Enterprise Random Password Manager Training Guide

Transcription

1 Enterprise Random Password Manager Training Guide Draft Published: January 11, 2011 Updated: February 9, 2011 Summary This guide provides an overview of Enterprise Random Password Manager (ERPM) by Lieberman Software Corporation

2 Enterprise Random Password Manager Training Guide 2 Contents About This Guide... 4 ERPM Overview... 4 ERPM Capabilities... 5 What s New in ERPM ?... 6 Guided Tour ERPM Database... 6 Database Overview... 6 Database Encryption Selecting Target Systems to Manage... 8 Creating a Management Set... 9 Activating a Management Set... 9 Configuring a Management Set Viewing and Managing Systems and Accounts Exploring the Windows Systems View Exploring the Windows Accounts View Exploring the Account Store View Changing Passwords Password Access and Recovery Configuring Access Rules Configuring Web Application Workflows Recovering Passwords Admin Tools Auditing and Compliance Reporting Reporting Data Warehouse Auditing Reports Compliance Reports Personal and Shared File Store Wide-Area and DMZ Network Support Third-Party Integrations Event Sinks Microsoft SCOM Integration Microsoft SCSM Integration... 43

3 Enterprise Random Password Manager Training Guide 3 ArcSight Integration BMC Remedy Integration SDK Integration For More Information Appendix What Are Privileged Identities? How Does Privileged Access Spread? Risks of Unsecured Privileged Identities... 50

4 Enterprise Random Password Manager Training Guide 4 About This Guide This document is intended to guide you through administration and use of Enterprise Random Password Manager (ERPM). Note: sections that display this icon are important technical notes. Sections that are marked with this icon describe notable product features. ERPM Overview Enterprise Random Password Manager (ERPM) discovers, updates, stores, and allows secure recovery of every local, domain, and process account in an organization. It detects and reports every location where privileged accounts are used, including: Local and domain accounts Configured services and scheduled tasks Applications including COM+ and DCOM IIS websites Databases such as SQL Server, Oracle, Sybase, DB2, and MySQL ERPM rapidly propagates password changes everywhere that each account is referenced in order to prevent account lockouts and service failures that can occur when manual processes create obsolete credentials. ERPM secures its passwords in an encrypted database that can be accessed from any web-enabled device or browser. Users check out privileged account passwords through an automated process that takes advantage an organization's existing identity access management framework to allow expedited, delegated access. Passwords are automatically re-randomized after check-in, and restricted recovery periods, forced check-ins, periodic verifications, web session timeouts, and phonetic spelling options are provided. ERPM has a 3-tier architecture that consists of: An MS-SQL 2000 or Oracle 11g database for privileged credentials and program data. A management console that resides on a 32- or 64-bit version of Windows Server 2003 or An IIS 6.0 or later web server that allows remote recovery of password by authorized personnel.

5 Enterprise Random Password Manager Training Guide 5 Note: Because ERPM manages sensitive information, in a production deployment host and application security settings should be configured appropriately and encryption protocols such as SSL should be enabled based on the scope of access provided. ERPM Capabilities Key ERPM capabilities include: Continuous auto-discovery of privileged accounts throughout the infrastructure, on a wide range of server and desktop operating systems; on databases including SQL Server, Oracle, Sybase, and DB2; on Web services platforms, line-of-business applications, network and security appliances, backup systems, and more. A guided tour of auto-discovery is provided in Creating a Dynamic Management Set. Encrypted, highly-available password storage that generates each new password according to configured rules for complexity, uniqueness (to avoid reuse as much as possible), and change frequency. Passwords are stored in an industrystandard AES-256 encrypted MS-SQL or Oracle database. A tour of database features is provided in ERPM Database. Reliable password propagation made possible by ERPM discovery, propagation and customization features prevents the service disruptions and system lockouts that can occur with manual password change processes. A tour of propagation features is provided in the Changing Passwords section. Secure, audited password recovery that is role-based and time-controlled so that passwords expire and are changed after a configured period. Password requests are audited and alert-generating so that there s full accountability; and support is provided for industry-standard, two-factor authentication including RSA

