Blue Coat Cloud Data Protection Server Administration Guide

Transcription

1 Blue Coat Cloud Data Protection Server Administration Guide Software version 4.5.x September 16, 2015

2 2015 Blue Coat Systems, Inc. All rights reserved. Blue Coat, the Blue Coat logos, ProxySG, PacketShaper, CacheFlow, IntelligenceCenter, CacheOS, CachePulse, Crossbeam, K9, the K9 logo, DRTR, MACH5, PacketWise, PolicyCenter, ProxyAV, ProxyClient, SGOS, WebPulse, Solera Networks, the Solera Networks logos, DeepSee, See Everything. Know Everything., Security Empowers Business, and BlueTouch are registered trademarks or trademarks of Blue Coat Systems, Inc. or its affiliates in the U.S. and certain other countries. This list may not be complete, and the absence of a trademark from this list does not mean it is not a trademark of Blue Coat or that Blue Coat has stopped using the trademark. All other trademarks mentioned in this document owned by third parties are the property of their respective owners. This document is for informational purposes only. Blue Coat makes no warranties, express, implied, or statutory, as to the information in this document. Table of Contents i

3 Table of Contents Blue Coat Cloud Data Protection Server... i Administration Guide... i Chapter 1 About the Blue Coat Cloud Data Protection Server Administration Guide... 1 About this document... 1 About the audience for this document... 2 About the Blue Coat Cloud Data Protection Server... 2 About configurable components of the Blue Coat Cloud Data Protection Server... 3 Chapter 2 Getting started with the Management Console... 6 About the Management Console... 6 Opening the Management Console... 6 Using the Management Console... 7 Using the dashboard... 8 Starting and stopping individual modules... 9 Chapter 3 Managing licenses About licenses Viewing existing licenses Installing licenses Chapter 4 Managing cloud applications About applications Viewing information about an application Creating an application instance Importing corporate assets from an application About refreshing metadata Refreshing metadata for a cloud application instance Editing an application instance Chapter 5 Managing token spaces Table of Contents ii

4 About token spaces and token vaults Creating a token vault Creating a token space Viewing a token space Editing a token space Chapter 6 Managing keys groups About keys groups About encryption key life cycle Creating a key group Creating a key Editing a Key Group Chapter 7 Managing data protection policies About data protection policies About support for protecting data inserted using Data Loader Creating a policy Viewing and editing a policy Deleting a policy Chapter 8 Managing users About users Viewing users Creating a user Editing a user Deleting a user Chapter 9 Auditing events About auditing events Viewing auditing events Chapter 10 Viewing Diagnostics Viewing search cluster summary Viewing nodes description Viewing API Documentation Monitoring and managing jobs Table of Contents iii

5 Managing the Data Sync job Chapter 11 About logging About log files About the maximum log file size and number of backup files About log cleansing Specifying Management Console module logging settings Updating log file locations from properties files Updating logging parameters in properties files Chapter 12 Glossary Table of Contents iv

6 Table of Contents v

7 Chapter 1 About the Blue Coat Cloud Data Protection Server Administration Guide About this document This guide contains the following chapters: About the Blue Coat Cloud Data Protection Server Administration Guide This chapter describes chapters in the document, the document audience, and the components of the Blue Coat Cloud Data Protection Server. Getting started with the Management Console This chapter shows how to open and use the Management Console, use the dashboard, and open a new environment. The chapter also describes the Management Console. Managing licenses This chapter shows how to view and add Blue Coat Cloud Data Protection Server and cloud application adapter licenses. Managing cloud applications This chapter shows how to create an application and import corporate assets. Managing token spaces This chapter shows how to view, create, update, and deactivate a token space. Managing keys groups This chapter shows how to manage and create keys groups. Managing data protection policies This chapter shows how to view policies and assets, and create, edit, and delete policies. Managing users This chapter describes user roles and shows how to view and create users. Auditing events This chapter shows how to view audit information. Viewing Diagnostics This chapter provides search cluster summary About logging for the Blue Coat Cloud Data Protection Server This chapter describes log files, maximum log file size and number of backup files, and how to specifying Management Console module logging settings About the Blue Coat Cloud Data Protection Server Administration Guide 1

