HP Helion CloudSystem Enterprise Security

Transcription

1 Technical white paper HP Helion CloudSystem Enterprise Security HP Application Defender Service Design and Deployment Table of contents Executive summary... 3 HP Helion CloudSystem Enterprise overview... 3 Essential cloud management capabilities... 3 Advanced usability features... 3 Business-friendly economics... 4 HP Fortify overview... 4 HP WebInspect... 4 HP Fortify Static Code Analyzer... 4 HP Fortify Software Security Center... 5 HP Fortify on Demand... 5 HP Application Defender... 5 Background assumptions... 6 Overview: HP Application Defender solution for CloudSystem... 6 HP Cloud Service Automation and VMware vsphere... 6 Configuration process steps... 7 Configuring HP Helion CloudSystem Enterprise... 7 Creating the virtual machine image required for Java Application with HP Application Defender deployment... 7 Staging the required software packages and files... 8 Importing software and creating HP Server Automation policies... 8 Configure Cloud Service Automation vcenter and SA Providers... 9 Creating the HP Application Defender vcenter Topology Service Design Publish and create the service offering Creating and using the application service Creating a subscription in HP Cloud Service Automation Accessing the subscribed Java Application with HP Application Defender Service Application Defender administration portal Returning the resource Monitoring and troubleshooting a deployment Click here to verify the latest version of this document

2 Summary Appendix A: Creating a CloudSystem Template with the HP SA Agent Appendix B: Staging the required software packages and files Appendix C: Software packages and policies Appendix D: Monitoring and troubleshooting a deployment Appendix E: Scripts Appendix F: Creating a Customization Specification for Linux For more information... 28

3 Executive summary As the number and complexity of enterprise applications grows the attack surface for exploits increases exponentially, leaving enterprises even more exposed. Traditional methods of protecting applications can take significant time to implement and are focused on software that is in development they don t protect applications running in production. Security must be a key component to ensure availability of the components that deliver and provision cloud-based services. This document describes how to configure HP Cloud Service Automation Service Design that comes with HP Helion CloudSystem Enterprise leveraging HP Operations Orchestration, HP Server Automation, and VMware vsphere to deploy HP Application Defender. This service allows software developers to offload resource intensive software scanning operations to a cloud based resource. Target audience: The intended audience of this white paper is system integrators, installers, and administrators who want to deploy Security-as-a-Service (SecaaS) using HP Helion CloudSystem Enterprise, HP Server Automation, and HP Cloud Service Automation. This white paper describes testing performed in November HP Helion CloudSystem Enterprise overview HP Helion CloudSystem is a complete solution for building and managing cloud services in a private- or hybrid-cloud model on and off premise, using a combination of private, managed, and public clouds. Get your cloud up and running quickly with CloudSystem, and smoothly transition to the new style of IT with automated management of traditional and cloudnative workloads. HP Helion CloudSystem Enterprise provides you: Agility. Automate the infrastructure-to-application lifecycle, and manage cloud services throughout from provisioning, to monitoring, to retirement. Powered by OpenStack technologies and enhanced by HP, it works out of the box, so you can build quickly, even with multi-hypervisor, multi-os, and heterogeneous infrastructures. Openness. Powered by a version of OpenStack technologies that have been enhanced and extended for the needs of enterprise customers, HP Helion CloudSystem works out of the box, so you can build quickly, even with multi-hypervisor, multi-os, and heterogeneous infrastructures. Security. HP Helion CloudSystem provides capabilities to make sure services and ongoing operations are secure and resilient. All products and services provide the visibility, control and governance you need across a hybrid IT environment. HP Helion CloudSystem Enterprise is offered as an HP ConvergedSystem solution pre-tested, pre-integrated, engineered, and optimized for cloud so you can spend less time getting ready for cloud, and more time building new cloud services. You can also turn your existing hardware assets into cloud infrastructure by adding CloudSystem software. Either way, HP Helion CloudSystem Enterprise gives you: Essential cloud management capabilities Automated delivery of advanced infrastructure and application services in minutes Enterprise-class lifecycle management for cloud services from initial provisioning, through ongoing scaling, updating, and monitoring, to final service retirement Hybrid cloud management, with out-of-the box support for HP Helion Public Cloud, Amazon Web Services, Microsoft Azure, and HP s global network of CloudAgile bursting partners Customizable automation of approvals, service delivery and cloud administration tasks, delivered via the HP Operations Orchestration workflow engine Optional advanced service automation through HP Helion CloudSystem Enterprise PAA (Platform, Applications and Analytics) add-on software, including automated patch and compliance management with HP Server Automation (SA) and sophisticated database and middleware management with HP Database and Middleware Automation software Integrated capacity planning and disaster recovery, delivered by HP Matrix OE software Advanced usability features Fast and easy software installation, with appliance-based packaging An administration console that aligns with HP OneView for management consistency and improved productivity across the datacenter 3

