Security Configuration Management. Setup Guide

Transcription

1 Security Configuration Management Setup Guide Setup Guide i

2 Note: Before using this information and the product it supports, read the information in Notices. Copyright IBM Corporation 2003, US Government Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp. ii SCM

3 Contents Part One 1 Introduction 1 System requirements 1 Part Two 3 Setting up your deployment 3 Installing SCM 3 Navigating SCM in the BigFix console 3 Modifying external site subscription 7 Using default SCM benchmarks 10 Modifying control parameters 11 Disabling controls 13 Remediating out-of-compliance controls 14 Accessing the Control Dashboard and Reporting 14 Part Three 19 Support 19 Technical support 19 Part Four 21 Notices 21 Setup Guide iii

4 iv SCM

5 Part One Introduction This guide will take you through the SCM installation and setup process. For a detailed methodology about how to use SCM, see the SCM User s Guide. For Security Content Automation Protocol (SCAP) guidance, see the BigFix SCAP Setup Guide and User s Guide, available on the BigFix support site. System requirements Your BigFix SCM deployment must be configured according to the following requirements. Minimum supported browser versions: Internet Explorer 6.0 or 7.0 Minimum Adobe Flash player version: Flash Player 9.0 Minimum BigFix component versions: Console Web Reports Windows Client UNIX Client Setup Guide 1

6 2 SCM

7 Part Two Setting up your deployment Installing SCM Each SCM benchmark, also called checklists or baselines, is provided as a single site and represents a single standard and platform. Once added to a BigFix deployment, the content is continuously updated and automatically delivered. The SCM site masthead contains information about BigFix content that performs certain tasks and analyses within your deployment. You must be subscribed to the SCM site in order to collect data from the BigFix Clients. This data is utilized for reporting and analysis. The process for site subscription depends on the version of the BigFix Console that you have. For more information about site subscription, see the BigFix Knowledge Base article here. Alternatively, an air-gap can be used to physically separate the BigFix Server from the Internet Fixlet Server. For more information, see The Fixlets in this site can be implemented as-is or customized to meet your own security policies. Because the relevance is evaluated locally on each endpoint, the SCM solution is scalable and can accommodate hundreds of thousands of clients. Navigating SCM in the BigFix console BigFix SCM has new and upgraded features that provide enhanced functionality related to compliance checklists and benchmarks. The navigation tree in the BigFix Console, which is available for all BigFix products, is your central command for all SCM functions. From the navigation tree, you can access all reports, wizards, Fixlets, analyses and tasks related to SCM tools. Components The BigFix Console organizes content into the following parts: Domain Panel Includes navigation tree and list of all domains Navigation Tree Includes list of nodes and sub-nodes containing site content List Panel Contains listing of tasks and Fixlets Work Area Work window where Fixlet and dialogs display In the context of the BigFix Console, products or sites are grouped by categories or domains. For example, Configuration Management is one of the sites contained within the Security Configuration domain, along with Asset Discovery, among others. Setup Guide 3

8 The Domain Panel is the area on the left side of the Console that includes a navigation tree and a list of all domains. The navigation tree includes a list of nodes and sub-nodes containing site content. The following image displays the navigation tree with expandable and collapsible nodes, and a list of domains at the bottom. By clicking the Security Configuration domain at the bottom of the domain panel, a list of sites associated with that particular domain will display in the navigation tree. The red-outlined area represents the entire Domain Panel (including the navigation tree and list of domains), and the blue box contains just the navigation tree for the Security Configuration domain. SCM tasks are sorted through upper and lower task windows, which are located on the right side of the Console. The upper panel, called the List Panel (blue), contains columns that sort data according to type, such as Status, Name, Site, Applicable Computer Count. The lower panel or Work Area (red) presents the Fixlet, task screen or Wizard from which you are directed to take specific actions to customize the content in your deployment. 4 SCM

9 Working with content The nodes in the Configuration Management navigation tree expand and collapse to enable you to easily navigate and manage relevant components in your deployment. Setup Guide 5