8 Glossary The glossary contains definitions for terms that appear in Blue Coat Cloud Data Protection product documentation. About the audience for this document This guide is intended for the following users: Cloud application user An end user who accesses a cloud application protected by the Blue Coat Cloud Data Protection Server. Administrator An administrative user who configures and manages certain aspects of the Blue Coat Cloud Data Protection Server. System administrator An administrative user who configures and manages the Blue Coat Cloud Data Protection core components, for example, IP, port, and database connection strings. About the Blue Coat Cloud Data Protection Server The Blue Coat Cloud Data Protection Server is an enterprise platform that provides organizations subject to data residency or privacy regulations, or those with strong internal security postures, the necessary framework to adopt public cloud technology while addressing their data control requirements. The Blue Coat Cloud Data Protection platform is a software server solution comprised of multiple server components capable of a wide range of flexible deployment options. The key tenets of the Blue Coat Cloud Data Protection Server include: Support for multiple policy options tokenization, encryption, and audit to satisfy multiple business objectives Widest support for application functionality while data is protected with strong and validated tokenization and encryption options Open integration and interoperability with broader security ecosystem solutions As native Java server applications, the Blue Coat Cloud Data Protection Server components run on Linux operating systems and can be installed on physical or virtual hosts. The Blue Coat Cloud Data Protection Server includes: Blue Coat Cloud Data Protection Server The Blue Coat Cloud Data Protection Server operates as a forward proxy, configured to intercept network traffic to and from cloud applications. Based on a configured policy, the server extracts sensitive data and either encrypts the data or replaces the data with a token. Tokens are stored along with the original text in a secure token vault. The server comprises multiple components and modules, including the Management Console application. About the Blue Coat Cloud Data Protection Server Administration Guide 2

9 Blue Coat Cloud Data Protection Integration Server The Integration Server acts as a reverse proxy, and allows for connectivity to the Blue Coat Cloud Data Protection Server for remote users and applications. The Integration Server provides features that simplify the deployment of the solution when users move between the internal network and remote work locations. If this optional component is not used, the Blue Coat Cloud Data Protection Server is added to the organization s existing internet proxy chain to allow the server to intercept data. Blue Coat Cloud Data Protection Communication Server The Communication Server is a mail transfer agent that works in conjunction with a cloud application s services, and supports use cases where contents are obfuscated. The Communication Server fully integrates with existing mail servers, leveraging all of the existing corporate security, handling policies, and support systems such as spam filtering and virus detection. Blue Coat Cloud Data Protection for cloud applications The Blue Coat Cloud Data Protection for cloud applications can be deployed for each SaaS cloud application that requires protection. Cloud application protection provides application-specific integration and play a critical role in preserving application functionality. Blue Coat Cloud Data Protection Policy Builder Policy Builder provides a framework for organizations to design and publish data protection policies for virtually any network based application. Policy Builder can be used for applications where Blue Coat Cloud Data Protection is not available for a given cloud application. The Blue Coat Cloud Data Protection leverages some system infrastructure for processing and operations: SAN/NAS Storage Disk space is used for a number of functions, including log file storage, search index storage, and storage for tokenized files and attachments. RDMS The Blue Coat Cloud Data Protection Server maintains configuration and state information in a RDMS solution. System configuration input during initialization is stored in a configuration schema. Other schemas are used to store information regarding operation scheduling, crypto and tokenization settings, and audit information. When using tokenization as a policy option, the tokens themselves are stored in one or more schemas. About configurable components of the Blue Coat Cloud Data Protection Server The following image shows the relationship between the components of the Blue Coat Cloud Data Protection Server that are configurable in the Management Console. About the Blue Coat Cloud Data Protection Server Administration Guide 3

10 Following components are shown in the image: Environment An environment is a logic collection of cloud application governance polices that approximates an organization s definition of an environment. For example, development, UAT, staging, production, etc. Location The token space location. A token space location contains a collection of tokens. Administrators must create a token space location before they can create a token space. Multiple token space locations can be created in an environment. Token Space A token space defines tokenization rules for a collection of data. A clear text value that occurs multiple times in the collection shares the same token. Multiple token spaces can belong to a single token space location. Policy A data protection policy specifies protection rules for an asset. Multiple data protection policies can exist in a single token space. Application An application is a network-accessible application. An application can be a private cloud, public cloud, software-as-a-service (SaaS) or platform-as-a-service (PaaS) application. An administrator uses the Management Console to register applications for enterprise organizations. For example, to register salesforce.com application, you can create an application from the Management Console. Similarly another application can be created to register Xactly Incent cloud application. Instance An application instance represents a salesforce.com organization. Administrators can register multiple application instances for a registered application. About the Blue Coat Cloud Data Protection Server Administration Guide 4

11 Key Group A key group is a collection of key management settings. Using encryption, an administrator applies a key group to a policy to protect assets. A key group can apply to multiple policies and a policy must use only one key group. Key groups inherit their settings from key group profiles. Keys An encryption key is part of a key group. Multiple keys can be created in a key group. Asset An asset is a user-defined data element in a cloud application or service, for example, a field or dropdown list. The Blue Coat Cloud Data Protection Server identifies assets by applying detection rules when intercepting data from the client to the cloud. Multiple assets are part of each application instance. About the Blue Coat Cloud Data Protection Server Administration Guide 5