4 A drag-and-drop designer for rapidly defining new multi-tier cloud services A consumer-inspired self-service marketplace portal, powered by HP Cloud Service Automation, that makes it easy for consumers to request cloud services Business-friendly economics An open architectural foundation, based on the HP implementation of OpenStack technology, that delivers innovation and consistency across HP s cloud portfolio Open programming interfaces, including OpenStack APIs, for integrating with other systems Cloud-ready licensing, to support IT transformation at the business level Investment protection for HP Helion CloudSystem Matrix users HP Fortify overview HP Fortify helps customers reduce their security risks by offering both On-Premises and Software-as-a-Service (SaaS)- based solutions to identify, prioritize and remediate application vulnerabilities. The solutions also enable organizations to save time and resources by eliminating risks in the early stages of the application development process, when vulnerabilities are easier and less expensive to fix. HP Fortify offers On-Premises solutions (HP WebInspect, HP Fortify Static Code Analyzer, HP Fortify Software Security Center) and Software-as-a-Service (SaaS) solutions (HP Fortify on Demand, HP Application Defender). HP WebInspect HP WebInspect is an automated dynamic testing tool that mimics real-world hacking techniques and attacks, and provides comprehensive dynamic analysis of complex web applications and services. Key features: Go beyond black box testing: Integrate dynamic and runtime analysis to find more vulnerabilities and fix them faster. Optimize your testing resources. Advanced technologies, such as simultaneous crawl, bring professional-level testing to novice security testers. Easily inform management on vulnerability trending, compliance management, and ROI. Clearly communicate with development on the details and priorities of each vulnerability. Leverage prebuilt integrations for HP Application Lifecycle Management (ALM), HP Quality Center and other security testing and management systems. Start quickly and scale as needed. HP WebInspect dynamic application security testing (DAST) is available on demand or as a licensed product. Build an enterprise-wide AppSec program. WebInspect Enterprise establishes a shared service to centralize results while distributing security intelligence. HP Fortify Static Code Analyzer HP Fortify Static Code Analyzer provides automated static code analysis to help developers eliminate vulnerabilities and build secure software. It helps verify that your software is trustworthy, reduce costs, increase productivity and implement secure coding best practices. Static Code Analyzer scans source code, identifies root causes of software security vulnerabilities and correlates and prioritizes results giving you line-of-code guidance for closing gaps in your security. To verify that the most serious issues are addressed first, it correlates and prioritizes results to deliver an accurate, risk-ranked list of issues. Key features: Reduce business risk by identifying vulnerabilities that pose the biggest threat Identify and remove exploitable vulnerabilities quickly with a repeatable process Reduce development cost by identifying vulnerabilities early in the security development life cycle (SDLC) Educate developers in secure coding practices while they work Bring development and security teams together to find and fix security issues 4

5 HP Fortify Software Security Center HP Fortify Software Security Center is a suite of integrated software security solutions for automating key processes of developing and deploying secure applications. HP Fortify Software Security Center helps you resolve software vulnerabilities across the entire SDLC. Key features: Speed triage, audit, and testing with central test result access and visibility Get siloed teams to collaborate on resolving security issues Get a clear, accurate picture of software risk across your enterprise Identify areas for improvement to accelerate the reduction of risk and expense HP Fortify on Demand HP Fortify on Demand is a managed application security testing service that enables organizations to quickly test the application security of a few applications or launch a comprehensive security program without additional investment in software and personnel. Key benefits: Get started right away without the need to hire a security testing team or install expensive hardware or software. Start small and quickly scale to hundreds of apps. Our flexible solution can assess them all: web, mobile and client whether developed in-house or by a third-party. Simple fixed pricing, per application (or by subscription) eliminates any guesswork. Not only does HP Fortify on Demand offer the fastest turnaround times for results (on average 1 day for static and 3-5 days for dynamic), we back them with SLAs contractual penalties. Host your instance at one of our global data centers or on-premise in your own environment. Support is available 24x7, and the centralized portal is available in local languages. Manage your application security program, coordinate your testing schedule, manage remediation projects, and collaborate across teams through one centralized interface. Generate assessment reports and export results to upload into other reporting systems. Ensure that you always have the most recent and most effective security information from the smartest minds in the business. HP Security Research is a globally recognized leader in advanced vulnerability research and delivers regular and automatic security updates to all products. Comprehensive security testing across static, dynamic, mobile, vendor, and open source applications. Additionally, Fortify on Demand is fully integrated with a wide range of development tools to become the backbone of a SDLC including build server integration, IDE plug-ins, and bug tracking systems. Users can choose on or off-premise delivery or a hybrid solution. HP Application Defender HP Application Defender is application security simplified. It is a Software as a Service solution, or SaaS, that protects production applications from the inside out. Contextual insight from within the application itself allows you to confidently identify and stop attacks that network security cannot see. Managed from the cloud, and pre-configured to provide instant visibility into the security of your applications, the solution enables you to start protecting against security vulnerabilities in production software in minutes without any changes to the code. Key benefits: Protection Context from inside the application identifies and stops attacks unseen by network monitors and Web Application Firewalls (WAF) Runtime analysis of application logic and data flows Accurately distinguish between an actual attack and a legitimate request Visibility Actionable information with rich insight including the fully constructed query used and the line of code where the vulnerability exists Interactive dashboards and configurable reports for risk prioritization and remediation 5

6 Simplicity Install quickly and easily with a three-step deployment, get protection up and running in minutes Efficiently manage, report and scale via the cloud Background assumptions This implementation assumes that the reader has a general understanding of the HP Helion CloudSystem Enterprise environment and is capable of creating and deploying subscription services, is comfortable with Red Hat Enterprise Linux (RHEL) 6 distributions, and able to administer these environments. The reader should have basic knowledge about HP Helion CloudSystem Enterprise components including HP Helion CloudSystem Foundation, HP Cloud Service Automation, and HP Operations Orchestration as well as HP Server Automation. It is assumed that an HP Helion CloudSystem Enterprise solution has been deployed, configured and working. Also that HP Server Automation has been installed and configured before attempting to deploy this implementation. The HP Application Defender software and license are acquired through the appropriate channels. Links to the documentation for installing, configuring, and verifying these components and their interoperability can be found in the For more information section at the end of this document. Table 1 lists the versions used on this reference implementation. Table 1. Software components versions used for this implementation Component Version HP Helion CloudSystem Enterprise HP Helion CloudSystem 8.1 HP Cloud Service Automation 4.1 HP Operations Orchestration HP Server Automation HP SA HP OO-SA Content Pack HP Application Defender HP Application Defender 1.0 Overview: HP Application Defender solution for CloudSystem HP Helion CloudSystem Enterprise is the integrated bundle of HP Helion CloudSystem Foundation, HP Cloud Service Automation, and HP Operations Orchestration. HP Server Automation is included in HP Helion CloudSystem Enterprise PAA (Platform, Applications, and Analytics) add-on software. This document describes how to deploy HP Application Defender using HP Cloud Service Automation with VMware vsphere providing protection to your production Java application by identifying and instantly defending against threats to protect applications from vulnerabilities without having to change the application code. The implementation will show the Topology Service Design feature included in HP Cloud Service Automation 4.1 and how it can be used to automatically deploy a custom Java application along with HP Application Defender on top of a VMware virtual machine (VM) instance. HP Cloud Service Automation and VMware vsphere Deployment of a Java application along with HP Application Defender using VMware vsphere as a compute provider in HP Cloud Service Automation is described in the steps below: 1. The User requests a service through the HP Cloud Service Automation Marketplace Portal. 2. HP Cloud Service Automation uses an HP Operations Orchestration workflow to make a request to deploy a virtual machine template to VMware vsphere vcenter. 3. VMware vsphere vcenter deploys a pre-created virtual machine template. 4. The virtual machine is deployed on a VMware Host. 5. The Java application that HP Application Defender will be monitoring and protecting is deployed on the virtual machine. 6. After the Java application is deployed, an Operations Orchestration workflow requests the HP Application Defender deployment using Server Automation. 7. Once the application deployment successfully completes, the user can access the HP Application Defender using a web browser. The deployed HP Application Defender agent automatically monitors and protects your deployed production application from vulnerabilities. 6

