Security Content Update Release Notes for CCS 12.x

Transcription

1 Security Content Update Release Notes for CCS 12.x

2 SCU Release Notes for CCS 12.0 Documentation version: 1.0 Legal Notice Copyright 2018 Symantec Corporation. All rights reserved. Symantec, the Symantec Logo, the Checkmark Logo and are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. The product described in this document is distributed under licenses restricting its use, copying, distribution, and decompilation/reverse engineering. No part of this document may be reproduced in any form by any means without prior written authorization of Symantec Corporation and its licensors, if any. THE DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE. Symantec Corporation 350 Ellis Street Mountain View, CA

3 Symantec Support All support services will be delivered in accordance with your support agreement and the then-current Enterprise Technical Support policy. Knowledge Base Articles and Symantec Connect Before you contact Technical Support, you can find free content in our online Knowledge Base, which includes troubleshooting articles, how-to articles, alerts, and product manuals. In the search box of the following URL, type the name of your product: Access our blogs and online forums to engage with other customers, partners, and Symantec employees on a wide range of topics at the following URL: Technical Support and Enterprise Customer Support Symantec Support maintains support centers globally 24 hours a day, 7 days a week. Technical Support s primary role is to respond to specific queries about product features and functionality. Enterprise Customer Support assists with non-technical questions, such as license activation, software version upgrades, product access, and renewals. For Symantec Support terms, conditions, policies, and other support information, see: To contact Symantec Support, see:

4 Contents Symantec Support... 3 Chapter 1 Prerequisites for Security Content Updates... 5 Prerequisites... 5 Chapter 2 What's New... 7 New features... 7 New technical standards... 8 Deprecated technical standards... 9 Addition to predefined platforms... 9 Modified files Chapter 3 Resolved Issues Resolved issues... 13

5 Chapter 1 Prerequisites for Security Content Updates This chapter includes the following topics: Prerequisites Prerequisites The following are the prerequisites to install a Security Content Update (SCU): Control Compliance Suite 12.0 or later versions Before you install a Security Content Update (SCU), you must have Control Compliance Suite 12.0 or later versions installed on your computer. To use data collection support for MySQL, MySQL-RDS, MariaDB, and DB2 databases installed on Windows and UNIX platforms, you must upgrade to CCS (Product Update ) To use data collection support for Sybase databases installed on RHEL-Intel and Solaris-Intel platforms, you must upgrade to CCS (Product Update ) Quick Fix (QF) This QF is supported on CCS If you have command based standards installed, and you want to upgrade to a newer SCU, you must apply this QF. For information on command based standards, see the Predefined Technical Standards page. You can download the installation package for the QF from the following location: Quick Fix (QF) This QF is supported on CCS If you have command based standards installed, and you want to upgrade to a newer SCU, you must apply this QF. For information on command based standards, see the Predefined

6 Prerequisites for Security Content Updates Prerequisites 6 Technical Standards page. You can download the installation package for the QF from the following location:

7 Chapter 2 What's New This chapter includes the following topics: New features New technical standards Deprecated technical standards Addition to predefined platforms Modified files New features The Security Content Update (SCU) contains the following new features: Data collection support for Sybase databases Platform support for OpenStack Queens Platform Support for Ubuntu Platform Support for IIS 10.0 Platform Support for Symantec Endpoint Protection 12 and Symantec Endpoint Protection 14 Data collection support for Sybase databases Raw-data collection support for Sybase database that is installed on a RHEL-Intel or Solaris-Intel asset is available in Control Compliance Suite from SCU onwards. This support is available both for agent-based and agentless methods of data collection. Note: Some infrastructure updates are required to use this feature. These updates are available in QF You can download the QF.zip package from the following location.