12 Chapter 2 Getting started with the Management Console This chapter contains the following topics: About the Management Console Opening the Management Console Using the Management Console Using the dashboard About the Management Console The Management Console is a web-based interface available for administrators to manage users, applications, keys, token spaces, and data protection policies. Opening the Management Console Before logging into the Management Console, ensure that you have the URL of the machine on which the Blue Coat Cloud Data Protection Server is installed, and the credentials that the system administrator created when installing the server. To open the Management Console 1. In the browser, enter the URL for the Management Console using the following syntax: Where BlueCoatCloudProtectionServerMachine is the URL of the machine on which the Blue Coat Cloud Data Protection Server is installed. For example, if the server is installed at :8081, access the Management Console using the following URL: Getting started with the Management Console 6

13 2. In Login to System, and in Username and Password, provide credentials. 3. Choose Log in. Using the Management Console The top toolbar displays at the top of the Management Console, as shown in the following image. The top toolbar contains the following elements: Environment Displays the environment name. An environment is an operating scope for cloud application instances and modules. An environment contains a collection of cloud application governance polices and configuration settings. Selecting the environment name lists available environments to choose from. Alerts Displays the notifications for the current Account. For example, "Change your password", "Database connection error:detection" Account Displays the user name of the user currently logged in. Selecting the user name gives options to view the user profile, lock the user, and log out from current session. Language settings Displays the selected language for Management Console. Selecting the language icon provides a list of languages to choose from. English is the only supported language at this time. Getting started with the Management Console 7

14 The menu bar displays at the side of the Management Console, as shown in the following image. Choose a menu item to open that management option in the main window. Using the dashboard The dashboard, shown in the following image, provides system information on containers and modules and enables an administrator to manage modules. A container is a run-time environment that allows you to run modules. A module is a component that is deployed in a run-time environment. The following information displays on the dashboard: System Statistics Shows the number of registered cloud applications, number of running containers (nodes), number of running modules, and number of active users. Getting started with the Management Console 8

15 Blue Coat Cloud Data Protection Server modules Lists the modules running in the server as shown in the following image. For the server, available modules display in table format. The table contains the following columns: Module Name The name of the module. Uptime The number of hours since the module has been running. Status Whether the module is running or stopped. Starting and stopping individual modules From the Management Console dashboard, you can start, stop, suspend, restart, and configure available modules. The following image shows the dashboard with list of all modules and available options for Policy module. Getting started with the Management Console 9

16 Getting started with the Management Console 10

17 Chapter 3 Managing licenses This chapter contains the following topics. About licenses Viewing existing licenses Installing licenses About licenses You would need to install a license for each of the following products before you can start using them. Blue Coat Cloud Data Protection Server Blue Coat Cloud Data Protection Integration Server Blue Coat Cloud Data Protection Communication Server Blue Coat Cloud Data Protection for Salesforce Blue Coat Cloud Data Protection Policy Builder Viewing existing licenses You can view existing licenses from the Management Console->Settings->Licenses. The page displays summary of licenses users and applications and list of existing licenses. The list of total licensed users, licensed applications and expired licenses displays. Managing licenses 11

18 The list of licenses displays as shown in the following image. The following information displays in LICENSES: License Type Indicates if the license is for a Server or Adapter. Licenses for Blue Coat Cloud Data Protection Server, Blue Coat Cloud Data Protection Integration Server, and Blue Coat Cloud Data Protection Communication Server have License Type SERVER. All cloud adapters including Salesforce, Yammer, Policy Builder have the License Type ADAPTER. Company The display name for the customer organization. Installed on The date when the license was installed in the given environment. Valid From The start date when license is active. This means that users can begin using the given product on this date. Valid To The license expires after this date. Users will be unable to use the products after this date. Expired Indicates of the license is expired. The column is blank is the license is valid. Attributes Shows the number of users and applications the license is valid for. Installing licenses You can add license for a product from the Management Console. From Management Console-> Settings-> Licenses, choose Install a new license. The following form displays. Managing licenses 12

19 Browse to the license file, or alternatively drag and drop the license file. The license gets installed and the following success message displays. Managing licenses 13

20 Chapter 4 Managing cloud applications This chapter contains the following topics: About applications Creating an application instance Importing corporate assets from an application About applications An application is a network-accessible application. An application can be a private cloud, public cloud, software-as-a-service (SaaS) or platform-as-a-service (PaaS) application. An administrator uses the Management Console to register applications for enterprise organizations. To register an application, a system administrator installs: A cloud adapter for a specific application Blue Coat Cloud Data Protection Policy Builder and then uses Policy Builder to configure the application Application Management is available to system administrators. Viewing information about an application You can view information about registered applications. From the Management Console, select Cloud from menu on the left side. The installed cloud adapters display in the menu as shown. The number 1 beside the application name indicates the number of existing instances of the cloud application in the given environment. To view information about an application Managing cloud applications 14