7 Figure 2. Deployment of Java application along with HP Application Defender Deploying Java Application protected and managed by HP Application Defender through HP Helion CloudSystem Enterprise on VMware vsphere HP Helion CloudSystem Enterprise Admin Management Console Marketplace Portal HP Cloud Service Automation HP Operations Orchestration VMware vcenter HP BladeSystem User VM ESXi ESXi VM ESXi VM HP Application Defender HP Application Defender monitoring and protecting Production Application from vulnerabilities HP Server Automation Deployed VM Deployed Java Application with HP Application Defender Agent Configuration process steps This reference implementation details the major steps required to install and configure the HP Application Defender application. They include the following: 1. Creating the base virtual machine image required for the Java application with HP Application Defender deployment. 2. Creating the scripts and staging the binaries required for the reference implementation. 3. Importing and customizing the HP Server Automation software policies. 4. Creating Topology Service Designs and publishing Service Offerings in CSA. 5. Creating and using the application service. After these steps are complete, the application will be available for business users to automatically deploy using the CSA Marketplace Portal (MPP). A final step is also included that will decommission the service and return the resources to the HP Helion CloudSystem Enterprise environment. Configuring HP Helion CloudSystem Enterprise This reference implementation provides the steps required to create the necessary components for deploying HP Application Defender using HP Helion CloudSystem Enterprise. Creating the virtual machine image required for Java Application with HP Application Defender deployment A RHEL 6.5 x86_64 template base image needs to be created. This image requires a Data Center Management Network and an External network. For details see Appendix A. The information below defines the requirements for the Java application along with HP Application Defender used in this reference implementation. If you plan to use a different version of HP Application Defender, refer to the HP Application 7

8 Defender online help for the supported OS types and system configurations for the version of HP Application Defender you need to deploy. The storage and server requirements depend on your Java application requirements. 1. Operating system: Red Hat Enterprise Linux (RHEL) version CPU, memory, and disk space: CPU: 1 or 2 x Intel Xeon Quad Core or equivalent Memory: 8 GB Minimum disk space: 10 GB See Appendix A: Creating a CloudSystem Template with the HP SA Agent for details and instructions on how to create a RHEL 6.5x86 template for VMware that can be used in CloudSystem Topology Design for VM instance deployments. After the template is created, deploy a test VM instance to make sure the deployed VM is registered with the SA agent. Refer to Appendix A step 6. Staging the required software packages and files In this section we are going to stage the software required to create the HP Server Automation software policies. This includes the following software: JDK 8 Apache Tomcat 8 Custom Java application (for this deployment we have used an internal sample application called Riches.java) HP Application Defender agent See Appendix B: Staging the required software packages and files for a detailed list of the required packages used in this implementation. Create a temporary folder on your workstation that is running the Server Automation client and download the required software packages from the websites provided. Newer versions of the packages listed in Appendix B may be available but verify that any new versions are compatible. An HP Application Defender account is required of this service design and must be acquired through the appropriate channels. Log on to your HP Application Defender account, On the Manage tab, click Download Agents and the Download Agent Packages popup opens. In the popup, select Java Agent as shown in Figure 3. The agent installation file, HpAppDefender.tar.gz, is downloaded to your computer. Figure 3. Download Agent options for HP Application Defender Importing software and creating HP Server Automation policies HP Server Automation policies are used to deploy and configure the HP Application Defender. The required files staged in the previous section will be imported into HP Server Automation and used in software policies. All the individual items (scripts, ZIP packages, and RPM packages) will need to be imported into HP Server Automation and stored in the /Package Repository/All Red Hat Linux/Red Hat Enterprise Linux Server 6 X86_64 folder. Verify the OS type selected for the imported software is Red Hat Enterprise Linux Server 6 X86_64. The following server automation software polices will be created: Java_1.8 ApacheTomcat8 RichesJava 8