6 Enterprise Random Password Manager Training Guide 6 SecurID. A guided tour of password recovery rules and recovery workflows is provided in Password Access and Recovery. Comprehensive Auditing and Compliance reporting that provides formatted, customizable reports of password requests, checkout and check in operations, delegation changes, and ERPM operational events. A tour of reporting features is provided in the Auditing and Compliance Reporting section. Third-party integration made possible by the ERPM Event Sink feature and a flexible SDK for third-party software integration that is provided free of charge. A tour of integration features is provided in the Third-Party Integration section. What s New in ERPM ? ERPM provides new management, configuration and discovery options compared to previous versions. Highlights include: Third-Party Application Support: adds integration with Microsoft System Center Service Manager, Q1 Labs QRadar, and third-party Privileged User Management (PUM) solutions. Account Properties: adds Account Properties context information for Linux, Microsoft SQL database, Sybase, and Oracle accounts. Database Management: adds multi-instance and multi-system password change job capabilities for Microsoft SQL, Oracle, Sybase, and MySQL databases; adds dynamic port connectivity for Microsoft SQL. Lights-Out Management Card Support: adds auto-discovery of IPMI-compliant devices and accounts and management of IPMI devices. Help Desk Integration: adds Web app ticket number verification for BMC Remedy & Microsoft SCSM. Safeguards for Web Access: added options for enhanced ERPM Web application security. Guided Tour This guided tour is intended to familiarize you with the features of Enterprise Random Password Manager. 1. ERPM Database Database Overview ERPM gives you the choice to store account credentials and application settings on a Microsoft SQL Server or Oracle 11g database.

7 Enterprise Random Password Manager Training Guide 7 Because ERPM takes advantage of an industry-standard Microsoft SQL Server or Oracle database, you're assured of proven, documented high-availably and recovery options; an established community of DBAs with knowledge to support the system; and the ability to leverage your existing infrastructure, personnel and monitoring framework for a more efficient, transparent solution. To view ERPM database settings: In the ERPM Settings menu, under Data Store Configuration, click Basic Configuration. This action opens the Database Data Store Configuration window. In the Database Data Store Configuration window you verify and change basic database settings, including provider (MS-SQL or Oracle), database communication encryption settings, connection limits and other parameters. Click OK to close the Database Data Store Configuration window. Database Encryption Because privileged account credentials grant access to sensitive data and configuration settings, it is recommended that you enable encryption for the ERPM data store. To view ERPM data store encryption settings: In the Settings menu, click Encryption Settings. This action opens the Encryption Settings window.

8 Enterprise Random Password Manager Training Guide 8 In the Encryption Settings window you verify and change encryption settings, test encryption keys, and configure third-party software and hardware encryption options. Click OK to close the Encryption Settings window. 2. Selecting Target Systems to Manage ERPM organizes information about systems and accounts it manages using Management Sets. Management Sets allows you to organize auto-discovery, password recovery, and other settings in a way that corresponds to the physical infrastructure and personnel roles of your organization to streamline your management tasks. For example, you can organize Management Sets according to the physical locations of systems; or, according to the roles of personnel who have access to different types of systems; or in any combination. Note: because ERPM grants users and groups the authority to recover passwords from systems according to their Management Set membership, consider the structure of your organization and personnel roles carefully before you create Management Sets and assign systems to them. For production deployments Professional Services are available to help ensure that Management Sets and other features are configured for efficient and secure management of your environment.

9 Enterprise Random Password Manager Training Guide 9 Creating a Management Set The preferred approach is to configure ERPM using dynamic Management Sets that are updated automatically through LDAP queries, database queries, scanned IP address ranges, and other criteria that you define. ERPM can be configured to scan these criteria at configured intervals, to add and remove systems from each Management Set accordingly, and to update the scheduled jobs associated with each Management Set. ERPM can automatically discover and manage new and changed accounts that appear whenever systems and applications are deployed, changed or removed. In doing so, ERPM can augment your organization's security by helping you prevent the spread of unsecured privileged accounts. To create a Management Set: On the SystemsList menu click Manage System Sets. In the Manage Management Sets window click Add Management Set. Type Demo Management Set and click OK. Activating a Management Set You must activate a Management Set before you can perform mass management actions on its members. In the following sections we will explore systems that are members of the selected Management Set. To activate a Management Set:

10 Enterprise Random Password Manager Training Guide 10 In the Manage Management Sets list select the Management Set and click Activate Management Set. Note: the name of the active Management Set and view appear in the ERPM title bar. Configuring a Management Set In the Edit Group Properties window you can build dynamic lists of systems in the active Management Set by entering domains, IP address ranges, Active Directory paths, LDAP sources, systems lists and other criteria. From the SystemsList menu click Edit Current Systems Set Properties. On the Domains tab, click the New button. You can type the name of a domain or click the Browse button to browse for a domain.

11 Enterprise Random Password Manager Training Guide 11 Click Cancel to close the Select Domain box. Click the Options tab of the Edit System Set Properties window. Ensure that all checkboxes are checked. Note: the Options tab configures ERPM to add and delete members of the active Management Set on a schedule that you define, according to the criteria you specify in the other tabs. Click the Active Directory Paths tab and in Add All Systems Under These AD Paths click the New button to open the Edit Active Directory Path window. In the Edit Active Directory Paths window, click the Browse button to demonstrate how you can add systems according to Active Directory container.