21 In Clouds, select the application you want to view. Selecting SALESFORCE, shows the list of salesforce.com instances registered in the environment. Information for the application displays. ID The application ID Description An optional description of the application Cloud Instance ID The identifier for the given cloud application. For salesforce.com, it s the organization ID. Actions Include refresh metadata, edit application, and delete application instance Creating an application instance Before viewing registered applications or creating an application instance, you must install the appropriate adapter license. For more information on installing a license, refer to the Managing licenses chapter. The examples in this section show how to create an instance of the Salesforce application. To create an instance of the Salesforce application, you: Choose to create a new instance Add salesforce.com client and user credentials Specify SOAP API end-point settings Specify data synchronization schedule settings Specify Log4J settings To create an application Managing cloud applications 15

22 1. From Management Console->Clouds->SALESFORCE, choose Add new SALESFORCE instance. ADD CLOUD INSTANCE appears, as shown in the following image. 2. From Company, select your organization. In the example, Perspecsys is selected. In Org ID, provide a Salesforce Org ID. In Description, provide a short description of the instance. To add Salesforce client and user credentials In client and user credentials section, perform the following tasks: 1. In Login URI, add the URL to the salesforce.com instance. For example, enter 2. In REST API Path, accept the default value. 3. In SOAP API Path, accept the default value. 4. In API Version, accept the default value. 5. In User Name, add the salesforce.com user name. 6. In User Password, add the appropriate Salesforce password. Managing cloud applications 16

23 7. In Security Token, add the Salesforce security token. To specify the salesforce.com objects to sync with the Blue Coat Cloud Data Protection database In List of Object Names to Data Sync, define the object types for which to enable search functionality. To add a new object type, select Add. To specify data synchronization schedule settings In Data Sync Schedule Configuration, accept the default values, as shown in the following image. Managing cloud applications 17

24 Importing corporate assets from an application A cloud application administrator can import all corporate assets from the cloud application. To protect assets in a given cloud application instance, you must first import the assets. This section contains the following sections: About refreshing metadata Refreshing metadata in the Management Console About refreshing metadata To import assets for a given application, from the Management Console refresh metadata. Following features are available when refreshing metadata from the Management Console: When refreshing metadata, the summary screen shows the overall and current stage progress. Also when refreshing metadata, if the process fails, error details and exceptions from the log files display. This helps the administrator to troubleshoot the root cause of the failure. After completion of the refresh process, a separate count is shown for standard and custom detection rules Refreshing metadata for a cloud application instance The examples show importing from the Salesforce cloud application. From the Management Console->Clouds, select SALESFORCE. The Salesforce cloud instances page displays as shown in the following image. Managing cloud applications 18

25 To import corporate assets from an application 1. From the Actions column, choose refresh icon for a salesforce instance. The Refresh Metadata window displays as shown in the following image. The following information displays in Refresh Metadata: o o o o o o Total number of objects in the Salesforce cloud application instance Total number of object fields Number of objects in last refresh Number of object fields in last refresh The detection rules in last refresh The user who performed the last refresh 2. Choose Refresh. A confirmation message displays. The message states that the metadata refresh process interrupts the running operations. The administrator can choose to proceed or cancel the refresh process. The following image shows the confirmation message. Managing cloud applications 19

26 Select Ok. The progress of the refresh displays. 3. If the refresh metadata process fails, an error message and details and corresponding exceptions from the logs display as shown in the following image. Managing cloud applications 20

27 4. After the refresh completes, choose Close, as shown in the following image: Editing an application instance An administrator can edit an application instance in the Management Console. The following example shows how to edit a Salesforce application instance. To edit an application instance From the Management Console->Clouds, select SALESFORCE. The Salesforce cloud instances page displays as shown in the following image. From the list of applications, choose the edit icon from the Actions column. Managing cloud applications 21

28 ADD CLOUD INSTANCE window displays. Edit the required fields and select Save. Managing cloud applications 22

29 Chapter 5 Managing token spaces This chapter contains the following topics: About token spaces and token vaults Creating a token vault Creating a token space Viewing a token space Updating a token space About token spaces and token vaults A token space defines tokenization rules for a collection of data. A clear text value that occurs multiple times in the collection shares the same token. In an environment, an administrator can view, create, update, and remove a token space. Token spaces is available to system administrators and token group managers. A token vault stores the tokens, as well as protected data that is intercepted and tokenized before it is sent to the cloud application for processing and storage. A vault also provides index caching features to preserve search functionality within the cloud application. Customers can utilize their existing preferred database technologies for the token vault. Creating a token vault Before creating a token space, you must create a token vault. To create a token vault 1. Choose Tokenization->Token Vaults. The list of existing token vaults appears, as shown in the following image. Managing token spaces 23