8 What's New New technical standards 8 In SCU , support for default and non-default blacklisted commands is added for Sybase. For more information, see the Blacklisting commands for data collection on Sybase, MySQL, MariaDB, and DB2 databases (Updated in SCU ) topic in the Security Content Update Getting Started Guide (Version: CCS 12.x) Platform support for OpenStack Queens The platform support for OpenStack Queens release is made available SCU onwards. A security essential is added to get the compliance on OpenStack platform. The support is available for agent-based and agentless data collection. Platform Support for Ubuntu The platform support for Ubuntu release is made available SCU onwards. A security essential is added to get the compliance on Ubuntu platform. The support is available for agent-based and agentless data collection. Platform Support for IIS 10.0 The platform support for IIS 10.0 release is made available SCU onwards. A CIS standard is added to get the compliance on IIS platform. The support is available for agent-based and agentless data collection. Platform Support for Symantec Endpoint Protection 12 and Symantec Endpoint Protection 14 The support for Symantec Endpoint Protection 12 and Symantec Endpoint Protection 14 has been made available by providing Security Essential in SCU The support is available for agent-based and agentless data collection. New technical standards The following technical standards are added in SCU : CIS Security Configuration Benchmark for Microsoft IIS 10.0 v1.0.0 CIS Benchmark for Apache HTTP Server 2.4 v1.3.1 CIS Benchmark for Apple OS x10.12 v1.0.0 Security Essentials for OpenStack Queens Security Essentials for Sybase ASE 15.7 Security Essentials for Sybase ASE 16.x Security Essentials for Symantec Endpoint Protection 12 and Symantec Endpoint Protection 14

9 What's New Deprecated technical standards 9 Security Essentials for Ubuntu LTS Deprecated technical standards What is a deprecated standard? A deprecated technical standard is a standard which customers can still use for data collection for the asset types that it covers, but for which technical support or updates are no longer available from Symantec. A technical standard is marked as 'Deprecated' in CCS Standards Manager in the following cases: A CCS standard corresponding to a CIS Benchmark is deprecated if the support for a platform is ended by the platform vendor. A lower version of a CCS standard corresponding to a CIS Benchmark is deprecated if a higher version of the CCS standard is available for the same platform. A Security Essentials standard is deprecated if it is superseded by a CIS Benchmark for the same platform. A standard is marked as 'Deprecated' in the user interface (UI) for two consecutive SCUs. After that, it is removed from the SCU installer. For uninterrupted technical support for a platform, Symantec recommends that customers switch to a CIS Benchmark CCS standard that supersedes a deprecated standard. Note: Data that is already collected by using a deprecated standard remains unaffected even after the standard is removed from the SCU installer. The following technical standards are deprecated in SCU : Table 2-1 Deprecated technical standards in SCU Platform Oracle Apple Unix Applications OS or Application Version Oracle 9i and 10g Apple OS X Apache HTTP Server 2.4 Deprecated Standard CIS Oracle 9i and 10g Database Security Benchmark v2.0 Security Essentials for Apple OSX Security Essentials for Apache HTTP Server 2.4 Addition to predefined platforms SCU contains the following addition and enhancements to the predefined platforms in Control Compliance Suite:

10 What's New Addition to predefined platforms 10 Sybase Raw data collection support for Sybase database installed on RHEL-Intel and Solaris-Intel computers is available form SCU onwards. Earlier, message-based data collection support for this platform was available in Control Compliance Suite. The following are the highlights of the Sybase platform enhancements. Asset group template The following asset group templates are added to the platform-specific folders in the Asset Group Templates collection in the Control Compliance Suite asset system. Folder UNIX Asset group template All Sybase UNIX Machines Sybase 15.x UNIX Machines Sybase 16.x UNIX Machines Asset types The following asset types are added to support data collection for Sybase Server instance running on RHEL-Intel and Solaris-Intel computers: Unix Sybase Servers Target types The following target types are added to support data collection for Sybase Server instance running on RHEL-Intel and Solaris-Intel computers: Sybase 15.x Server on Unix Sybase 16.x Server on Unix All Sybase Servers on Unix OpenStack Queens The platform support for OpenStack Queens release is made available SCU onwards. A security essential is added to get the compliance on OpenStack platform. The support is available for agent-based and agentless data collection. Technical Standard The following security essential has been added to the Control Compliance Suite technical standards under the Predefined > Unix > Applications folder Security Essentials for OpenStack Queens Ubuntu The platform support for Ubuntu release is made available SCU onwards. A security essential is added to get the compliance on OpenStack platform. The support is available for agent-based and agentless data collection.