12 Enterprise Random Password Manager Training Guide 12 Click Cancel to close the Select Container window and then click Cancel to close the Edit Active Directory Path window. The Edit System Set Properties window provides other features to configure automatic Management Set membership updates. To explore the range of filtering options available to automatically add or exclude members of the Management Set: Click the Filter Options tab. Notice that you can configure systems by a filter matching pattern, and include or exclude systems by operating system and system type. Click Cancel to close the Edit System Set Properties window. In the following section described mass management actions that you can take on the members of the active Management Set.

13 Enterprise Random Password Manager Training Guide Viewing and Managing Systems and Accounts Exploring the Windows Systems View The Windows Systems View displays the windows computers in the active Management Set. In this view you can perform mass management actions on the Windows computers that you select. To open the Windows Systems View, in the ERPM View menu click Windows Systems View. Click any system in the Main Panel and click Ctrl-A to select all of the computers. Choose Refresh System Information in the context menu that appears when you right-click. Click OK to close the Job Status window that appears when the refresh is done. An updated Windows System list will appear in the Main Panel. Note: in the Windows Systems View you can perform other mass management actions by selecting one or more systems and choosing an action from the context menu that appears when you right-click.

14 Enterprise Random Password Manager Training Guide 14 Exploring the Windows Accounts View For each account in the active Management Set the Windows Accounts View shows the physical system where the account resides, the number of instances of the account in use, the password age, the last login, last managed change, and other information. To open the Windows Accounts View, in the ERPM View menu click Windows Accounts View. Select all accounts by clicking any account in the main panel and then pressing Ctrl-A. Right-click to view the available mass management options. Note: you can change passwords, enable, disable, and delete accounts, and perform other mass management actions by right-clicking the selected accounts and choosing the action from the context menu. Exploring the Account Store View The Account Store View displays the accounts in the active Management Set in a tree view that is organized by host device and application. To open the Account Store View, in the View menu click Account Store View. In the Main View Panel, click the Windows Systems node to expand it. The Windows systems in the current Management Set appear in this node.

15 Enterprise Random Password Manager Training Guide 15 Continue to expand the nodes in a system to view details about all privileged accounts discovered on the system. The Accounts Store view gives you a fast, flexible way to explore privileged accounts on your network. You can expand any system's node to see the accounts, services, tasks, COM+ and DCOM applications, and IIS accounts that are present. Select one or more computers in the expanded Windows System node and rightclick to view the available mass management actions that you can take. Note: you can view additional types of accounts by activating a Management Set containing the accounts. Mass management actions including password changes, moving systems to other Management Sets, and opening remote connections appear in the context menu.

16 Enterprise Random Password Manager Training Guide 16 Note: You can expand the other nodes to view other types of computers, applications and network devices in the active Management Set. Managing Linux/UNIX Accounts To manage Linux/UNIX accounts in the Account Store view: In the SystemsList menu click Manage System Sets. Under Management Set Name click a Management Set containing one or more Linux/UNIX computers and then click Activate Management Set. In the Account Store View window expand the Linux/Unix Systems node and sub nodes until an account name is visible. You can choose Change Password or Account Properties from the context menu that appears when you right-click a Linux or UNIX account. Managing Database Accounts To manage database accounts in the Account Store view: In the SystemsList menu click Manage System Sets. Under Management Set Name click a Management Set containing one or more systems hosting a supported database and then click Activate Management Set. In the Account Store View window expand the SQL Server Instances, Oracle Databases, Sybase ASE Databases, or MySQL Database Instances node and sub nodes until a database account name is visible. You can choose Change Password or Account Properties from the context menu that appears when you right-click a database account. Managing Microsoft Office SharePoint Server (MOSS) Accounts To manage Microsoft Office SharePoint Server (MOSS) accounts in the Account Store view: In the SystemsList menu click Manage System Sets. Under Management Set Name click a Management Set that includes one or more MOSS hosts and then click Activate Management Set. In the Account Store View window expand the Windows Systems node, the sub node of a system hosting MOSS accounts, and the Sharepoint sub node until Sharepoint accounts are visible. You can choose Change Password or Account Properties from the context menu that appears when you right-click a SharePoint account.

17 Enterprise Random Password Manager Training Guide 17 Managing Windows Services To manage Microsoft Windows Services accounts in the Account Store view: In the SystemsList menu click Manage System Sets. Under Management Set Name click a Management Set containing one or more computers hosting Windows services and then click Activate Management Set. In the Account Store View window expand the Windows Systems node and the sub node of a system hosting Windows services. Expand the Windows Services sub node. You can choose Push Account Credentials to Item from the context menu that appears when you right-click a Windows services account. Managing Windows Tasks To manage Microsoft Windows Services accounts in the Account Store view: In the SystemsList menu click Manage System Sets. Under Management Set Name click a Management Set containing one or more computers with configured Windows tasks then click Activate Management Set. In the Account Store View window expand the Windows Systems node and the sub node of a system hosting Windows tasks. Expand the Tasks sub node. You can choose Push Account Credentials to Item from the context menu that appears when you right-click a tasks account.