9 AppDefender HPAppDefender For detailed instructions to create the HP Server Automation software packages and polices used in this service design refer to Appendix C: Software packages and policies. Configure Cloud Service Automation vcenter and SA Providers The key requirements prior to importing the sample service design for HP Application Defender for vcenter are to configure the resource providers for VMware vcenter and HP Service Automation. To configure the resource providers, run the following steps: 1. Launch HP Cloud Service Management Console: A. Enter the URL for the HP CloudSystem Console in a web browser and log in as an administrator user. B. The default URL is CloudSystem Foundation Server IP or hostname>. C. On the CloudSystem dropdown menu, go to Enterprise. D. Under Tools, click Cloud Service Management Console to launch HP Cloud Service Automation (CSA) Administrator portal. E. Bookmark this webpage URL for CSA. 2. Log on to the CSA Management Console using an account with administrator privileges, i.e., admin. 3. Select the Providers tile. 4. Create the provider for VMware vcenter provider. A. Select VMware vcenter on the list of providers on the left panel. B. Click the Create button on the main panel. C. Provider the entries for the required fields: i. Display Name = VMware vcenter for HP CloudSystem ii. iii. iv. User ID = administrator Password = administrator password used to log in on the vcenter client Service Access Point = Note: The above Service Access Point URL is an example. Specify the FQDN of your vcenter server and provide the administrative user and password. D. Click Create to save the settings. E. Select the Properties tab: i. Click on DATACENTERNAME to launch the Edit Property dialog. ii. iii. Enter the Datacenter Name configured in vcenter on the Property Value field. Click Save on the Edit Property dialog. 5. Open the newly created vcenter provider then go to the Components tab. A. Verify the presence of the vcenter Server and vcenter Network Interface components. 6. Create the provider for the HP Server Automation provider: A. Select HP Server Automation on the list of providers on the left panel. B. Click the Create button on the main panel. C. Provide the entries for the required fields. iv. Display Name = SA for HP CloudSystem v. User ID = hpsa_admin (user having permissions to deploy SA software policies) vi. Password = hpsa_admin user password vii. Service Access Point = server IP address>:443 D. Click Create to save the settings. 7. Open the newly created Server Automation provider then go to the Components tab. Import the SA software policy created in the previous section as a component. A. Import the child components first (Java_1.8, ApacheTomcat8, RichesJava (replace RichesJava with your Java Application software policy), AppDefender). The four steps below are for importing the Java_1.8 Software policy. i. Click the Manage button to go to the Topology Components list. 9

10 ii. iii. iv. Click the Import button. Select HP Server Automation for the Import Source and leave Source Type as Live instance then click Next. Select Java_1.8 from the list of HPSA Software Policies then click Finish. Repeat the steps for the rest of the child components. B. Import the parent component (HPAppDefender). C. Open the parent component AGGREGATES relationship as shown in Figure 4 and edit each relationship by selecting the edit icon. Figure 4. Component Relationship D. Mark the relationship as not required by unchecking the field Required Relationship. Do this for all the AGGREGATES relationships with the child component as shown in Figure 5. E. After you finish updating all child components, click Save. Figure 5. Topology Component Relationship Creating the HP Application Defender vcenter Topology Service Design The following are the steps to create a service design that will deploy a Java application along with an instance of an HP Application Defender agent in a VM using the VMware vcenter provider. 1. Log on to the HP CSA Management Console using an account with administrator privileges if you are not logged in. 2. Go to Designs Topology Designer. 3. Click the Create button. 4. On the Create Design General dialog enter the following field values then click next: A. Name = Sample Java application with HP AppDefender Protection (specify a unique name for the service design) B. Description = [OPTIONAL] C. Version = D. Palette = none 8. Leave HP Helion OpenStack Provider as none and click finish. 10

11 9. Create the topology layout on the Editor tab. A. Create vcenter and HP AppDefender server components. i. Mouse over on the white canvas and left-click when you see a grey square. ii. Select vcenter Server. It is optional to change the server label to something else. iii. Mouse over on the canvass next to the vcenter Server component and left-click when you see a grey square. iv. Select HP AppDefender. It is optional to change the server label to something else. B. Connect the server components as shown in Figure 6. i. Mouse over to the vcenter server until you see a connector represented by a hollow circle on its border. ii. Click on the connector and drag it to the HP Application Defender server. Figure 6. Connecting server components in CSA Designer C. Provide server properties for the vcenter Server component. i. Click on the vcenter server component. ii. Provide the pre-defined values specified in Table 2 that match your environment. D. There are no server properties for the HP AppDefender component. Click Save. Table 2. Application Defender Server Properties Property Value Description vm TemplateReference String Name of the OS Template in VMware vcenter to use for the HP Application Defender instance. customizationspec String VM Template Customization Specification. Customization Specifications are defined in VMware vcenter in Home Custom Specifications Manager (See Appendix F: Creating a Customization Specification for Linux) vmnameprefix String Prefix to the HP Application Defender VM hostname. (e.g.: AppDef) username String The username used for the root user configured on the HP Application Defender VM. password String The password used for the root user configured on the HP Application Defender VM. 10. It is a best practice to perform a Test Run of the newly created Topology Design before publishing. A. Go to the Overview tab of the Design Details page. B. Click the Test Run button. C. Provide the Name of the Test Run. The rest of the fields are optional. Click Finish. 11

12 D. Click View to check the status. You may need to refresh the page to reflect the current status. You should see the status as Active as shown in Figure 7. Figure 7. Test run status E. Launch the HP Server Automation Java Client. Select the Devices tab Servers All Managed Servers and the newly deployed VM should be listed. Publish and create the service offering A service offering must be published and created in HP Cloud Service Automation before subscribers can request services based on this service design. To publish a service offering, complete the following steps: 1. Log on to the HP Cloud Service Automation Administrator portal using an account with administrator privileges. 2. Go to Designs Topology Designer. 3. Select the service design Sample Java application with HP AppDefender Protection. 4. On the Overview tab, click the Publish button. 5. Click Yes to the Confirm Publishing pop-up. 6. Click on the Cloud Service Automation link in the title bar next to the HP icon to get back to the main page. To create a service offering in the default catalog, complete the following steps: 1. Go to Offerings. 2. In the All Offerings panel, click Create. 3. On the Create Offering dialog: A. Leave the Offering Type set to Standard. B. Select the Service Design by clicking the ellipsis button. C. Select the Topology Design named Sample Java application with HP AppDefender Protection, then click the Select button. D. Enter Sample Java application with HP AppDefender Protection on the Display Name. E. [OPTIONAL] Enter a Description and Image for the offering. F. Click the Create button. HP Cloud Service Automation is installed with a default global catalog named Global Shared Catalog. When you publish a service offering in this global catalog, that service offering will be visible in every organization s Marketplace Portal. 1. On the Offerings details page: A. Go to the Publishing tab. B. Click Publish to launch the Publish Service Offering dialog. C. Select Global Shared Catalog. D. Expand the In Category dropdown and select a category, i.e., Application Services. E. Click Publish on the Publish Service Offering dialog. F. Click Close on the Success message box. 2. Verify the published service offering. A. Go back to the main page of HP Cloud Service Automation. B. Go to Catalog. 12

