McAfee Cloud Workload Security Installation Guide. (McAfee epolicy Orchestrator)

Transcription

1 McAfee Cloud Workload Security Installation Guide (McAfee epolicy Orchestrator)

2 COPYRIGHT Copyright 2018 McAfee, LLC TRADEMARK ATTRIBUTIONS McAfee and the McAfee logo, McAfee Active Protection, epolicy Orchestrator, McAfee epo, McAfee EMM, Foundstone, McAfee LiveSafe, McAfee QuickClean, Safe Eyes, McAfee SECURE, SecureOS, McAfee Shredder, SiteAdvisor, McAfee Stinger, True Key, TrustedSource, VirusScan are trademarks or registered trademarks of McAfee, LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 McAfee Cloud Workload Security Installation Guide

3 Contents 1 Installation of Cloud Workload Security 5 Cloud Workload Security packages and McAfee suites Requirements Installing the Cloud Workload Security extension Download and install the extension manually Install the extension through Software Manager Configure a deployment task for Linux group of systems Extension list on McAfee epo Uninstall the extensions Configuring cloud accounts and your security products 9 Register an AWS cloud account Create an AWS user Create a user permission policy Create an IAM role with flow logs for your AWS account Assign the policy to a user Register an AWS account Registering a Kubernetes account Deploy McAfee pod Validating McAfee pod Delete McAfee pod Using RBAC authorization Register a Kubernetes cluster Configuring Microsoft Azure cloud accounts Create an application in the Microsoft Azure console Create an application using PowerShell script Finding Subscription ID, Tenant ID, and Client ID Configure client key Set delegated permissions Assign the application to your subscription Register a Microsoft Azure account Register a VMware vsphere account from the Accounts pane Register an OpenStack account Register a Network Security Manager account Download the Virtual Probe Install the Virtual Probe Configuring your security products and viewing reports Delete a cloud account McAfee Cloud Workload Security Installation Guide 3

4 Contents 4 McAfee Cloud Workload Security Installation Guide

5 1 Installation of Cloud Workload Security McAfee Cloud Workload Security is packaged in public, hybrid, and private variants to support different cloud vendor accounts. Install any of these Cloud Workload Security extensions on the McAfee epolicy Orchestrator (McAfee epo ) server to deploy and configure your McAfee products based on your requirements. Contents Cloud Workload Security packages and McAfee suites Requirements Installing the Cloud Workload Security extension Uninstall the extensions Cloud Workload Security packages and McAfee suites Cloud Workload Security is packaged in public, hybrid, and private variants to support different cloud vendor accounts. Table 1-1 Cloud Workload Security packages Cloud Workload Security variant Cloud Workload Security for Public cloud Cloud Workload Security for Private cloud Cloud Workload Security for Hybrid cloud Supported cloud vendors AWS, Microsoft Azure, and Kubernetes connector VMware vsphere, OpenStack, and Kubernetes connector VMware vsphere, AWS, Microsoft Azure, OpenStack, and Kubernetes connector Package names Cloud_Workload_Security_Public_5.1.0 Cloud_Workload_Security_Private_5.1.0 Cloud_Workload_Security_Hybrid_5.1.0 Cloud Workload Security package includes license extension and Kubernetes connector extension. Install license extension to enable traffic discovery, traffic assessment, traffic visualization, and Network Security account registration. Install kubernetes connector extension to register Kubernetes Cluster account, and discover, assess, and secure Docker containers on Kubernetes. McAfee Cloud Workload Security Installation Guide 5

6 1 Installation of Cloud Workload Security Requirements Requirements To install the Cloud Workload Security extension, make sure that you have the compatible versions of McAfee epo, McAfee Agent, and browsers. Component Version McAfee epo 5.3.3, 5.9 (EPO590HF ), and McAfee Agent Browsers and later. For more information, see KB Google Chrome 62.0 and later Internet Explorer 11 Installing the Cloud Workload Security extension You can install the Cloud Workload Security extension with the Software Manager utility on McAfee epo, or by downloading and installing the extension from the McAfee download site. Download and install the extension manually Download and install the Public Cloud Security package on the McAfee epo server. 1 From the McAfee download site ( use your grant number and select your suite. 2 From the products listed, select and download Common UI 1.3 and your Cloud Workload Security variant. 3 Log on to the McAfee epo server as an administrator. 4 Select Menu Software Extensions Install Extension. 5 Browse to and select the extension file, then click OK. Install Common UI 1.3 first, then install Cloud Workload Security. The Install Extension page displays the extension names and version details. Install the extension through Software Manager Use McAfee epo Software Manager to install the Cloud Workload Security extension. 1 Log on to the McAfee epo server as an administrator. 2 Select Menu Software, then click Software Manager. 3 From Software (by Label) Messaging & Web Security, select Common UI 1.3 on McAfee epo and then click Check In All. 4 From Software (by Label) Endpoint Security, select your Cloud Workload Security 5.1 variant and then click Check In All. 6 McAfee Cloud Workload Security Installation Guide