18 Enterprise Random Password Manager Training Guide 18 Managing Windows COM+ Applications To manage Windows COM+ application accounts in the Account Store view: In the SystemsList menu click Manage System Sets. Under Management Set Name click a Management Set containing one or more computers hosting COM+ applications and then click Activate Management Set. In the Account Store View window expand the Windows Systems node and the sub node of a system hosting a COM+ application. Expand the COM+ Applications sub node. You can choose Push Account Credentials to Item from the context menu that appears when you right-click a COM+ application account. Managing IIS Accounts To manage Windows COM+ application accounts in the Account Store view: In the SystemsList menu click Manage System Sets. Under Management Set Name click a Management Set containing one or more systems hosting IIS and then click Activate Management Set. In the Account Store View window expand the Windows Systems node and the sub node of a system hosting IIS accounts. Expand one of the system s IIS sub nodes. You can choose Push Account Credentials to Item from the context menu that appears when you right-click an IIS account. 4. Changing Passwords Changing passwords starts with selecting the target systems and then selecting the scope of propagation for the password change job. To change passwords on systems that you select: In the View menu click Windows Systems View. In the main panel, select one or more computers and click the Change Passwords button in the left-hand panel. This action opens the Change Password Type window.

19 Enterprise Random Password Manager Training Guide 19 The Password Change Type window shows different password change options available for the selected. ERPM can change passwords present in Windows accounts, SQL Server, Sybase ASE, MySQL, Oracle, Linux/OSX, Unix, Cisco routers, AS/400 and OS/390 systems. Click Windows Account to open the Create New Job window. Click the Password Settings tab to view the available password settings for the password change job. In this window you can configure password length, complexity, and other settings.

20 Enterprise Random Password Manager Training Guide 20 Note: the recommended practice is to choose Random password on the Password Settings tab to prevent unaudited access and reuse of privileged account credentials. To see an example of a password generated with the settings you select click Generate Example. Click the Propagation Settings tab to view the list of credential types that are configured for the current job. Click Add New to open a wizard that guides you through adding new propagation types including Windows service credentials, COM+ and DCOM identities, IIS accounts, SCOM Run As credentials,.net Config files, SharePoint credentials, and others. Click Cancel to close the wizard and return to the Create New Job window. Note: you can create custom account types using an SDK that is available at no extra cost. For further details are provided in the Third Party Integration section. Click the Schedule tab to view password job schedule options.

21 Enterprise Random Password Manager Training Guide 21 On the Schedule tab you can configure precise scheduling options for the password change job. Click the Propagation Scope tab to view the settings for the current job. You can clear the Propagate only to system that account is changed on box to propagate the password change to dependent accounts in other Management Sets. Note: by configuring propagation settings you can update the passwords of dependent accounts during the password change job. The ERPM propagation feature eliminates service disruptions and system lockouts that could occur if manual password change processes cause applications to access obsolete credentials. Click the Schedule tab. In the Job Scheduling Period box choose Immediately and then click OK to start the password change job. This action opens an Active Threads Status window while the job is in process.

22 Enterprise Random Password Manager Training Guide 22 When the password change job is finished an Operation window opens with a job status summary. Click OK to close the window. During the password change job ERPM generates passwords according to your settings. The passwords are encrypted so that no clear text values are stored in the ERPM database or sent over the network.

23 Enterprise Random Password Manager Training Guide 23 ERPM's continuous auto-discovery and propagation features ensure that password changes are propagated to all locations where a password is referenced. This keeps interdependent systems and applications in synch and prevents application lock-outs and service disruptions. Note: you can also change passwords on accounts that you select in the Windows Accounts View and the Account Store View. 5. Password Access and Recovery Configuring Access Rules ERPM grants access to privileged account passwords through an SSL-encrypted web interface. In the Web Application Delegation window you can configure how different users and groups interact with the web application. For example, for each role you can configure access to Management Sets and actions such as password recovery and delegation, views and reporting, and notification. Begin by confirming the configuration of a user who is permitted to request passwords with the approval of an administrator, to connect by Remote Desktop, and to view accounts. To open the Web Application Delegation window: In the Settings menu, under Delegation, click Web Application Global Delegation Rules to open the Web Application Global Delegation Rules window.