10 Configuration Management content is organized into two primary nodes External Checklists and SCAP Tools, along with two dashboards located at the top of the navigation tree. In the image below, you can see how each sub-node under External Checklists expands to display additional tasks and content: 6 SCM

11 Composite view For an overall view of the type of SCM content, click o the External Checklists node and review the List Panel on the right. Modifying external site subscription When deploying an SCM checklist or benchmark, consider the selection of configuration settings implemented on a given system. In many cases, organizations define a single benchmark for a single class of systems or type of systems, and apply that benchmark for both assessment and remediation when needed. The SCM checklists must be carefully subscribed to only the systems that are evaluating the configuration settings defined within the site. This ensures that the Reporting Dashboard only reports on the configuration settings you want to be evaluated on the systems. Without correctly subscribing the sites, the Dashboard might not report correctly. Generally, when you subscribe a BigFix-provided SCM checklist, the BigFix Console distributes the sites to all BigFix Clients by default. To correctly target clients, follow the steps below: 1. From the BigFix Console, click Tools and select Add External Site Masthead. 2. Browse to locate the masthead file, and click Open. Select a security site from the list that is targeted to a specific operating system, such as the SCM Checklist for DISA STIG on Windows Setup Guide 7

12 3. To add the site, click Yes and enter your Private Key Password. 4. To gather the site, click Gather in the External Site dialog. The BigFix Server begins the gathering process, during which time tasks and analyses are gathered from the central BigFix Hosted Content Server. 5. Click the Computer Subscriptions tab. This allows you to set parameters for the computers that are subscribed to this site. 6. Click the Computers which match the condition below button and review the dropdown list to select filter criteria. 8 SCM

13 7. Select the group of computers you want to target. For this example, select OS and enter Win2003 in the property value box. This subscribes Win2003 OS computers to this particular site. Follow this procedure with each site to ensure that only the appropriate computers are subscribed to each out-of-the-box SCM site. Below are the group definitions for other operating systems: Operating System String Windows XP WinXP Windows Vista WinVista Windows 2003 Win2003 Oracle Solaris 10 OracleOS 5.10 Oracle Solaris 9 OracleOS 5.9 Oracle Solaris 8 OracleOS 5.8 IBM AIX 5.1 AIX 5.1 IBM AIX 5.2 AIX 5.2 IBM AIX 5.3 AIX 5.3 HP-UX 11.0 HP-UX B HP-UX HP-UX B HP-UX HP-UX B Red Hat Enterprise Linux 3 Linux Red Hat Enterprise AS 3 Linux Red Hat Enterprise ES 3 Linux Red Hat Enterprise WS 3 Red Hat Enterprise Linux 4 Linux Red Hat Enterprise AS 4 Linux Red Hat Enterprise ES 4 Linux Red Hat Enterprise WS 4 Red Hat Enterprise Linux 5 Linux Red Hat Enterprise AS 5 Linux Red Hat Enterprise ES 5 Linux Red Hat Enterprise WS 5 Setup Guide 9

14 This is the basic procedure for viewing and using an SCM checklist on all supported platforms. There are differences between the Windows and UNIX platforms and how you set parameters on each. For more information, see the BigFix SCM Benchmarks Guide. Using default SCM benchmarks After subscribing to the SCM sites, locate your SCM checklists in the navigation tree. Expand each checklist to view available content. 10 SCM