13 C. Select the Global Shared Catalog. D. Go to the Offerings tab and you should see the offering for HP Application Defender. Creating and using the application service Below is an example of how a subscriber can order the Java application with HP Application Defender using HP Cloud Service Automation. Creating a subscription in HP Cloud Service Automation You can order the HP Application Defender service from the HP Cloud Service Automation Marketplace Portal (MPP). 1. Launch HP Cloud Service Automation Marketplace Portal: A. Enter the URL for the HP CloudSystem Console in a web browser and login as an administrator user. B. The default URL is CloudSystem Foundation Server IP or hostname>. C. On the CloudSystem dropdown menu, go to Enterprise. D. Under Tools, click Marketplace Portal to launch HP Cloud Service Automation Marketplace Portal. E. Bookmark this webpage URL for MPP so that you can go directly to the shortcut instead of going through the link from CloudSystem Console if using the default Marketplace Portal. 2. Click Log In and enter the following information: A. Username: Your HP Cloud Service Automation Marketplace Portal user name, i.e., consumer. B. Password: Your HP Cloud Service Automation Consumer Portal password. 3. Expand the Sidebar Menu by clicking on the icon shortcut and select Browse Catalog. 4. Select the service offering called Sample Java application with HP AppDefender Protection. 5. Click the Checkout button. 6. Provide a Subscription Name of your choice, i.e., Sample Java application with HP Application Defender Protection. Description is optional. 7. Click the Submit Request button to deploy the service offering request. 8. You can monitor the progress of the request by clicking the View Requests button on the Request Confirmation details. 9. The status of your subscription can be monitored on the subscriptions panel by clicking Subscriptions on the Sidebar Menu. A typical end to end deployment takes 5 to 8 minutes to complete. Note This reference implementation uses the default Marketplace Portal. If your environment is set up for a different consumer organization, the unique URL for the MPP organization could be found on the organization page in the CSA Administrator portal. Accessing the subscribed Java Application with HP Application Defender Service 1. Log on to the HP Cloud Service Automation Marketplace Portal (MPP) using your consumer user account (or the same account you used to deploy the service). 2. On the main page of the MPP, expand the Sidebar Menu and select My Services. 3. Select the service name Sample Java application with HP Application Defender Protection. If it successfully deployed from the previous step, the service will have a green Online Services banner. 13

14 4. On the My Service Details for the deployed service, scroll down to the HP Application Defender Server. Take note of the External IP Address value as shown in Figure 8. Figure 8. Marketplace Portal Service Details 5. Using the External server IP address, open the following URL in a web browser for Tomcat server: server ip address>:8080 Note Port 8080 is the default port assigned for Apache Tomcat. If this port is used by another application, the Apache Tomcat will not load. You will have to edit the server.xml file and assign a different port instead of the default Check if your Java application is deployed or not as shown in Figure 9. Figure 9. Deployed Applications 14

15 Application Defender administration portal 1. Log in to HP Application Defender, using your account credentials. Verify that your Application Defender agent has registered with the service. Select the Manage tab and you should be able to see the Name/IP of your Virtual Machine as shown in Figure 10. Figure 10. Agents registered in HP Application Defender 2. Risk Group is a container for one or more agents that monitor your site or services for attacks. HP Application Defender comes with two default risk groups. One for the Java platform and the other for the Microsoft.NET platform. To configure protection settings, you must assign your agent to a non-default Java or.net risk group. In general you should put all agents for the same application in the same Risk Group. To create a new Risk Group for your tenant, from the Manage view, click New Risk Group. Select the platform type for the agent, locate your new risk group at the bottom of the risk group list. 3. To rename the newly created Risk Group, click New Risk Group, in the Rename Risk Group dialog box, replace the default name with a new name and click OK. Note that you cannot rename the default risk groups. 4. And at any time you want to delete the Risk Group, select the Risk Group and click on the Delete button. Note that you cannot delete the default risk groups. 15

16 5. You can assign your agents to one or more risk groups. Select the Name/IP of the agent and click on the Change Group. From the list in the Change Group dialog box, select a risk group and click OK. 6. Change the settings of the Agents by choosing the agent and selecting the Protection Settings tab. Click on the radio buttons for each role category and select Monitor, Protect or Disable as required by your security policy and click on the Save button. See Figure 11. Figure 11. Change settings for Monitor or Protect in HP Application Defender 16

17 7. Click on the Protect tab on the top left of the page to view the Application Defender at work as shown in Figure 12. This view provides details about attacks in your application environment and where the bulk of your threat management activity takes place. Summary of vulnerability information, including issue counts, event distribution over time and individual vulnerability records are displayed. Figure 12. Java Application Activity 8. Underneath the header are the Protect, Manage, Reports and Administrator tabs. Use these tabs to navigate to each of the HP Application Defender views. 9. Threat Timeline shows the distribution of all protected issues (top) and monitored issues (bottom) for a defined time period based on the filter selections in the summary bar as shown in Figure 13. Figure 13. Threat Timeline 17

18 10. Application Activity Graph shows all agent activity during the corresponding time period represented in the Threat Timeline. The number of agents and activity displayed changes based on the filters you specify as shown in Figure 14. Figure 14. Application Activity Graph 11. Details of Protected and Monitored events are listed below the Application Activity graph in chronological order, with the newest events listed at the top as shown in Figure 15. Figure 15. Application Activity Graph 18

19 12. The Risk Summary Report provides summary data on activity during a given week, month, or quarter (three months). You can use it to analyze your service usage, identify threat trends and fine-tune your application to address threats. From the navigation bar, click on Reports, the Report view opens and displays any scheduled and completed reports. Click Create Report. i. On the Schedule tab provide the name of the report and select the Frequency option. ii. In the Create Report window, click Parameters and provide the percentage value that the protection for a risk group must reach or exceed to be considered adequately protected. The default value is 90%. Select one to three Risk Groups to report on. iii. If you want to distribute a copy of the report in PDF format, click the Recipients tab and provide addresses of the recipients. 13. At any time, depending on changing threats, you can modify the protection settings (step 6). Returning the resource If you no longer need the deployed HP Application Defender service, this section describes the steps to return the resources used. 1. Log on to the HP Cloud Service Automation Marketplace Portal (MPP) using your consumer user account (or the same account you used to deploy the service). 2. On the main page of the MPP, expand the Sidebar Menu and select My Services. 19