30 2. Choose Add New Token Vault. Add TOKEN VAULT form appears, as shown in the following image. 3. Add the following values. o o o o o In Token Vaults Path, provide a path for the directory in which to store tokenized file attachments. For example, enter/home/apprtxuser/training_prerequisites/nfs/exports/token1. Note: You would need to create the directory before adding it in the Token Vaults Path. In Database Provider Type, select the database type from the drop down list. For MySQL, select MYSQL from the list. In Database Driver Location, enter the location of the database driver. For example, for MySQL, enter /usr/local/perspecsys/container/lib/mysql-connectorjava jar. For Oracle, enter /usr/local/jdbc_driver/ojdbc.jar.note: Adding a location that does not exist will not prompt the user with an error or warning. In Database URL, enter the URL to the database. For example, for MySQL enter jdbc:mysql:// :3306/psys_tokenspace1. In Database Username, shown in the following image, enter the database user name. This user must have root privileges. Managing token spaces 24

31 o o o In Database Password, enter the password for the database user. In Database Pool Min Connections, enter a value. In Database Pool Max Connections, enter a value. 4. Choose Save. The following image shows the sample values. After saving, choose Tokenization->Token Vaults. The token vault displays in the list, as shown in the following image. Managing token spaces 25

32 Creating a token space Before creating a token space, you name the token space and specify a token vault. To create a token space 1. From Tokenization->Token Spaces, choose Add New Token Space. 2. In ADD TOKEN SPACE Form, add the following values. o o o o In Token Space Name, provide a name for the token space. In Token Vault, enter the location of the folder where the token space information is stored. In Token Index De-Duplication Policy, select ALLOW or DENY. In Token Index Generation Policy, select SEQUENCE. The following image shows sample values. 3. Choose Save. After creating the token space, the following information saves in the database: The last modification date of the token space The user ID of the user who created the token space The user ID of the user who made the last modification save in the database Managing token spaces 26

33 Viewing a token space In Token Spaces, you can view a summary of available token spaces, and view details for a specific token space. To view a token space Choose Tokenization->Token Spaces. Token Spaces displays a summary of all available token spaces. To view an individual token space Choose the edit icon from the Actions column. Add token space displays information on an individual token space. Editing a token space An administrator can update a token space that is not used in a policy. A token space used in an active or suspended policy cannot be updated. An administrator can modify: A token space name or description The state of a token space The data type for a token space To update a token space 1. Browse to Tokenization->Token Spaces. 2. From the list of existing token spaces, locate the token space to update and choose the edit icon in the Actions column. Token Space information displays, as shown in the following image. 3. Update the name or location as needed and choose Save. Managing token spaces 27

34 Chapter 6 Managing keys groups This chapter contains the following topics: About keys groups Creating a key group Creating a key Revoking a key About keys groups A key group is a collection of key management settings. Using encryption, an administrator applies a key group to a policy to protect assets. A key group can apply to multiple policies and a policy must use only one key group. A key manager is a provider of key material storage or cryptographic operations. The Blue Coat Cloud Data Protection Server supports Voltage, SafeNet, and the proprietary key manager available with the Blue Coat Cloud Data Protection Server Key Management is available to system administrators and key group managers. About encryption key life cycle The encryption key life cycle contains two periods. The originator usage period is the time after a key is assigned that it can be used to encrypt data. The recipient usage period is the time period that a key can be used for decryption. Note that both originator and recipient usage period start at the same time, when the key is assigned. The following image shows the key lifecycle: Managing keys groups 28

35 For each new key group, one encryption key gets created. An administrator activates the encryption key. In general cases, the Blue Coat Cloud Data Protection Server takes care of key rotation according to the originator usage period and administrators don't need to change the key states manually. When a key expires at the end of originator usage period, the system generates and activates the new key. Autogenerated keys are automatically put in active state.the old key remains in the active state so that data encrypted with this key can be decrypted. Keys must be in active state to allow decryption operations. In all cases, the most recently activated key is used for encryption operations. The most recently activated key is highlighted as shown in the following image. When the recipient period expires for a key or when the user manually de-activates the key, the key enters deactivated state. In this state, the key cannot be used for encryption or decryption operations. When the key is deemed compromised, an administrator can revoke the key. In that state the key will not be available for decryption operations. Keys that are either deactivated or revoked can be destroyed. Note: In the Management Console, when an administrator manually deactivates or revokes a key, the key is not available to be used for either encryption or decryption operations. Any existing data encrypted with the key is not be decrypted and will appear unreadable. Creating a key group To create a key group, you must specify a key group name and description, and associate a key group profile with the key group. A key group profile can be associated with multiple key groups. A key group must be associated with only one key group profile. To create a new key group 1. From the Management Console, select Encryption, Key Groups, Add New Key Group profile. 2. In KEY GROUP PROPERTIES, in Name and in Description, provide a name and, optionally, a brief description for the key group. In State, select Enabled to make the key group active. Managing keys groups 29