15 The Fixlets displayed in Fixlets and Tasks represent security controls with which at least one BigFix-managed computer on your network is out of compliance. Fixlets use Relevance expressions to evaluate a security control locally, on each endpoint. An endpoint that is out of compliance reports back to the BigFix Console, which lists the Fixlet as relevant. You always see a real-time evaluation of your security status. Double-click any Fixlet from the list to view it. The Fixlet opens in the work area with the following tabs: Description, Details, Applicable Computers and Action History. Click the Description tab to view the text describing this Fixlet. Typically, you see a report on the security issue. You can evaluate the importance of this compliance issue before you take action. Depending on the issue, the description tab could offer a procedure for maintaining compliance or a list of active remediations found in the Actions box. To deploy a remediation, click the applicable link. Select a Fixlet Action to adjust a deployment in the Take Action dialog. For more information on the Take Action dialog, see the BigFix Console Operator s Guide. Once you have targeted your desired set, click OK and enter your Private Key Password. This sends the Action to the appropriate endpoints. As the computers are remediated, you can watch the progress using any of the reporting tools contained in the BigFix Console, including the Fixlet list, Visualization Tools, Web Reports and Dashboards. When every endpoint in your enterprise is remediated, this control is no longer relevant and is not displayed in the list of relevant Fixlets. Although the Fixlets are no longer be listed, they continue checking for computers that deviate from the specified level of compliance. Modifying control parameters In addition to monitoring and remediating, you can modify certain parameters to adjust the sensitivity of the controls. For example, you might want to observe a policy of using 14-character passwords. You can customize the password-length parameter to your specific policy. Although parameters can be modified on both UNIX and Windows content, there are some differences in how this is implemented. UNIX content is aimed at users who want maximum command-line control. Setup Guide 11

16 The SCM checklists for Windows systems use BigFix Tasks to enable alteration of the parameters for each configuration setting. For each Fixlet control parameter, there is an associated Task that sets the parameter. To run the Task, scroll to the bottom of the Fixlet description and click the Control Parameterization link. The associated Control Parameterization Task opens with a description of the parameter function, the possible range, and the recommended values. Click in the Actions box to remediate the policy issue. 12 SCM

17 To deploy the new setting that guides the associated Fixlet control, click OK and enter your password. Once set, the Fixlet is only relevant on those computers and devices that do not meet this new threshold. Thus, you can modify the Windows content to suit the needs of each detail of your security policy. Note: Not all controls can be parameterized. For nformation on parameterization for the UNIX platforms, see the AIX, Linux and Solaris parameterization guides available on the BigFix support site. Disabling controls You can disable certain controls on a computer-by-computer basis. For example, you might have legacy computers or development workstations that have custom security policies. To remove them from the security scan, you can disable the control for those specific devices. Again, this procedure is different on UNIX and Windows systems. To disable a Windows control, follow the procedure in the previous section to access the Task associated with the Fixlet control. In the Task, you see an action to enable/disable the control. Click this link to access the Take Action dialog and target the set of computers that you want to exclude from evaluation. To deploy this action, click OK and supply your password. The selected computers are displayed as compliant within the Dashboards and Reports and, therefore, no longer evaluate the control. Setup Guide 13

18 Remediating out-of-compliance controls If an endpoint is out of compliance with a policy, it appears in the console as a relevant Fixlet. Depending on the issue, it might offer to remediate the problem, typically by modifying or updating a file or the Windows registry entry. Click the Fixlet to review the specific issue and scroll to the bottom of the description. To initiate the remediation process, click the link in the Actions box. Accessing the Control Dashboard and Reporting The SCM solution includes a graphical dashboard that provides an overview of your security posture and its details. The charts can be customized to focus on any subset of your deployment. These custom reports can be saved, so that you can quickly revisit any subset of your enterprise. Since the information for the dashboard is generated at the endpoints and sent back through an intelligent relay system, you can view it in real time. Note: Load the he SCM masthead into the console. Select SCM Dashboard located at the top of the navigation tree. 14 SCM

19 When the Dashboard opens, click Create New Report on the right side of the window and supply a name. After information from your endpoints is gathered, the Dashboard creates its display. You see a Filter Panel on the left side of the work area to control how data displays in the charts. Experiment with the controls and watch how the associated graphs change. Hover over the graphs to see specific information on each segment. Click a graph to see more information. To save your report, click on the disk icon in the upper right. Setup Guide 15

20 16 SCM

21 The icons on the top right of the work area enable you to save, print, or refresh the Console. BigFix also offers a Web Reports application to view aspects of your deployment. For more information about Web Reports, see the BigFix Web Reports Guide. Setup Guide 17