24 Enterprise Random Password Manager Training Guide 24 In the Enrolled Identities pane click Administrator User. In the Settings for Identity group, confirm that Logon and Grant All Access are checked. Note: an identity with Grant All Access checked can access all Management Sets regardless of whether they appear in the Delegated System Sets For Identity window. An Explicit Identity offers a convenient way to configure access by vendors, contractors, and other personnel who may not have domain account credentials. In the Web Application Delegation window you can also configure alerting on password requests and recoveries by group or by account. This feature helps ensure that prompt action is taken on selected requests or recoveries. Note: delegation roles configured by Windows Domain Group, Windows Domain User, and Role-Based Mapping are dynamic and reflect current group memberships. This ensures that ERPM will continue to provide the correct level of access whenever personnel roles change. Click OK to close the Web Application Delegation window. Configuring Web Application Workflows You can specify how users interact with the ERPM web application by opening the Web Application Setting Window. In the ERPM Settings menu, under Manage Web Application, click Manage Web Application Instances. In the Manage Web Application Instances window, click the web application instance that is visible in the main panel.

25 Enterprise Random Password Manager Training Guide 25 From the Options menu, click Configure default web application options. This action opens the Web Application Settings window. In the App Options tab you can configure rules for password auto-spin, self recovery, authentication including RSA SecurID, password display, and other options. Click the Password Access tab.

26 Enterprise Random Password Manager Training Guide 26 In the Password Access tab you can configure whether to require recovery comments and ticket numbers, check-in comments, password logging options, checkout and extension duration, and other options. You can optionally configure file store settings by clicking the File Store Settings tab or configure account elevation settings by clicking the Account Elevation tab. Privileged User Management Integration ERPM integrates with third-party Privileged User Management (PUM) products to provide access controls that allow users to perform actions as elevated accounts on target Linux/UNIX systems. The third-party PUM system acts as a command proxy that can log all actions taken through this process. When PUM integration is enabled authorized users can choose the Linux/UNIX systems they want to manage, issue commands and monitor the responses through the ERPM interface. To configure PUM integration: Click the Privileged User Management tab. You can configure PUM integration support by entering the PUM Gateway Server, Gateway User, and response configuration file path for PUM operations.

27 Enterprise Random Password Manager Training Guide 27 Click OK to close the Web Application Settings window and then click Close to close the Manage Web Application Instances window. Recovering Passwords To recover passwords, open the ERPM web application interface. Open the ERPM web application window in Internet Explorer; this is typically configured as an ERPM Web Site icon on your desktop. In the Authenticator box enter your login credentials and click Login.

28 Enterprise Random Password Manager Training Guide 28 Click the Passwords link. This action opens the Passwords Recover page. I Click the Recover Password link for one of the systems in the list. This action opens a Password Recovery Comment screen. Note: if your account was configured in the Web Application Delegation window to Allow RDP from Web, you can also click the Open Terminal Services open a terminal services session with the selected system. link to The Open Terminal Services feature can be used to grant temporary access to contractors, vendors, and other outside personnel since the RDP login occurs without the requestor viewing the password. Type a comment in the text box and click Recover. This action opens the Recovered Password page. Notice that this page displays a complex, random password as configured in the Changing Passwords section above, and the password will be changed within a configured time limit.

29 Enterprise Random Password Manager Training Guide 29 Note: to configure the password checkout time limit, allowable number of extensions, whether comments are required, and other password recovery options, in the ERPM Settings menu, in the Manage Web Application group, click Manage Web Application Instances. In the Options menu click Configure default web application options. ERPM ensures that privileged passwords are unknown until each audited check-out request and can't be shared or re-used following expiration. ERPM improves staff efficiency by eliminating manual approval processes, and reduces the potential for privileged passwords being used by malicious programs and unauthorized personnel. Admin Tools If you are logged into the ERPM web interface with an account that is configured in the Web Application Delegation window to Grant All Access, an Admin Tools link will be visible under Site Navigation. Click Admin Tools to open the Admin Tools Site Settings page.

30 Enterprise Random Password Manager Training Guide 30 The Admin Tools Site Settings page shows ERPM web application configuration details. Click Live Activity to open the Admin Tools Live Activity page. On this page a user with an account that is configured in the Web Application Delegation window to Grant All Access can force a check in of any checked out passwords by clicking Force Check In.

