Frequently Asked Questions. Secure Log Manager. Last Update: 6/25/ Barfield Road Atlanta, GA Tel: Fax:

Transcription

1 Frequently Asked Questions Secure Log Manager Last Update: 6/25/ Barfield Road Atlanta, GA Tel: Fax:

2 1. What is Secure Log Manager? Secure Log Manager (SLM) is designed to meet the requirements of managing system audit logs, SLM is equally applicable to installations with tens of systems or tens of thousands of systems. Secure Log Manager provides log management for large communities of Systems Servers and Workstation, Windows or UNIX. Secure Log Manager ensures the integrity and continuity of system log data by collecting the data into a single point, in a secure and forensically sound way, where it may be used for later analysis or forensic investigation. 2. What facilities does Secure Log Manager provide? Secure Log Manager provides a solution to the problems of secure log management by providing: A mechanism for the secure transfer of system logs from individual systems onto a central management system. The secure transfer is performed so that the logs may, if required, later be used for forensic analysis. Facilities to allow viewing of the centrally held logs Facilities for the archiving to long term storage of collected Logs Facilities for the export of logs to an ODBC database for analysis Centrally, the Secure Log Manager allows filtering, viewing, reporting and archiving of the stored logs. 3. What is supported at Release 1 of Secure Log Manager? At Release 1 Secure Log Manager addresses the requirements of managing Windows Event Logs. Agents and some supporting features are provided for logs on some UNIX platforms. Log collection and transfer for UNIX is similar to Windows, some Console and reporting features are different at this release. Features and facilities for UNIX platforms will be brought to the same level as Windows at later releases of SLM. Secure Log Manager securely collects logs from enterprise wide systems to a secure central system. Logs can be exported to an ODBC database for analysis and can also be archived to secure long terms storage. All of the handling of the logs preserves the original format so that they are suitable, if required, for forensic analysis. Frequently Asked Questions Page 1

3 4. What environment do I need for Secure Log Manager? Secure Log manager is designed to work within a Windows domain environment. The computers hosting the Collector and Consoles must be in the same Windows Trust Domain, or must have appropriate trust relationships established between their respective Windows Trust Domains. 5. What are the System requirements for Secure Log manager? See the System requirements document for the full requirements, in summary they are: Network: WINS Name Resolution, TCP/IP Name Resolution and Windows Trust Domains. Collector: Pentium III 500 MHz processor 64MB RAM. Windows NT4 Server Edition SP 6a and MDAC 2.5 or 2.6. Min 10 MB NTFS file system for software installation. Console: Pentium III 500 MHz processor 64MB RAM by 768 resolution. Windows NT4 Workstation or Server Edition SP 6a and MDAC 2.5 or 2.6. Internet Explorer 5 or later. Min of 10 MB NTFS file system for software installation. Event Loader: The event loader is an optional component of Secure Log Manager. Pentium III 500 MHz processor 64MB RAM. Windows NT4 Server Edition with SP 6a and MDAC 2.5 or 2.6. A min of 5 MB on an NTFS file system for software installation. Windows 2000 / Windows NT Agent: Pentium processor 64MB RAM. Windows 2000 Professional or Server Edition or Windows NT4 Workstation or Server Edition with SP4 or later. Min 5 of MB NTFS file system for software installation. Sun Solaris Agents: SPARC Enterprise 250 processor or better 32MbRAM. Solaris 2.6 with patch applied or Solaris 7 and 8. Min of 5 MB for software installation. Hewlett-Packard HP-UX Agents: HP9000/712 processor or better 32MB RAM. HP-UX or 11 with 32MB RAM. Min of 5 MB for software installation. 6. I use Event Log Manager (ELM), is Secure Log Manager applicable to me? YES, Secure Log Manager would be the best upgrade path for you. 7. I use Workstation Edition (WSE), is Secure Log Manager applicable to me? YES, Secure Log Manager would be the best upgrade path for you. 8. As a user of ELM or WSE am I entitled to transition to Secure Log Manager If your ELM or WSE is currently on maintenance then the transition to Secure Log Manager is covered within your existing maintenance agreement. If your maintenance has expired you will need to purchase Secure Log Manager. 9. Is IS17799 (BS7799) applicable with Secure Log Manager YES - The BS 7799 Information security management code of practice is rapidly gaining international acceptance. BS7799 gives recommendations for information security management for use by those who are responsible for initiating, implementing or maintaining security in their organization. 10. Why Secure Log Manager? For many organizations the management of audit trails is of very high importance, both from a security, legislation and an administration viewpoint. Today s operating systems, including Windows and UNIX, can produce a large amount of audit data in the system logs. There are few tools available today to provide for the reliable management of this log data. Frequently Asked Questions Page 2

