Using IBM BigFix SCM. Reminder: You must dial-in to the phone conference to listen to the panelists. The web cast does not include audio.

Transcription

1 IBM Security Support Open Mic Wednesday, April 6, 2016 Using IBM BigFix SCM Panelists Christian Castro, Presenter IBM BigFix Level 2 Support Engineer Adam McDonald Level 2 Support Knowledge Leader Nathan Hanner - Level 2 Support Engineer Kevin Reinstein, Moderator - Level 2 Support Manager Reminder: You must dial-in to the phone conference to listen to the panelists. The web cast does not include audio. USA toll-free: USA toll: Participant passcode: Slides and additional dial in numbers in techdoc : NOTICE: By participating in this call, you give your irrevocable consent to IBM to record any statements that you may make during the call, as well as to IBM's use of such recording in any and all media, including for video postings on YouTube. If you object, please do not connect to this call. 1

2 Agenda What is SCM? What is SCA? Installation of SCM and SCA Working with a Checklist for Windows* Creating Custom Checklists Common pitfalls to avoid *Linux Checklists will not be covered in this OpenMic. However if there is interest there can be another OpenMic scheduled to cover using SCM in Linux environments. 2

3 What are SCM and SCA?

4 What are SCM and SCA? SCM stands for Security and Compliance Management. It is a product that is part of the IBM BigFix suite that helps organizations both protect endpoints and meet various federal and industry security compliance standards for their machines. Some standards are: Center for Internet Security (CIS), US Government and Configuration Baseline (USGCB). SCA stands for Security and Compliance Analytics. It is the graphical piece of the SCM product. SCA shows you the graphical results of your compliance efforts. Though not required for SCM to work, customers find it highly beneficial to have a webpage that shows which machines are in compliance and SCA does this. Both SCM and SCA are now known as IBM BigFix Compliance For more information regarding this topic refer to our whitepaper at: =WGD03072USEN.PDF 4

5 Installing SCM

6 How do you install SCM? SCM consists of sites just like any of our other sites. The sites have fixlets in them that are geared to look for certain things pertaining to the standard, whatever standard you chose, CIS, DISA STIG etc. As such, you add them into the console like any other site, using the License Overview screen as below: 6

7 How do you install SCM? Once you add the SCM site, they will appear under the BigFix Management domain. 7

8 How do you install SCA? To install SCA 1. Add the SCM Reporting site to your BigFix console. 2. Expand Fixlets and Tasks underneath that site. 3. Deploy Fixlet IBM BigFix Compliance 1.8 First-time install to the computer you intend to use as your SCA server, as below: 8

9 How do you install SCA? Warning: Make sure whatever machine you choose to house the SCA product has enough disk space to handle the SCA installation. The installer file alone takes 298 MB of disk space. 9

10 How do you install SCA? As per the installation fixlet you download the SCA installer file. It will be at: X:\Program Files (x86)\bigfix Enterprise\BES Installers\TEMA 10

11 How do you install SCA? Run the executable 11

12 How do you install SCA? Follow the prompts. For purposes of this presentation SCA was installed on the main BigFix server. You can also choose to install it on a server other than the main BF server. 12

13 How do you install SCA? I also chose to supply it the webreports database which is an optional step. Note: on Windows the default name for the WebReports database is BESReporting. 13

14 How do you install SCA? Note this screen about importing. The more SCM sites you added and the more machines you subscribed to those sites, the longer the import will take. 14

15 How do you install SCA? 15

16 How do you install SCA? After installation you can launch the SCA webpage which will show as IBM BigFix Compliance. For purposes of this presentation I had already subscribed to some SCM sites and had subscribed some machines to those sites so I had data for the SCA import job to import. The SCA webpage showed me this: 16

17 How do you install SCA? If you choose to use Mozilla Firefox as your browser you will get the following screen. You need to click on the Add Exception button in order for Firefox to show you the SCA page. 17

18 How do you install SCA? For Firefox you will then have to click the Confirm Security Exception button: 18

19 How do you install SCA? SCA webpage via Firefox: 19

20 How do you install SCA? SCA webpage via Firefox: 20

21 Working with a Checklist for Windows

22 Working with a Checklist for Windows For purposes of this presentation I had already subscribed my machines to some sites such as the PCI DSS Checklist for Windows 7. Note: A checklist is a site. The fixlets in them check for specific things and collectively make up the checklist or site. 22

23 Working with a Checklist for Windows To see my results in graphical form, I then went to the SCA website as per below. Then chose Reports -> Checklist -> and saw the graphical output for that site. 2 of my machines were applicable to the site and they passed 39% of all the checks from that site (the checklist) as of 4/5/2016 midnight, 12:00 AM. 23

24 Working with a Checklist site for Windows Note: If you go back to the BigFix console -> under the site itself -> click on the Show Non- Relevant Content up top, you will see this particular site checks for 229 things. Not all 229 are actual checks. Some are housekeeping fixlets themselves. 24

25 Working with a Checklist site for Windows Note: As the SCM sites use fixlets, each fixlet will, in-turn, use Relevance to determine if it itself is applicable to a machine(s) or not. Some fixlets may not be applicable as, for example, database checks fixlets would not be applicable to a customer that had no databases in their environment. If you un-depress Show Non-Relevant Content and you will see only 125 fixlets applicable to this environment for this particular SCM site. 25