31 Enterprise Random Password Manager Training Guide Auditing and Compliance Reporting ERPM provides two main categories of reports. Auditing Reports provide information about ERPM web application user activity. Examples include: Password Request reports Password Check in and Checkout reports File Store Operation reports Delegation Change reports Compliance Reports provide information about the activities of the ERPM application as a whole. Examples include: All Systems reports showing all systems managed by ERPM All Stored Passwords reports showing the status of all stored passwords All Jobs report showing all ERPM file change operations Single User Audit reports showing all ERPM interaction by a selected user Single Account Audit report showing all ERPM application and user activity for a selected account Single System Audit reports showing all ERPM application and user activity for a selected system Reporting Data Warehouse ERPM stores data for auditing and compliance reports in a data store called the Reporting Database that is separate from the primary data store. The use of a separate data warehouse ensures that even complex queries run efficiently, with a minimum of impact on other ERPM processes. A separate ERPM Reporting Database assures responsive compliance and activity audit reporting even in the largest and most complex network environments. To view Reporting Database settings: In the ERPM Actions panel click Compliance. In the Compliance window Database menu click Change Reporting Database. This action opens the Database Data Store Configuration window.

32 Enterprise Random Password Manager Training Guide 32 In the Database Data Store Configuration window you can choose SQL Server or Oracle database provider, set connection limits, and enter other configuration settings for the Reporting Database. The ERPM data warehouse is compatible with business intelligence reporting tools such as Crystal Reports, SQL Server Reporting Services, and others. This allows you to create fully customizable business reports that are based on ERPM Auditing and Compliance data. Auditing Reports Auditing reports provide information about users' interaction with the ERPM web application. To open the Auditing report feature: Login to the ERPM Web Application by double-clicking the desktop icon and entering the credentials provided by Lieberman Software. Click the Auditing link.

33 Enterprise Random Password Manager Training Guide 33 This action opens the Auditing Activity Log page with the default All Operations view. Operations that can be reported by clicking the Operation box in the Auditing Activity Log page include: Logon Logoff Delegation Change Password Add/Change/Delete Password Checkout Password Check in Password Requests

34 Enterprise Random Password Manager Training Guide 34 Password Request Grant File Store Operation File Access Request File Access Request Grant Web application error A few of the available reports are described below. Password Request Report The Password Request report shows all password request activity. You can filter reports by day and time, system / account, and manager. You can also sort the report by clicking on a column heading. To create a Password Request report: In the Operation box click Password Requests and then click Refresh. The report shows the Manager name, System and Account, Description with comments, the user IP address, time and result. Password Checkout Report The Password Checkout report shows all password checkout activity. You can filter reports by day and time, system / account, and manager. You can also sort the report by clicking on a column heading. To create a Password Checkout report: In the Operation box click Password Checkout and then click Refresh.

35 Enterprise Random Password Manager Training Guide 35 The report shows the Manager name, Account, Description with user comments, the user IP address, time and result. Delegation Change Report The Delegation Change report shows changes in delegation settings for all users, including the creation of new accounts and changes in group settings. To create a Delegation Change report: In the Operation box click Delegation Change and then click Refresh. The report shows the Manager name, Account, Description with user comments, the user IP address, time and result.

36 Enterprise Random Password Manager Training Guide 36 The Auditing Activity Log page allows you to quickly create reports of password and file store activity, delegation changes, and web application activity. You can filter by time, system or account and manager, and can quickly sort views by clicking a column heading. Note: you can right-click the link at the bottom of the page to save the audit results as an Excel compatible.csv file. This feature allows you to share and view reports in third-party graphics programs. Compliance Reports Compliance Reports provide information about operations performed by the ERPM application. To access Compliance Reports: Click the Compliance link on the left-hand side of the page. This action opens the Auditing Compliance page.

37 Enterprise Random Password Manager Training Guide 37 Reports that can be accessed by clicking the Generate Report Type box include: All Systems All Stored Passwords All Jobs All Jobs Activity Last 24 Hours All Jobs Activity Last Week All Overdue Jobs All Web Access Permissions Single Account Audit Single System Audit Single User Audit The following sections provide examples of some of the available Compliance reports. All Stored Passwords Report The All Stored Passwords report can be used to show compliance with regulatory mandates, and to prove the effectiveness of the ERPM application in managing privileged account passwords. To create an All Stored Passwords report: Under Data Capture Timestamp, click the Capture Data button to create a data capture timestamp.

38 Enterprise Random Password Manager Training Guide 38 Notice that the display refreshes to reflect the presence of a new snapshot. Under Generate Report Type, select All Stored Passwords and click the Generate Report button. This action opens a new web browser window with the All Stored Passwords report. Note: to save this report, in the Internet Explorer File menu click Save As. Close the web browser window with the All Stored Passwords report. Single User Audit Report A Single User Audit report can be used to document an individual user's history of interactions with ERPM and its target systems. To create a Single User Audit Report: On the Auditing Compliance page, under Generate Report Type, click Single User Audit. When the User Name box appears, type a configured user name and then click Generate Report. This action opens a new web browser window with the audit report for the user.