11 What's New Modified files 11 Technical Standard The following security essential has been added to the Control Compliance Suite technical standards under the Predefined > Unix >folder Security Essentials for Ubuntu LTS Asset group template The following asset group template is added to the platform-specific folders in the Asset Group Templates collection in the Control Compliance Suite asset system template is added in the UNIX folder in Folder UNIX Asset group template Ubuntu Servers Target Type The following target type is added. Ubuntu Machines IIS 10.0 The platform support for IIS 10.0 release is made available SCU onwards. A CIS standard is added to get the compliance on IIS platform. The support is available for agent-based and agentless data collection. Technical Standard The following CIS standard has been added to the Control Compliance Suite technical standards under the Predefined > Unix >folder CIS Security Configuration Benchmark for Microsoft IIS 10.0 v1.0.0 Symantec Endpoint Protection 12 and Symantec Endpoint Protection 14 The support for Symantec Endpoint Protection 12 and Symantec Endpoint Protection 14 has been made available by providing Security Essential in SCU The support is available for agent-based and agentless data collection. Technical Standard The following Security Essential has been added to the Control Compliance Suite technical standards under the Predefined > Unix >folder CIS Security Configuration Benchmark for Microsoft IIS 10.0 v1.0.0 Modified files The following files are modified in SCU : Symantec.CSM.WindowsPlatformContent.CISIISv1.0.dll

12 What's New Modified files 12 UnixScopes.dll Unix.Schema.dll Symantec.CSM.CredentialMgmt.PlatformCredentials.dll Symantec.CSM.Content.Localization.Resources.dll Symantec.CSM.DataCollector.CustomCredentialResolver.dll Symantec.CSM.UnixPlatformContent.Apache.dll Symantec.CSM.UnixPlatformContent.RHELv1.0.5.dll Dbif.Schema.dll Symantec.CSM.VMwarePlatformContent.VMwareESXi4x.dll Note: The version number for all the files mentioned earlier is

13 Chapter 3 Resolved Issues This chapter includes the following topics: Resolved issues Resolved issues Table 3-1 contains the details of the customer issues that are resolved in SCU Table 3-1 Resolved Issues in SCU Issue Windows Data collector will not initialize after upgrade to SCU "worker process terminated" error occurs when doing agent based jobs after updating to SCU from Resolution Now, the code is modified, and the data collection with Windows Data collector is successful. Now, the code is modified, and the 'worker process terminated' error does not appear. Cisco Router - Cisco CIS check is pass in one switch and unknown in other switch even after same configuration Now, the code is modified, and the CISCO CIS check passes for switches with similar configuration. CCS 11x/12x SuSE 12 Assets unable to run CER/DC job using predefined standards VMware data collection error - Exception:0x8000ffff Check "Is bidirectional CHAP authentication enabled for iscsi traffic?" check outcome is confusing if no iscsi is configured on targeted ESXi Now, the code is modified. Suse 12 SE and Suse 12 CIS standard has been updated allowing the users to run a CER or Data collection job. Now, the code is modified, and the error while collecting the VMWARE vsphere standard does not appear. Evidence text is modified to address the issue.

14 Resolved Issues Resolved issues 14 Table 3-1 Issue Resolved Issues in SCU (continued) Resolution VMware Hardening Guidelines ESXi 5.x via vcenter - Check : : "Is use of independent nonpersistent disks avoided?" causes error during evaluation when disk set to null in VM. Now the code is modified and Evidence text is edited to address the issue. Need Standard Review: CIS Windows 10 v1.3.0 predefined standard has fifteen checks seemingly with wrong check logic, not matching what the check is supposed to do. Fifteen checks so far identified. Security Essentials for PaloAlto Firewall v8.0. Check "1.5.1 Ensure 'V3' is selected for SNMP polling" is failing inappropriately. Now the code is modified and the standard is revised. The checks now perform as expected. Now the code is modified, and the check "1.5.1 Ensure 'V3' is selected for SNMP polling" for Security Essentials for PaloAlto Firewall v8.0. does not fail. During data collection and evaluation for the a custom standard, if some checks failed, the entire standard failed in evaluation results SQL agent-based data collection without domain cache dependency, fails. CER failed with error "Data Collection could not be completed as Domain Cache does not exist or invalid Domain Cache" Now the check expression for the custom standard is modified, and the standard does not fail. Before you run SQL agent-based data collection without domain cache dependency, you must first sync the ConfigurationSettings.xml file to the agent by running a Windows data collection job in order to create a key for 'Wnt.configuration' in the 'AgentManifest.xml' file. After the'wnt.configuration' key is placed in the 'AgentManifest.xml' file, the 'BuildDomainCache' parameter is honored on the agent Perform the following steps Add the Configuration parameter on DPS in file Install Agent on Windows with SQL asset. Register the agent on the CCS Manager Import SQL asset for this agent-based windows asset. Increase the version of "Wnt.Configuration" key in the ManagerManifest.xml File at DPS location so that the new configuration is synced to agent. Run CER on SQL asset without running DC for dependent Windows asset. Now the SQL agent-based data collection without domain cache dependency completes without error.