20 3. Select the HP Application Defender service subscription. 4. On the My Service Details view, click the grey Managed Subscription button. 5. Click on the red Cancel Subscription button. 6. Click Yes on the message box pop-up. The Subscription Status is updated to Cancelled Subscription. Note Your cancellation time may vary depending on the hardware in your environment. If configured, you will be notified by that the service has been cancelled. Monitoring and troubleshooting a deployment If you wish to follow the service deployment process more closely, you can do so through the various provider interfaces. Refer to Appendix D: Monitoring and troubleshooting a deployment. Summary Managed from the cloud, HP Application Defender is a software as a service (SaaS) solution that protects production applications against security vulnerabilities. Without changing or altering your application s code, you can quickly stop attacks such as SQL injection and cross-site scripting using contextual insight from within the application itself. Visibility into the full query executed by the application (attacker) allows you to confidently identify and stop many attacks that network security layer products cannot. In this document we have shown how to create and deploy an HP Application Defender with HP Cloud Service Automation (CSA) to enable enhanced security for HP Helion CloudSystem Enterprise consumers and their subscription based services. The document also shows an overview of how to use the HP Application Defender including Protect, Manage, and Reports views. 20

21 Appendix A: Creating a CloudSystem Template with the HP SA Agent The following instructions require that you have access to the RHEL 6.5 ISO image. 1. Create a base Red Hat Enterprise Linux 6.5 Virtual Machine from the VMware vsphere client. a. Configure RHEL as a Basic Server, using DHCP network and include two networks: Data Center Management Network connected to your SA server and External network. b. Install RHEL 6.5. c. Specify a hostname, i.e., app-defender, instead of the default localhost. d. Install VMware Tools on the VM and reboot the VM. e. Obtain the IP address of the virtual machine. 2. Configure the RHEL VM network and security settings for eth0 and eth1. a. Set up ethx networking. Remove the "HWADDR=" line. Verify the setting onboot=yes The /etc/sysconfig/network-scripts/ifcfg-eth0 & ifcfg-eth1 file should be similar to: DEVICE="eth0" BOOTPROTO= dhcp" IPV6INIT="no" NM_CONTROLLED="no" ONBOOT="yes" TYPE="Ethernet" b. Disable SELinux in your VM template. Edit /etc/selinux/config. Change SELINUX=enforcing to SELINUX=disabled c. Remove the /etc/udev/rules.d/70-persistent-net.rules file. d. Disable IPv6 by editing /etc/sysctl.conf and adding net.ipv6.conf.all.disable_ipv6 = 1 to the end of the file. 3. Install the HP SA Agent on a Virtual Machine: The HP Cloud Service Automation Installation Guide 4.10 details the procedure to prepare a VM template with the HP SA Agent already installed. a. Log in to HP Server Automation Java Client as an administrative user. Note: You can download the Server Automation Java client from the Server Automation web client accessible at Core IP address>. The link to download the Java client is on the login page. Click on Download Hewlett-Packard Launcher to install the application. The installer has an option to create a shortcut on your desktop. You don t need to log in to the web client. b. Make sure the VM is connected to the network and the HP Server Automation (HP SA) system can be reached. c. From Server Automation Java Client, choose the Devices tab, then Servers SA Agent Installation. d. In the dropdown box, select Explicit IPs/Hostnames. Enter the IP address of your virtual machine and click on the Scan button. e. Right-click on the discovered server and select the Install SA Agent option. Enter the username and password. Under Actions, select Verify prerequisites, copy installer and install agent. f. Click on Start Job to copy the agent files to the VM. Click Close once the job is completed. g. Click on All Managed Servers option to open the All Managed Servers window. h. Click on the View dropdown menu and select Properties. i. Click on the virtual machine on which the agent was installed. j. Record the Object ID of the virtual machine, which can be found in the Management Information section of the Properties panel. 4. Sanitize the SA Agent installed on the VM: a. In the HP Server Automation client, select the Library tab and then By Type. b. Expand the Extensions folder. c. Select Program. 21

22 d. Locate the BRDC HPSA agent sanitizer. e. Execute the BRDC HPSA agent sanitizer APX: Right-click the APX and select Run. f. Select the Options tab in the Run Program Extensions dialog. g. In the Specify any needed parameters for this program execution field, enter the Object ID, which you previously obtained for the virtual server template. h. Click Start Job when the sanitation completes, click Close. i. Gracefully shut down the virtual machine (shutdown h now) after the job completes successfully. Note: Do not reboot this virtual machine. j. Convert the image to a VMware VM template. In the vsphere Client, right-click the VM and from the Template dropdown select Convert to Template. 5. Remove the server entry in SA. a. Go to Devices Servers All Managed Servers. b. Locate the server whose SA agent you just sanitized on step 4. c. Right-click on the server and select Deactivate SA Agent. d. Click the Deactivate confirm button. e. Right-click on the server again and select Remove from SA. f. Click the Remove from SA button. 6. Verify if the SA agent installs. a. Deploy a VM from the template. b. If the SA agent and changes were done correctly, the VM should automatically register its SA agent after boot up. c. You can verify it from the Devices tab of SA. Go to Servers All Managed Servers. On the toolbar, click View Refresh. It takes about 3 to 5 minutes after booting for the server to show up. If the server does not automatically register after 5 minutes, verify above steps 4 and 5. d. Once verified, delete the test VM and remove the device from SA. Appendix B: Staging the required software packages and files The HP Application Defender Agent is a required component of this service design and must be acquired through the appropriate channels. With a valid user account the Application Defender Agent can be downloaded from Create a temporary folder on a workstation that is running the Server Automation client and place the following files listed in Table 3 in the folder. Table 3. Software packages and files Software and Scripts jdk-8u25-linux-x64.rpm jdkpostinstall.sh apachetomcat8/apache-tomcat tar.gz tomcat tomcat-users.xml riches.war HpAppDefender.tar.gz HPAppDefenderAgent.sh Internet Location oracle.com/technetwork/java/javase/downloads/index.html See Appendix E for jdkpostinstall.sh script. See Appendix E for scripts. Update tomcat-users.xml as per your user requirements. Replace riches.war with your Java application.war file (Note: Riches.war is an internal custom Java application. Replace it with your production Java application.) Access to this package requires an HP Application Defender account. See Appendix E for HPAppDefenderAgent.sh file 22