39 Enterprise Random Password Manager Training Guide 39 Close the Audit Report browser window. Single System Audit Report A single system audit report provides the history of access requests to a selected system, for example, to explore activities that may have resulted in undesired system behavior. To open a Single System Audit report: On the Auditing Compliance page, under Generate Report Type, click Single System Audit. Enter a configured System Name, in the Number of days box type 30, and click Generate Report. This action opens a System Audit Report in a new browser window. Close the System Audit Report web browser window.

40 Enterprise Random Password Manager Training Guide 40 You can explore other types of compliance reports on the Auditing Compliance page including reports by account and reports of ERPM job activity. 7. Personal and Shared File Store If you are logged into the ERPM web interface with an account that is configured in the Web Application Delegation window to access the file store, a File Store link appears on the ERPM web application Main page. This feature allows you to upload, securely store, and allow delegated, audited access to files from within the ERPM web application. To add a file the File Store: On the ERPM web application Main page click File Store. On the File Store View Files page click Add File to Store. Enter the new store file name and click Browse to browse for the file. Click Upload to upload the file. This action opens the File Store View Files page with a list of uploaded files. The File Store provides a secure, audited way to store and retrieve sensitive documents and other files from within the ERPM web application.

41 Enterprise Random Password Manager Training Guide Wide-Area and DMZ Network Support The ERPM feature called Zone Processors ensures reliable propagation of account credentials in networks with high-latency WAN links and DMZs. Zone Processors can be configured to minimize WAN traffic over high-cost links, and to communicate one-way from a DMZ, through a firewall, to the ERPM database. To view Zone Processor configuration settings: In the ERPM DeferredProcessing menu click Jobs Monitor. This action opens the Stored Jobs window. Click the Zone Processors link to open the Zone Processing Services window. In the Zone Processing Service window click Install to open the Zone Processor Instance window. In this window you can install and configure Zone Processors on remote computers. Click Cancel to close the Zone Processor Instance window, click Close to close the Zone Processing Services window, and then close the Stored Jobs window.

42 Enterprise Random Password Manager Training Guide 42 Zone Processors make ERPM an ideal choice for enterprises with geographically disperse locations, high-latency and high-cost WAN links, and network DMZs. 9. Third-Party Integrations ERPM integrates with third-party applications through its Event Sink feature, and through an SDK that is provided at no additional charge. Event Sinks The ERPM Event Sink feature is used to communicate with third-party applications. Communication through log file values, Registry values, Named Pipes, Com Calls, and Event Logging is supported. Event Sinks allow you to view ERPM events in other application consoles; enable ERPM to trigger other products' help desk, trouble ticketing, and other workflows; and let you to receive and other alerts when configured ERPM events occur. To access the Event Sink Configuration window: In the ERPM Settings menu, in the Extension Components group, click Configure Event Sinks. This action opens the Event Sink Definitions window. Click the New button to open the Event Sink Configuration window. Click Filter events to only the ranges listed below to open the Select Event Sink Event Range window and then click OK. This action makes event IDs and Event Actions visible in the Recognized Events panel. Microsoft SCOM Integration The Microsoft System Center Service Manager Integration allows users to monitor the status of the ERPM application from within the SCOM interface, and to recover passwords from systems that are visible in the SCOM Computers pane. The integration is available as a Management Pack at no additional charge. If you have configured the SCOM integration you can view ERPM application health and recover system passwords from the SCOM interface: In the left-hand Monitoring pane of the SCOM interface you can expand the Lieberman Software Enterprise Random Password Manager node to view the status of the ERPM application.

43 Enterprise Random Password Manager Training Guide 43 In the left-hand Monitoring pane you can click the Computers node, select a system in the center Computers pane, and click Enterprise Random Password Manager Recover Privileged Password to recover a password. Microsoft SCSM Integration The Microsoft System Center Service Manager Integration allows users to access the privileged accounts managed by ERPM through the Microsoft System Center Service Manager interface. When enabled, ERPM verifies trouble ticket information so that only users who provide valid ticket data can retrieve passwords allowing them to access sensitive systems. ERPM does so by: Verifying that the ticket exists

44 Enterprise Random Password Manager Training Guide 44 Confirming that the ticket number is for the requested system Validating that the ticket is currently open Authenticating that the user who opened the ticket has permission to log into the ERPM/RPM console Once these criteria have been established, the trouble ticket is logged into ERPM and the privileged account password released to the requestor. The products work together to record privileged account access as part of the BMC Remedy trouble ticket life cycle. The Microsoft SCSM Integration allows users to access privileged accounts through the SCSM interface. This feature can be configured to grant privileged access only to the extent needed to resolve each IT service issue, and only if authorized through SCSM. The products work together to record privileged account access as part of the SCSM trouble ticket life cycle. To access the System Center Service Manager Configuration Settings window: In the ERPM Settings menu, in the Extension Components group, click System Center Service Manager. Note: the settings are configured for an account on an SCSM host machine. You can access the ERPM integration features by following the steps outlined below. Click Cancel to close the window.