4 11. What are System Logs? UNIX System: UNIX systems generally write their audit data to log files, typically 'sulog' and 'syslog. The 'sulog' contains all attempts to change user using the UNIX 'su' command. 'Syslog' contains the other operating system audit information.' Some UNIX variants may have other system logs. Windows Event Logs: Windows (NT and 2000) writes its audit data to Event Logs, on Windows NT these are the Application, System and Security Event Log and on Windows 2000 there are additional Event Logs, including the Directory Services and File replication event logs. 12. Are Windows logs text files? No - Each Windows Event Log contains a number of structured event records. Each record has an Event ID and a source name, a reference to the application or subsystem that generated the event. The Event ID is only relevant in the context of a given source name. For example, Event ID 5 for source Secure Log Manager Agent expands to the string Service has stopped. These text strings are held within application binary files. Each application or subsystem registers its message string files with the Event Log subsystem, allowing the Windows Event Viewer to access and expand the Event ID strings. 13. Is Secure Log Manager a forensic analysis tool? NO - Secure Log Manager is not a forensic analysis tool. Secure Log Manager can be considered an important prerequisite to forensics in that it securely collects logs from all over the enterprise. Users who wish to investigate security incidents require the logs to be in a form in which they can be used for analysis and forensic use. Any user wishing to follow through to prosecution would require logs in a format that are admissible as evidence in a court of law When combined with other analysis tools 14. What does Secure Log Manager do? On each managed Windows system, the Secure Log Manager Agent monitors the size of all event logs. If a log reaches a user-defined threshold/trigger condition the log is transferred to the Secure Log Manager Collector on a central management platform using a secure store and forward mechanism. Alternatively the transfer of logs, on both Windows and UNIX, can be triggered by time, this can be at specified times, days of week, days of month 15. What are the components of Secure Log Manager Secure Log Manager implements a 3-tier architecture. On each system to be managed an Agent is installed, the agent is configured with the name of the system running the Secure Log Collector. The Collector provides the agents management and data management for Secure Log Manager and uses an ODBC database, at first release this will be an Access database and subsequent releases will support SQL Server and Oracle. The Collector is the middle tier of Secure Log Manager. One or more Consoles can connect to the Collector. Frequently Asked Questions Page 3

5 16. What is the Architecture of SLM? 17. SLM consists of the following components: Consoles - Providing a user friendly graphical interface Collector - The data storage and management component Agents - Agent(s) installed on each system to be managed 18. What is an SLM Agent? The SLM Agent is installed on each system that requires log management. The agent monitors the logs and on detection of a trigger condition will initiate the transfer of a log to the collector using a secure store and forward mechanism. Each Agent has a 'heart beat' to the Collector, the frequency being a user defined value, which allows the console to display the connection status of each Windows system being managed. Additionally, in order to ensure the integrity of the Agent, each Windows SLM Agent will initiate a self-check on a regular basis and raise a high priority alert if it detects an integrity failure. 19. What is an SLM Collector? The SLM Collector collects incoming event log files and stores them in the 'central' store. The Collector manages the data stores; these are the flat file folders and ODBC database. SLM can use MS Access, SQL Server and Oracle as its ODBC database. An optional part of the Collector is the Event Loader, which can automatically load log data onto the ODBC database on receipt from agents. A Log Browser for UNIX logs is also included as part of the Collector. The Collector includes facilities for alert management and ODBC output of NT Event Logs. 20. What is an SLM Console? The Console provides the user interface to SLM and enables log management, alert management and reporting which includes graphical reporting and trend analysis. Management reports are available showing statistics such as elapsed time from alert generation to closure. Frequently Asked Questions Page 4

6 21. What does the SLM Console User interface provide? The SLM Console provides a User Interface, which supports: Hierarchical tree view of managed SLM systems, their connection status and 'heart beat' status. Log alert notification Alert acknowledgement Simple Log browsing of Windows logs Selection of Windows log events for export to the query database Pre-defined reports and graphs on alerts and events in the query database using 'Crystal Reports Several Consoles may be run concurrently, with each connecting to the Collector and having direct or network access to the Collectors shared drive. A simple log viewer is provided at this release for UNIX logs. 22. Which Platforms supported at release SLM 1.0? Console: Windows NT 4 only Collector: Windows NT 4 only Database: Access, SQL Server, Oracle Agents: Windows NT 4, Windows 2000, Solaris 2.6, 7, 8, HP-UX and How is SLM licensed? Secure Log Manager uses the standard ISS key mechanism. The Collector is the 'controlled' Secure Log Manager component and uses a standard ISS key file. The ISS key file must include the IP address of the system on which the Collector is installed and the number of agents to be supported by the Collector. The Console and Agents do not require and ISS.KEY file. Note: This IP address for the Collector can be an address range. The IP addresses of the system on which agents are to be installed are not required. 24. Do I need a Licence to do an Evaluation? NO - For product evaluations a single agent installation can be created which does not require an ISS key. The agent must be installed on the same system as the Collector. 25. What are Secure Log Manager main features and functions? Secure Log Manager (SLM) provides log management for large communities of Systems Servers and Workstation, Windows or UNIX. Secure Log Manager ensures the continuity of system log data by collecting the data into a central point, in a secure and forensically sound way, where it may be used for later analysis or forensic investigation. Secure Log Manager securely collects logs from enterprise wide systems to a secure central system. Logs can be exported to an ODBC database for analysis and can also be archived to secure long terms storage. All of the handling of the logs preserves the original format so that they are suitable, if required, for forensic analysis. On Windows Secure Log Manager is installed using 'Install Shield ' it supports full Microsoft SMS integration for rollout and update. On UNIX simple scripts are provided for local and remote silent installation. Reporting, using 'Crystal Reports ', provides a number of standard reports and includes simple analysis of Windows Logs. Frequently Asked Questions Page 5