23 Appendix C: Software packages and policies Software packages (RPM and ZIP files) are imported into HP Server Automation. Software policies are collections of software packages or other software policies. Note For this deployment we have used an internal custom Java application named RichesJava as an example for deploying a Java application. Replace RichesJava with your production Java application. Importing the packages To import software into HP Server Automation, complete the following steps: 1. Create the Java_1.8, ApacheTomcat8, user s Java Application and AppDefender ZIP file install bundle: A. Create the staging folders under c:\temp and place the files downloaded from the previous section into their respective folder as specified in Table 4. B. Compress sets of files into a ZIP archive file as specified in Table 4. You can do this with programs like WinZip or 7-Zip on Windows, or using the zip command on a Linux system. Table 4. ZIP archives Zip Archive Folder and Files Post-Install Script jdk8.zip apachetomcat.zip RichesJava.zip AppDefender.zip C:\temp\jdk8 jdk-8u25-linux-x64.rpm jdkpostinstall.sh C:\temp\apachetomcat8 apache-tomcat tar.gz tomcat tomcat-users.xml C:\temp\RichesJava riches.war C:\temp\AppDefender HpAppDefender.tar.gz HpAppDefenderAgent.sh cd /tmp/jdk8 /bin/rpm -Uvh jdk-8u25-linux-x64.rpm chmod +x /tmp/jdk8/jdkpostinstall.sh cd /tmp/apachetomcat8 /bin/cp apache-tomcat tar.gz /opt cd /opt /bin/tar -xvf apache-tomcat tar.gz /bin/cp /tmp/apachetomcat8/tomcat-users.xml /opt/apachetomcat /conf/ /bin/cp /tmp/apachetomcat8/tomcat /etc/init.d/tomcat chmod +x /etc/init.d/tomcat Note: Replace the war file with your Java application. RichesJava is just to illustrate the reference implementation. /bin/cp /tmp/richesjava/riches.war /opt/apache-tomcat /webapps/ /bin/cp /tmp/appdefender/hpappdefender.tar.gz / cd / /bin/tar -xzf /HpAppDefender.tar.gz chmod +x /tmp/appdefender/hpappdefenderagent.sh /tmp/appdefender/hpappdefenderagent.sh chmod +x /tmp/tmpcatalina.sh mv /tmp/tmpcatalina.sh /opt/apache-tomcat /bin/catalina.sh service tomcat start 2. Log in to HP Server Automation Java Client as an administrative user. 3. Select Library from the button on the bottom left. Click on the By Folder tab and right-click on the Library folder then select Import Software. 23

24 4. Click Browse to the right of the File(s) field and select ALL of the ZIP files created in step 1. The Type field should be automatically set to ZIP Archive (.zip). 5. Change the value for Folder to /Package Repository/All Red Hat Linux/Red Hat Enterprise Linux Server 6 X86_64. Click Select. 6. Change the value for Platforms to Red Hat Enterprise Linux Server 6 X86_ Click Import. Close the Software Imports dialog when finished. 8. Browse to Library/Package Repository/All Red Hat Linux/Red Hat Enterprise Linux Server 6 X86_ Right-click the jdk8.zip package and select Open. A. In the Views tree select Properties and set Default Install Path to /tmp. B. Select the Install Scripts. C. In the Post-Install Script tab, enter the contents from Table Go to File Save to save your changes. Close the window. Repeat the above steps 9 and 10 for the apachetomcat8.zip, RichesJava.zip (replace with your Java Application zip file) and AppDefender.zip. Creating the software policy Table 5. Server Automation Software Policy content Software Policy Name File Notes Java_1.8 ApacheTomcat8 jdk8.zip Apachetomcat8.zip RichesJava RichesJava.zip Replace with your Java application AppDefender HPAppDefender AppDefender.zip Java_1.8 ApacheTomcat8 RichesJava AppDefender This is the top level software policy for the 4 sub-policies. This is the order the policies should be listed on the items list. 1. Right-click the Library folder and select New Software Policy. 2. Set the values from Table 5. The instructions below are for creating a software policy for Java_1.8: A. Set Name to Java_1.8. B. Click Select and set the Location to /Package Repository/All Red Hat Linux/Red Hat Enterprise Linux Server 6 X86_64. C. Set the OS to Red Hat Enterprise Linux Server 6 X86_ Select Policy Items in the Views panel. 4. Click Add in the toolbar. Click on the Browse Folders tab. 5. Expand the Package Repository/All Red Hat Linux/Red Hat Enterprise Linux Server 6 X86_64 folder. 6. Select the jdk8.zip file. 7. Click Select. 8. On the File menu, click Save to save the software policy. 9. Close the window. Repeat the above steps for creating the rest of the Server Automation Software policies from Table 5. 24