26 Working with a Checklist for Windows You can then go back to the SCA main page and check out the various charts. In this example you can navigate to Reports -> Checklists and see how many checks, for the entire environment, passed (compliant), failed (not compliant) or were not applicable. 26

27 Working with a Checklist for Windows You can then click on the individual checklists and see a report just for that checklist as below. There is a heading titled Checklist: PCI DSS Checklist for Windows 7 Keep in mind the Check Results History values are the checks themselves; not the number of computers. And it s a cumulative number for all computers. 27

28 Working with a Checklist for Windows Example below shows 225 checks total, but reading 239 checks as Non-Compliant. How can this be? It can be because it s the total, for all machines. In the example, there are 2 computers subscribed to this PCI DSS Checklist for Windows 7 site. Between both machines, 239 individual fixlets (checks) came back as noncompliant, 155 Compliant, 56 Not Applicable. You can click on the numbers themselves for more info. 28

29 Working with a Checklist for Windows You can also customize the SCA webpage view with the Configure View option, as below: 29

30 Working with a Checklist for Windows See: 30

31 Creating a Custom Checklist

32 Creating a Custom Checklist The recommended way to create your own custom checklist is to use the Create Custom Checklist Wizard that is part of the SCM reporting site as shown below: 32

33 Creating a Custom Checklist. You then can name your site and choose the fixlets you want to create your custom checklists from our sites as shown below: 33

34 Creating a Custom Checklist Make sure to click on the Create Checklist button on the bottom of the screen. The site will then appear under Custom Sites in the BigFix console: 34

35 Creating a Custom Checklist We recommend you use the Synchronize Custom Checks feature to make sure the copy that you have derived from our own site(s) is up to date. A recommended practice is to run this wizard once a month. Note that when we release new content, we do not update customers own custom sites, just our sites, therefore, the need for the wizard. 35

36 Common pitfalls to avoid

37 Common pitfalls to avoid The biggest pitfall users face is not understanding the relationship between what they do in the console and the results they will see in the SCA webpage. Therefore, keep in mind: SCA will pull data from the BigFix database into its own database known as the TEMA database. This is a very laborious process and puts strain on the BigFix server database if you have a large deployment with thousands upon thousands of endpoints. Therefore we recommend the import job be scheduled during off-hours. The default pull time is once a day at midnight. A once a day pull is recommended. The pull is what is referred to as the Import job. If you add/remove computers from the console, it will take some time to see those results in SCA provided you performed an import job. If a machine was not subscribed to the corresponding SCM site then no results will be visible for that machine in the SCA webpage, even if you perform an import job. Machines must be added to SCM sites first. 37

38 Common pitfalls to avoid For Custom Checklists: Make sure you use the Synchronize Custom Checks wizard under the SCM Reporting site to have the latest version of checks you copied from our sites. Otherwise you run the risk of a checklist having old relevance and giving you incorrect results in the SCA webpage. For the Import job We recommend the Import job be run once a day during non-peak hours. 38

39 Where do you get more information? Questions on this or other topics can be directed to the IBM BigFix forum: Additional references: IBM BigFix Compliance in IBM Knowledge Center: IBM BigFix Compliance in IBM developerworks articles: 0Endpoint%20Manager/page/BigFix%20Compliance How to sign up for notifications when BigFix releases new content for our sites: Follow us: 39

40 Questions

41 Questions for the panel? Now is your opportunity to ask questions of our panelists. To ask a question now: Press *1 to ask a question over the phone or Type your question into the IBM Connections Cloud Meeting chat To ask a question after this presentation: You are encouraged to participate in our Forum topic for this event: IBM Corporation 41

42 Statement of Good Security Practices: IT system security involves protecting systems and information through prevention, detection and response to improper access from within and outside your enterprise. Improper access can result in information being altered, destroyed, misappropriated or misused or can result in damage to or misuse of your systems, including for use in attacks on others. No IT system or product should be considered completely secure and no single product, service or security measure can be completely effective in preventing improper use or access. IBM systems, products and services are designed to be part of a lawful, comprehensive security approach, which will necessarily involve additional operational procedures, and may require other systems, products or services to be most effective. IBM DOES NOT WARRANT THAT ANY SYSTEMS, PRODUCTS OR SERVICES ARE IMMUNE FROM, OR WILL MAKE YOUR ENTERPRISE IMMUNE FROM, THE MALICIOUS OR ILLEGAL CONDUCT OF ANY PARTY. THANK YOU Copyright IBM Corporation All rights reserved. The information contained in these materials is provided for informational purposes only, and is provided AS IS without warranty of any kind, express or implied. IBM shall not be responsible for any damages arising out of the use of, or otherwise related to, these materials. Nothing contained in these materials is intended to, nor shall have the effect of, creating any warranties or representations from IBM or its suppliers or licensors, or altering the terms and conditions of the applicable license agreement governing the use of IBM software. References in these materials to IBM products, programs, or services do not imply that they will be available in all countries in which IBM operates. Product release dates and / or capabilities referenced in these materials may change at any time at IBM s sole discretion based on market opportunities or other factors, and are not intended to be a commitment to future product or feature availability in any way. IBM, the IBM logo, and other IBM products and services are trademarks of the International Business Machines Corporation, in the United States, other countries or both. Other company, product, or service names may be trademarks or service marks of others.