45 Enterprise Random Password Manager Training Guide 45 Accessing the ERPM Integration in SCSM The Microsoft System Center Configuration Manager Integration allows users to request, recover, check in, and change passwords on any system selected in SCSM, and to add new ERPM accounts. To access ERPM integration features in the SCCM console: In the left-hand pane expand the Site Database node and select the All Systems node. This action makes a system list visible in the center panel. Click a system in the center pane, and in the context menu that appears when you right-click, in the Password Management group, click Recover Privileged Password. Enter your login credentials when prompted. This action opens the ERPM window.

46 Enterprise Random Password Manager Training Guide 46 In the ERPM window you can request, recover, check in, and change passwords on any system you select in SCSM; you can also add new ERPM accounts. Note: you can perform any of these operations, and verify them by accessing the selected computer. ArcSight Integration The ArcSight Integration makes ERPM operations including console, password, Web Application, file store, and scheduler service events visible from within the ArcSight ESM application. If you have configured this integration you can view ERPM events in the ArcSight monitor web application window.

47 Enterprise Random Password Manager Training Guide 47 In the ArcSight Logger web application you can view ERPM event and configuration information. BMC Remedy Integration The BMC Remedy Integration allows users to access the privileged accounts managed by ERPM through the BMC Remedy interface. When enabled, ERPM verifies trouble ticket information so that only users who provide valid ticket data can retrieve passwords allowing them to access sensitive systems. ERPM does so by: Verifying that the ticket exists Confirming that the ticket number is for the requested system Validating that the ticket is currently open Authenticating that the user who opened the ticket has permission to log into the ERPM/RPM console Once these criteria have been established, the trouble ticket is logged into ERPM and the privileged account password released to the requestor. The products work together to record privileged account access as part of the BMC Remedy trouble ticket life cycle. The BMC Remedy Integration allows users to access privileged accounts through the BMC Remedy interface. This feature can be configured to grant privileged access only to the extent needed to resolve each IT service issue, and only if authorized through BMC Remedy. The products work together to record privileged account access as part of the BMC Remedy trouble ticket life cycle. To access the BMC Remedy Configuration Settings window: In the ERPM Settings menu, in the Extension Components group, click BMC Remedy.

48 Enterprise Random Password Manager Training Guide 48 Note: in the BMC Remedy Configure Settings window you can configure ERPM to access the BMC remote API for integration with the trouble ticketing system. Refer to the "BMC Remedy" section of the Enterprise Random Password Manager Admin Guide for further information. SDK Integration A Client Agent SDK is provided that allows other programs to access the password store on the ERPM web application and, if configured, on local systems. If ERPM has been configured to push encrypted passwords to the local system Registry, programs can use the SDK to access passwords even when the local system is offline or the ERPM web application is unreachable. The Client Agent SDK can programmatically input new passwords for accounts, add new accounts and corresponding passwords, enroll new systems and accounts, retrieve existing stored password for an account, or get the locally cached copy of a local account's current password, if enabled. Common uses for the Client Agent SDK include: Automating enrollment of new systems as part of a build process. Recovering the local Administrator password for an offline local system Replacing hard-coded passwords in ASP pages and web applications Setup instructions and example code for each use case is provided in the Integrate Using the SDK section of the Enterprise Random Password Manager Admin Guide.

49 Enterprise Random Password Manager Training Guide For More Information The following documents provide additional information about ERPM. Enterprise Random Password Manager Installation Guide Enterprise Random Password Manager Admin Guide You can also visit or call (USA and Canada) or (International). 11. Appendix What Are Privileged Identities? Privileged identities are accounts that hold elevated permission to access files, run programs, and change configuration settings. Privileged identities exist in many places in IT; they are found on server and desktop operating systems, on network devices such as routers, switches, and security appliances, and in programs and services including databases, line-of-business applications, Web services, backup software, scheduled tasks, and others. The Identity Access Management (IAM) technologies that are present in virtually all IT environments are designed to provision and de-provision users, manage normal user login activity, and may grant single sign-on to multiple systems and applications. However, in general these technologies don't detect or secure privileged identities. How Does Privileged Access Spread? Absent sufficient controls, access to an organization's privileged accounts spreads over time in both planned and unintended ways. This happens as: Companies fail to change pre-configured logins and service accounts (whether documented or undocumented) that are introduced as they deploy new hardware, networking appliances, backup systems and monitoring appliances. New applications are installed that contain both documented login and service accounts and undocumented backdoors. Companies delegate administrative duties across overlapping functional teams, change roles of administrative personnel, and contract these duties to outside parties. Organizations fail to revoke all privileged accounts accessed by an employee after his job role changes or his employment ends.