; OR a program or plug-in that enables an SSL VPN to access non-Web-based applications and services.
>Sources: NIST SP 800-113
A host-based intrusion prevention system program that monitors and analyzes activity and performs preventive actions; OR a program or plug-in that enables an SSL VPN to access non-Web-based applications and services.
>Sources: NIST SP 1800-21B from NIST SP 800-113