22 18 SCM

23 Part Three Support Technical support BigFix technical support site offers a number of specialized support options to help you learn, understand, and optimize your use of this product: BigFix Support Site Documentation Knowledge Base Forums and Communities Setup Guide 19

24 20 SCM

25 Part Four Notices IBM may not offer the products, services, or features discussed in this document in other countries. Consult your local IBM representative for information on the products and services currently available in your area. Any reference to an IBM product, program, or service is not intended to state or imply that only that IBM product, program, or service may be used. Any functionally equivalent product, program, or service that does not infringe any IBM intellectual property right may be used instead. However, it is the user's responsibility to evaluate and verify the operation of any non-ibm product, program, or service. IBM may have patents or pending patent applications covering subject matter described in this document. The furnishing of this document does not grant you any license to these patents. You can send license inquiries, in writing, to: IBM Director of Licensing IBM Corporation North Castle Drive Armonk, NY U.S.A. For license inquiries regarding double-byte (DBCS) information, contact the IBM Intellectual Property Department in your country or send inquiries, in writing, to: Intellectual Property Licensing Legal and Intellectual Property Law IBM Japan Ltd , Shimotsuruma, Yamato-shi Kanagawa Japan The following paragraph does not apply to the United Kingdom or any other country where such provisions are inconsistent with local law: INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement may not apply to you. This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice. Any references in this information to non-ibm Web sites are provided for convenience only and do not in any manner serve as an endorsement of those Web sites. The materials at those Web sites are not part of the materials for this IBM product and use of those Web sites is at your own risk. IBM may use or distribute any of the information you supply in any way it believes appropriate without incurring any obligation to you Setup Guide 21

26 Licensees of this program who wish to have information about it for the purpose of enabling: (i) the exchange of information between independently created programs and other programs (including this one) and (ii) the mutual use of the information which has been exchanged, should contact: IBM Corporation 2Z4A/ Burnet Road Austin, TX U.S.A. Such information may be available, subject to appropriate terms and conditions, including in some cases payment of a fee. The licensed program described in this document and all licensed material available for it are provided by IBM under terms of the IBM Customer Agreement, IBM International Program License Agreement or any equivalent agreement between us. Information concerning non-ibm products was obtained from the suppliers of those products, their published announcements or other publicly available sources. IBM has not tested those products and cannot confirm the accuracy of performance, compatibility or any other claims related to non- IBM products. Questions on the capabilities of non-ibm products should be addressed to the suppliers of those products. COPYRIGHT LICENSE: This information contains sample application programs in source language, which illustrate programming techniques on various operating platforms. You may copy, modify, and distribute these sample programs in any form without payment to IBM, for the purposes of developing, using, marketing or distributing application programs conforming to the application programming interface for the operating platform for which the sample programs are written. These examples have not been thoroughly tested under all conditions. IBM, therefore, cannot guarantee or imply reliability, serviceability, or function of these programs. The sample programs are provided "AS IS", without warranty of any kind. IBM shall not be liable for any damages arising out of your use of the sample programs. TRADEMARKS: IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corporation in the United States, other countries, or both. If these and other IBM trademarked terms are marked on their first occurrence in this information with a trademark symbol ( or ), these symbols indicate U.S. registered or common law trademarks owned by IBM at the time this information was published. Such trademarks may also be registered or common law trademarks in other countries. A current list of IBM trademarks is available on the Web at "Copyright and trademark information" at Adobe, the Adobe logo, PostScript, and the PostScript logo are either registered trademarks or trademarks of Adobe Systems Incorporated in the United States, and/or other countries. 22 SCM

27 Java and all Java-based trademarks and logos are trademarks or registered trademarks of Oracle and/or its affiliates. Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries, or both. Linux is a registered trademark of Linus Torvalds in the United States, other countries, or both. UNIX is a registered trademark of The Open Group in the United States and other countries. Other company, product, and service names may be trademarks or service marks of others. Setup Guide 23