36 Otherwise, select Disabled. 3. In KEY SPECIFICATION, specify the following values. a. Select a Key Manager from the list of registered managers. b. In Default Algorithm, select a default algorithm from the list of algorithms supported by the selected key manager. c. In Default Key Length, select a default key length from the list of supported key lengths for the selected algorithm. d. In Initialization Vector Policy, select an initialization vector policy from the list of supported initialization vector generation options. The following image shows sample values. 4. In CRYPTOGRAPHIC PERIODS, specify the following values. a. In Originator Usage, specify an originator usage period for keys generated in the key group. The originator usage period is the time after a key is assigned that it can be used to encrypt data. b. In Originator Usage Period, select the duration type. Available options are Minutes, Hours, Days, Weeks, Months, and Years. c. In Recipient Usage, specify a recipient usage period for keys generated in the key group. The recipient usage period is the time period that a key can be used for decryption. d. In Recipient Usage Period, select the duration type. Available options are Minutes, Hours, Days, Weeks, Months, and Years. Managing keys groups 30

37 The following image shows sample settings. Note that both originator and recipient usage period start at the same time, when the key is assigned. The following image shows property setting for a new key group. The key group appears in Key Management, as shown in the following image. Creating a key In Management Console, select Key Groups from the left menu. In the available Key Group Profiles, select the view icon beside key group that you want to create a key for. Select View icon in Actions column for the Key Group. By default, one key is created by the system for all new key groups. You can choose to Activate that key by selecting the green Activate icon in Actions column as shown in the image Managing keys groups 31

38 below. After activating, the key State changes to ACTIVE and the current active key is shown: When a key expires at the end of originator usage period, the system generates and activates a new key. Auto-generated keys are automatically put in active state.the old key remains in the active state so that data encrypted with this key can be decrypted. In all cases, the most recently activated key is used for encryption operations. The most recently activated key is highlighted and its name appears on the top of the list of keys as shown in the following image. Managing keys groups 32

39 Editing a Key Group When editing a key group, the changes an administrator makes in the Key Group affect only the new keys created after editing the Key Group. The existing key(s), if active and suitable for encryption and decryption, would still use the previous Key Group settings that existed at the time of key creation. Managing keys groups 33

40 Chapter 7 Managing data protection policies This chapter contains the following topics: About data protection policies o About support for protecting data inserted using Data Loader Creating a policy Viewing and editing a policy Deleting a policy About data protection policies A data protection policy specifies protection rules for an asset. An asset is a user-defined data element in a cloud application or service, for example, a field or drop-down list. The Blue Coat Cloud Data Protection Server identifies assets by applying detection rules when intercepting data from the client to the cloud. Polices apply to and are defined in a specific environment for a given application instance. Creating, editing, and deleting a policy does not require a restart of the Blue Coat Cloud Data Protection Server. To manage policies, a user requires the policy administrator role. Policy Management is available to system administrators and policy managers. About support for protecting data inserted using Data Loader Data inserted in the cloud application using the Apex Data Loader can be tokenized or encrypted using the policies created in the Management Console. Creating a policy To create a policy, you define properties for the policy, specify which cloud application fields to protect, and then define protection, sorting, and auditing settings. Managing data protection policies 34

41 To create a new data protection policy 1. From the Management Console, choose Policies->Manage Policies, and then choose Add a Policy. 2. In POLICY, and in Name, provide a name for the policy. 3. In Description, provide a brief description of the policy. 4. In Effective Date, specify a start date from which to make the policy active. Specify the start time from which to activate the policy. You can choose to accept the default current time. 5. To specify the assets to which the policy applies, choose Add a Field. Select the Application from the drop down list. Select the application instance and the list of Objects and fields available for protection appear. The following example shows assets for a salesforce.com application instance. Managing data protection policies 35

42 6. To apply a protection policy to an object field, do the following: a. Select an object type. For example, select Account. b. Then, select checkboxes for the appropriate fields, as shown in the following example. 7. To apply a protection policy to an attachment, do the following: Managing data protection policies 36