25 When you get to the top-level software policy called HPAppDefender, verify that the order of the policy items is shown as listed on Table 5. See Figure 16. You can move a policy item s order by clicking the up or down arrows. Figure 16. HP Server Automation Software Policy: HPAppDefender Appendix D: Monitoring and troubleshooting a deployment If you wish to follow the service deployment process more closely, you can do so through the various provider interfaces. VMware vcenter The first part of the service deployment process is the creation of the virtual machine through VMware vcenter. 1. Log in to VMware vcenter and navigate to Home Inventory Hosts and Clusters and you can see the virtual machine being created. 2. You can view the progress by viewing the Recent Tasks section of the interface or going to Home Management Events and you can track the progress of the deployment request in progress. HP Server Automation Once the virtual machine is deployed, you can check the progress of the service deployment process in HP SA. 1. Launch the HP Server Automation Java Client. 2. Click View Jobs and Sessions Job Logs in the main menu. 3. Double click the Job Status associated with the deployment. 4. You can track the progress by clicking on the currently running Action. HP Operations Orchestration Central In the event of an error during deployment, you can verify the details of the error via HP OO. 1. From the HP CloudSystem Console s main menu, go to Integrated Tools Integrated UIs HP Operations Orchestration Central. 2. In HP OO, go to Run Management and double-click the Run Name associated with the deployment. 3. Expand details by viewing at Table View. If running multiple deployments, you can go directly to the HP OO job status from the CSA Operations tile. 1. On the CSA Operations main page, click the User Name associated with the deployment being monitored. 2. On the Subscriptions tab, select the Subscription Details row associated with the deployment. 3. Go to the Events tab. Click the row associated with the deployment Event. 4. Click the Process ID hyperlink to automatically launch HP OO. 5. After logging in as an HP OO administrator user, you will be redirected to the appropriate Run Management location. You can expand the details by viewing at Table View. 25

26 Appendix E: Scripts Note Below are the samples of installation scripts. If the scripts are being created on the Windows server make sure to use a UNIX /Linux compatible editor and save in UNIX format before importing into Server Automation. jdkpostinstall.sh #! /bin/bash /usr/sbin/alternatives --install /usr/bin/java java /usr/java/jdk1.8.0_25/jre/bin/java /usr/sbin/alternatives --install /usr/bin/jar jar /usr/java/jdk1.8.0_25/bin/jar /usr/sbin/alternatives --install /usr/bin/javac javac /usr/java/jdk1.8.0_25/bin/javac /usr/sbin/alternatives --install /usr/bin/javaws javaws /usr/java/jdk1.8.0_25/jre/bin/javaws /usr/sbin/alternatives --set java /usr/java/jdk1.8.0_25/jre/bin/java /usr/sbin/alternatives --set javaws /usr/java/jdk1.8.0_25/jre/bin/javaws /usr/sbin/alternatives --set javaws /usr/java/jdk1.8.0_25/bin/javac /usr/sbin/alternatives --set jar /usr/java/jdk1.8.0_25/bin/jar tomcat #!/bin/bash # description: Tomcat start stop and restart #process: tomcat JAVA_HOME=/usr/java/jdk1.8.0_25/ export JAVA_HOME PATH=$JAVA_HOME/bin:$PATH export PATH CATALINA_HOME=/opt/apache-tomcat /bin case $1 in start) /bin/sh $CATALINA_HOME/startup.sh ;; stop) /bin/sh $CATALINA_HOME/shutdown.sh ;; restart) /bin/sh $CATALINA_HOME/shutdown.sh /bin/sh $CATALINA_HOME/startup.sh ;; esac exit 0 26

27 tomcat-users.xml Note Modify users and roles as per your requirements. <tomcat-users> <role rolename="tomcat"/> <role rolename="admin"/> <role rolename="manager"/> <role rolename="role1"/> <role rolename="manager-gui"/> <role rolename="admin-gui"/> <user username="tomcat" password="tomcat" roles="tomcat"/> <user username="both" password="tomcat" roles="tomcat,role1"/> <user username="role1" password="tomcat" roles="role1"/> <user username="admin" password="admin" roles="admin,manager,manager-gui,admin-gui"/> </tomcat-users> HpAppDefenderAgent.sh sed '/#JAVA_OPTS="$JAVA_OPTS -Dorg.apache.catalina.security.SecurityListener.UMASK='umask'"/ a\ CATALINA_OPTS="- javaagent:\/hpappdefender\/lib.latest\/fortifyagent.jar $CATALINA_OPTS"' /opt/apache-tomcat /bin/catalina.sh >/tmp/tmpcatalina.sh Appendix F: Creating a Customization Specification for Linux Use the Guest Customization wizard to save guest operating system settings in a specification that you can apply when cloning virtual machines or deploying from templates. From an appropriate system in your environment, launch the vsphere client. A. From the vsphere Client Home page, select Customization Specifications Manager. B. Click New. C. Select Linux from the Target Virtual Machine OS menu. D. Under Customization Specification Information, enter a name for the specification and an optional description and click Next. E. Specify how to determine the host name to identify the guest operating system on the network. Use the virtual machine s name F. Enter the Domain Name for the computer and click Next. G. Select the time zone for the virtual machine and click Next. H. Select the type of network settings to apply to the guest operating system. Custom settings Note: Add two NICs. For each network interface in the virtual machine, click the ellipsis button (...) to open the Network Properties dialog box. Enter the network settings and click OK. When the two network interfaces are configured, click Next. I. Enter DNS and domain settings. J. Click Finish to save your changes. The customization specification you created is listed in the Customization Specification Manager, and can be used to customize virtual machine guest operating systems. 27

28 For more information HP Security: hp.com/go/enterprisesecurity HP Helion CloudSystem Solutions: hp.com/go/cloudsystem HP Helion CloudSystem Enterprise: hp.com/go/cloudsystementerprise HP Application Defender: HP software product manuals and documentation (you will need an HP Passport to sign in and gain access): To help us improve our documents, please provide feedback at hp.com/solutions/feedback. Sign up for updates hp.com/go/getupdated Copyright 2015 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein. Microsoft and Windows are trademarks of the Microsoft group of companies. Red Hat is a registered trademark of Red Hat, Inc. in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries. VMware is a registered trademark or trademark of VMware, Inc. in the United States and/or other jurisdictions. Intel and Xeon are trademarks of Intel Corporation in the U.S. and other countries. Oracle and Java are registered trademarks of Oracle and/or its affiliates. UNIX is a registered trademark of The Open Group. The OpenStack Word Mark and OpenStack Logo are either registered trademarks/service marks or trademarks/service marks of the OpenStack Foundation, in the United States and other countries and are used with the OpenStack Foundation s permission. We are not affiliated with, endorsed, or sponsored by the OpenStack Foundation, or the OpenStack community. 4AA5-6661ENW, January 2015