7 26. What is a typical Secure Log Manager installation? The Secure Log Manager installation consists of any number of Agent systems (Windows and UNIX) managed by a single Windows NT based Collector system with one or more Consoles. A Console can be installed on the Collector system or on remote Windows Systems. The Collector and Agents can run on either NT servers or workstations although for performance and connectivity reasons it is recommended that the Collector be run on an appropriately sized server together with an appropriate ODBC database. The number of Agents that can be supported by one Collector is restricted only by system constraints. 27. What Network Security is provided? The Collector is authenticated to the Agents via SSL 3.0, using 1024-bit DSS certificates, with all subsequent traffic between Agent and Collector being encrypted with 168-bit Triple DES. This ensures that the agents will not leak information on security vulnerabilities to malicious third parties. Control communications between the Consoles and Collector is via DCOM and may be optionally encrypted at the packet level using the standard DCOM facilities and NT Security Service Providers. 28. What Log Transfer options are available? Logs will be transferred to the collector: When the log size reaches a configurable percentage full, i.e. 75% At a configurable times of day, days of the week, days of the month These transfer criteria may be configured separately for each type of log. 29. Does SLM clear the logs? Before a log is transferred to the Collector it is copied to temporary store on the agents, the system s log is cleared down, preventing the loss of events that could occur if the log became full. 30. Does SLM do authentications? YES - Before any data is transferred, both the Agent and Collector confirm that the remote party is valid. Both parties also maintain sequence numbers for all system log types, so that out-of-sequence transfers can be detected. 31. Does SLM do Encryption? YES - Secure Log Manager uses an encryption algorithm for all network transfers. To further improve security, encryption keys are changed after every file transfer. 32. Does SLM consolidate data from all agents? YES - Transfer of the collected data into an ODBC database allows the consolidation, correlation and analysis of logs across the whole enterprise. 33. What does SLM do with Message Strings Files? For Windows Event Logs in order to allow the Secure Log Manager Console to display the text associated with any event ID, Secure Log Manager transfers all files containing message strings to the collector along with the Event Log files. To minimize the amount of data transferred, each file is only transferred once. Frequently Asked Questions Page 6

8 34. How does SLM transfer logs to the Collector? SLM uses a secure Store & Forward mechanism. Before transfer to the Collector, the Agent copies all log data to a spool area. Data files are only deleted from the spool area once the Collector has confirmed that the files have been correctly received and stored to disk. The Collector verifies that sufficient disk space is available before allowing the transfer of any file. 35. How does the Store and Forward work? Spooling when a log matches the transfer criteria, the Agent performs a Backup & Clear operation on the log, resulting in the log being copied to the spool area and then cleared down. A control file is generated to hold system-specific information referenced by the event log. Any message files referenced by the event log are also copied to the spool area, though each file is only transferred to the Collector once. Forwarding The Agent attempts to connect to the Secure Log Manager Collector using a secure protocol over a named pipe on Windows or sockets on UNIX. Each set of files in the spool area is forwarded to the Collector. When the Collector acknowledges the receipt of the entire set of files the spooled copy is removed. Storing The Collector stores received sets of files in a directory hierarchy representing the managed network of systems. The stored event logs can then be viewed using the Secure Log Manager Console. 36. Where can I get more information about SLM? Contact you ISS Sales representative or visit the ISS web site at Where can I get the Secure Log Manager software? Contact you ISS Sales representative or visit the ISS web site at About Internet Security Systems (ISS) Internet Security Systems, Inc. (ISS) (Nasdaq: ISSX) is the leading global provider of security management solutions for the Internet. ISS protects critical information and network resources from attack and misuse. By combining best of breed software products, market-leading managed security services, aggressive research and development, and comprehensive educational and consulting services, ISS is the trusted security provider for thousands of customers around the world. Copyright , Internet Security Systems, Inc. All rights reserved worldwide. Internet Security Systems, the Internet Security Systems logo, and The Power To Protect are trademarks and service marks of Internet Security Systems, Inc. Other trademarks and trade names mentioned are marks and names of their owners as indicated. All trademarks are the property of their respective owners and are used here in an editorial context without intent of infringement. Specifications and content are subject to change without notice. Frequently Asked Questions Page 7