43 a. Select Documents. Then, select an attachment type. For example, select Account.Attachment, as shown in the following image. Managing data protection policies 37

44 b. Then, select checkboxes for the appropriate attachment fields, as shown in the following example. 8. To define a protection type for the policy, perform one of the following tasks: a. Select Encrypt option to protect fields using encryption. Select a key group from the available list. b. Select Tokenize option to protect fields using tokenization.select a token space from the available list. 9. To preserve sorting functionality for policy assets, in Functionality, select Sortable. 10. To enable auditing, in Obligations, select Audit. Viewing and editing a policy You can view a list of all policies in the system and view details of an individual policy. To view a list of policies 1. From the Management Console, choose Policies->Manage Policies. 2. The list of existing policies displays. Managing data protection policies 38

45 Policies page displays the following information about policies. Search Enables search on a policy name, ID, or asset. Policies display in table format. The table contains the following columns: ID A unique identification number for the policy Policy The name of a policy Effects The unique settings that are applied to the policy, for example, the protection type or sort cipher settings Actions The actions that a policy administrator can perform on a given policy, including edit or delete The following image shows the list of policies in an environment. To view and edit an individual policy In Actions, choose the edit icon for a policy. Information displays for an individual policy. An individual policy contains four sections, Policy, Condition, Protection Mode, and Functionality. The following information displays in Policy, as shown in the following image: Managing data protection policies 39

46 You can view or edit the following fields on this page: Name The policy name Description An optional description of the policy Effective Date The date the policy is activated In Condition, shown in the following image, protected assets for each cloud instance display in a list. Condition section displays the following information: Advanced mode Selecting this checkbox opens advanced mode to add assets. The assets must be specified in the following format: urn:psys:sfdc:4:account:billingcity Search Enables search on Instance name, Object or Field. The assets to be protected are shown in a table. The table contains the following columns: Cloud: The name of the cloud application Instance: Description of the cloud application instance Object: The cloud application object being protected Field: The cloud application field that will be protected with the policy Managing data protection policies 40

47 The following information displays in Protection Mode, shown in the following image: Encrypt Selecting this option ensures that the cloud application fields are protected using encryption. You must select a key group from the available list. Tokenize Selecting this option ensures that the cloud application fields are protected using tokenization. You must select a token space from the available list. None Selecting this option ensures that no protection mode is applied to the cloud application fields. The following information displays in Functionality, shown in the image. Sortable Sorting functionality is preserved for the fields selected in the policy Deleting a policy Policy administrators can delete existing policies. Restarting the server service is not required. To delete an existing policy In Actions, choose the delete icon for a policy. as shown in the following image. Managing data protection policies 41

48 Chapter 8 Managing users This chapter contains the following topics: About users Viewing users Creating a user Editing a user Deleting a user About users A user represents a person who accesses the Management Console. Six non-editable roles define privileges and system permissions for Management Console users. For example, applying the Policy Manager role to a user allows the user to create, edit, and delete policies. A user must contain one role. Roles apply to the environment in which they are defined. User Management is available to system administrators and user administrators. The following table describes permissions for each role. In the table, managing refers to creating, editing, and deleting, for example, managing a user indicates the ability to create, edit, or delete a user. Role System Administrator User Administrator Policy Manager Key Group Manager Token Space Manager Auditor Permissions A system administrator can manage users, manage and reset user credentials, install and configure applications, and import and export policies. A system administrator can stop and restart services and access system log files. A system administrator also has user administrator privileges. A user administrator can manage users, and manage and reset user credentials. A policy manager can manage policies. A policy manager cannot import or export policies. A key group manager can manage key group profiles and key groups, and revoke or deactivate keys. A token space manager can manage token spaces. An auditor can view audit reports. Managing users 42

49 Viewing users An administrator views Management Console users in User Management. Users display in a list, as shown in the following image. The following information displays in Users: Username The name that a user provides to log in to the Management Console Name The display name for a user in the Management Console The address of the user Role The role assigned to the user Actions The actions that you can perform on a user, including edit and delete To view the list of users From the menu bar, choose Users->Manage Users. List of existing users appears in the main window. Creating a user When creating a new user, you must assign a role to the user. Assigning a role applies security permissions which determine the actions the user can perform in the Management Console. Only a system administrator or user administrator can create a new user or assign roles, and only the system administrator can create a new system administrator. A user password must contain at least eight alpha-numeric characters. Managing users 43

