BeyondTrust Privileged Identity (Legacy) vs. Carbon Black App Control

It is very well suited to manage local passwords on machines. It fails at managing accounts located in the directory. It treats a directory as a "system" as a result of your settings for the "system" ends up being global. It makes for a very complicated rights structure. Rights have to be assigned on a per accounts basis.

Incentivized

It is more suited to lock down critical systems and servers to prevent unwanted changes, although you can use it on daily basis on laptops and desktops, it needs constant attention and events analysis. For some scenarios i.e. financial institutions it is a must-have solution, as App Control now is a requirement 5 of PCI DSS.

Incentivized

• Manage local accounts of workstations and servers.
• The web interface is easy for users of RED to use.
• The shared password list is a very nice feature that allows users to store credentials that have to remain static.

Incentivized

• Device Control - you can view and allow/disallow the ability for certain devices to be used in your environment. Specifically we used this with USB drives. If you have one you want to use - whitelist the serial number. The rest can't be used. Simple and easy.
• Software blocking. If you have an extremely dynamic software base (I doubt this is likely) this could get a bit annoying, but for most organizations like ours where we have specific applications that are required, and then the rest are a bit of an afterthought, it's easy to whitelist the correct applications that you want to be able to run in your environment. The rest can't run (in high enforcement). Users are able to easily request new applications, and you can set certain groups to be able to approve it on their own.
• Solid platform - with few exceptions setting up new software was very easy (Dragon Medical was a bit tricky, but worked through it with support). Once you have your rules set up and the initial setup done, you tend not to have to do much of anything except to update on occasion and deal with a few requests for applications to be unblocked, or publishes approved.

Incentivized

• Not as slick as CyberArk
• Training is free, but could use a lot of improvement
• Documentation needs refinement

• More frequently updates of "Software Updaters".
• Possibilities to tag within Yara rules.
• Overall it is the best whitelisting solution I have used.

Incentivized

CyberArk and ERPM are direct competitors. Great thing about ERPM is the ability to integrate with Sailpoint out of the box. Add to that the lower overall cost of the product.

The big difference between Protect and Barkly/AMP is how exactly it goes about what it's doing. Protect is application whitelisting and program reputation. So the way it's protecting you is using a proprietary reputation service, and hash values to identify applications, and then hitting a list of whitelisted programs to decide if you are able to run that or not, based on the policy you are in. There is a LOT of value in that. We actually are working on transitioning to Cisco Advanced Malware Protection (AMP). The main reason is cost (about the same cost as Cb Protect, but with (most of) the featureset of all 3 Carbon Black products for less than 1/3 of the total spend. AMP works differently, looking at a reputation service powered by Cisco's Talos cloud. You don't really have application whitelisting, but that also reduces how many "requests" you get for applications. So I'll have to find a different way to do whitelisting and USB blocking and the like, but I'm getting more visibility across my network and also built in antivirus (TETRA engine - ClamAV with some work). Barkly is an add that we are looking to put in as it looks at behavior of programs. So specifically it watches for privilege elevation and the like. Thus far all the big name problem children (WannaCry, other ransomware problems) have been caught natively in Barkly day 0.

Incentivized

• Lower cost than competitors
• Ease of usr means easy to get staff up to speed on the product
• Very painless rollout, meaning less time troubleshooting issues

• Dashboards are easy to understand for management
• We feel more secure than we were on our previous platform

Incentivized