50 To create a new user 1. Choose Users->Manage Users->Add New User 2. In username, provide a login name for the user for the Management Console. 3. In name, provide a display name for the user. 4. In , enter the address associated with this user. 5. In password, enter a password that contains at least eight alpha-numeric characters. 6. From role, select a role to apply to the user. 7. Choose Save. Editing a user Edit a user to update new information for the user, for example, to change the user's role or password. To edit a user 1. From Users->Manage Users, in Actions, choose the edit icon for the user. 2. In Edit User, change the appropriate settings. 3. Choose Save. Managing users 44

51 Deleting a user Delete a user to remove the user from the system. Alternatively, disable the user to make the user inactive in the system. An inactive user can be made active again at a later date. To delete a user 1. From Users->Manage Users, in Actions, choose the delete icon for the user. 2. In the confirmation message, choose OK. The user is removed from the Management Console. Managing users 45

52 Chapter 9 Auditing events This chapter contains the following topics: About auditing events Viewing auditing events About auditing events Auditing provides reporting for events that occur in the system. Typical events include changes performed by an administrator in the system. Audit Events is available to system administrators and auditors. Viewing auditing events To view audit events, from Management Console->Reporting, choose Audit. Audit data displays in table format, as shown in the following image. The table contains the following information: Date The date in Date/Month/Year format Resource Operated On The resource which was created or changed Username The name of the user who performed the action Auditing events 46

53 Chapter 10 Viewing Diagnostics This chapter contains the following topics: Viewing search cluster summary Viewing nodes description Viewing API Documentation Managing jobs Viewing search cluster summary To view search cluster summary, from Management Console->Diagnostics, choose Search Engine. The search cluster summary displays, as shown in the following image. The search cluster's status and additional parameter values are available in this page. A green status indicates good cluster health. The details on this page can help troubleshoot issues related to search. For example, if the number of active Nodes in your environment are not the same as the number of Nodes deployed, you can investigate why the nodes are not started. Cluster summary also contains the following details. Search Insert Rate shows the rate at which records are inserted into the search engine. Viewing Diagnostics 47

54 Search request Rate shows the rate at which records are requested from the search engine. Business Object Retrieve rate shows the rate at which cloud application assets are retrieved. Viewing nodes description From Management Console->Diagnostics, choose Search Engine. The following description about the node where the Blue Coat Cloud Data Protection Server components are installed are shown. Following details are available in Nodes section. The IP address of the node, including the operating system JVM memory Free disk space available on the node The size of storage available Number of documents on the node Number of Open file descriptors The version number Viewing API Documentation All the operations available in the Management Console can be run using REST APIs. To run the REST APIs and related documentation, access the Management Console. Browse to Diagnostics->API Documentation. Following page is shown. Viewing Diagnostics 48

55 Monitoring and managing jobs From the Management Console, you can monitor and manage jobs scheduled to be run by the Blue Coat Cloud Data Protection Server. To manage jobs, from Management Console->Diagnostics, choose Job Management. Viewing Diagnostics 49

56 Examples of jobs include refresh metadata and data synchronization for a given Salesforce instance. Job Management can be used for troubleshooting issues with the Blue Coat Cloud Data Protection Server. From the Management Console, browse to Jobs Management from the menu as shown in the image below. Selecting Job Management shows the list of all jobs that are scheduled or running. For example, the following image shows two jobs a data sync job and a refresh metadata job. In the above image, the data sync job is scheduled to start in 4 minutes and 28 seconds. The refresh metadata job is not scheduled and must be started manually. The following information displays for each job: Name the name of the job Description a brief description of the job. Job Status the status of the job. A job can be ACTIVE, PENDING, or PAUSED. Progress Indicates in % value, how much of the job is finished Schedule the regular interval after which the job is scheduled to run Starts In the duration after which the next execution of the job starts Actions the actions available on the job. Three options are available o o Start starts the job as soon as the play blue button is selected. Starting a job changes the Job Status to ACTIVE Pause pauses the job as soon as the blue pause button is selected. Pausing a job changes the Job Status to PAUSED Viewing Diagnostics 50

57 o o Delete deletes the job Resume the resume green color button appears when you pause a job. The start button is not available for a paused job. Note: For scheduled jobs like data synchronization, selecting the green resume button starts a job from beginning rather than resuming it from the paused state. Managing the Data Sync job For scheduled jobs like data synchronization, selecting the green resume button restarts the data synchronization job from beginning. Changes to the scheduled data synchronization job will not take effect until the schedule entry is recreated. Recreating the data synchronization job, will resynchronize all objects that are enabled for data sync for a specific salesforce.com organization. For organizations with large number of records, data synchronization operation is processed in batches. Administrators define the size of the batches using the DataSync operation Batch maximum size setting in the organization instance setup. Additionally, the Blue Coat Cloud Data Protection Server throttles the synchronization process to assure that system resources are managed across the cluster. Viewing Diagnostics 51