7 Installation of Cloud Workload Security Uninstall the extensions 1 Configure a deployment task for Linux group of systems Create a deployment task to remove the Assurance Information module Linux client from target systems in the System Tree. 1 From the System Tree, select the Assigned Client s tab. 2 Select Actions New Client Assignment. 3 Select Product as McAfee Agent, and Type as Product Deployment. 4 Select a name for your task and click Create New. 5 Select the Target Platforms as Linux, Products and Components as Assurance Information Module , and Action as Remove. 6 Click Save. Extension list on McAfee epo After installing the Cloud Workload Security extension, you can see these extensions by selecting Menu Extensions McAfee Data Center Security. CWS License extension Data Center Assessment Data Center Visualization vsphere Connector AWS Connector Data Center Metering Azure Connector MDCC OpenStack Connector Kubernetes Connector Uninstall the extensions Remove Cloud Workload Security software extensions from the McAfee epo server in the Extensions. Delete your cloud account from the McAfee epo server by selecting Menu Configuration Registered Servers, and selecting Actions Delete. 1 Log on to the McAfee epo server as an administrator. 2 Select Menu Software Extensions. 3 In the left pane, select Data Center Security group, then select the extensions in this order and click Remove. 1 CWS License extension 6 Data Center Assessment 2 Data Center Visualization 7 vsphere Connector 3 AWS Connector 8 Data Center Metering 4 Azure Connector 9 MDCC 5 OpenStack Connector 10 Kubernetes Connector McAfee Cloud Workload Security Installation Guide 7

8 1 Installation of Cloud Workload Security Uninstall the extensions Delete your cloud account from the McAfee epo server by selecting Menu Configuration Registered Servers, and selecting Actions Delete. 8 McAfee Cloud Workload Security Installation Guide

9 2 Configuring 2 cloud accounts and your security products You must register your cloud accounts with McAfee epo to establish a connection with the McAfee epo server. McAfee epo then discovers, imports, and displays the cloud asset information on a single page. After registering the cloud accounts on the Cloud Workload Security visualization page, you can view: Virtual networks and firewall (security group) information of your virtual machines in Cloud Workload Security. Imported VMs and virtualization properties on the McAfee epo System Tree. Security products installed on every virtual instance. Contents Register an AWS cloud account Registering a Kubernetes account Configuring Microsoft Azure cloud accounts Register a VMware vsphere account from the Accounts pane Register an OpenStack account Register a Network Security Manager account Configuring your security products and viewing reports Delete a cloud account Register an AWS cloud account You must register your AWS cloud accounts on McAfee epo. Cloud Workload Security offers three levels of privileges when registering an AWS account. You can configure your AWS account according to your requirements. Create an AWS user On the Amazon Web Services management console, create an AWS user with Access Key ID and Secret Access Key configured. 1 Log on to your Amazon Web Services management console. 2 Click All services Security, Identity & Compliance IAM to load the Identity and Access Management (IAM) dashboard. 3 From the Users section, click Add user. 4 Type a valid name in the User name field under Set user details section. McAfee Cloud Workload Security Installation Guide 9

10 2 Configuring cloud accounts and your security products Register an AWS cloud account 5 Select an access type under Select AWS access type section. Programmatic access To create an access key and secret access key AWS Management Console access To create a password to logon to AWS Management Console You can add the created user to a group, set permissions, and attach or add policies. 6 Click Create user. 7 Click Download.csv and save the CSV file. You can view Access Key ID and Secret Access Key for the created user in the same page. Create a user permission policy Create a policy with minimum required permissions for a user to use Cloud Workload Security. 1 Log on to your Amazon Web Services management console. 2 Click All services Security, Identity & Compliance to load IAM dashboard. 3 Set policies based on the required privilege. 4 Click Review policy. 5 Type a valid name and description. 6 Click Create policy. Policy for EC2 discovery/visibility These set of rules will allow you to create an AWS user with limited privilege user permission policy to discover EC2 assets and read firewall rules. { } "Version": " ", "Statement": [ { "Effect": "Allow", "Action": "ec2:describe*", "Resource": "*" } ] Policy for remediation of Security Groups These set of rules will allow you to create an AWS user with the privileges for the remediation of Security Groups. { "Version": " ", "Statement": [ { "Sid": "", "Effect": "Allow", "Action": [ "ec2:authorizesecuritygroupegress", "ec2:authorizesecuritygroupingress", "ec2:createsecuritygroup", "ec2:deletesecuritygroup", "ec2:modifyinstanceattribute", "ec2:modifynetworkinterfaceattribute", "ec2:revokesecuritygroupegress", "ec2:revokesecuritygroupingress", 10 McAfee Cloud Workload Security Installation Guide

11 Configuring cloud accounts and your security products Register an AWS cloud account 2 } ] } "ec2:createtags" ], "Resource": [ "*" ] Policy for Amazon GuardDuty This policy allows Cloud Workload Security to discover Amazon GuardDuty events. { } "Version": " ", "Statement": [ { "Sid": "DiscoverGuardGuty", "Effect": "Allow", "Action": [ "guardduty:getthreatintelset", "guardduty:getipset", "guardduty:listipsets", "guardduty:getfindings", "guardduty:listthreatintelsets", "guardduty:getthreatintelset", "guardduty:getmasteraccount", "guardduty:getipset", "guardduty:listfindings", "guardduty:getmembers", "guardduty:getfindingsstatistics", "guardduty:getdetector", "guardduty:listmembers", "guardduty:listdetectors", "guardduty:getinvitationscount", "guardduty:listinvitations" ], "Resource": "*" } ] Policy for workload shut down These set of rules will allow you to shut down the selected workload as a remediation measure. { } "Version": " ", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": "ec2:stopinstances", "Resource": "*" } ] Policy to enable Network Traffic Discovery These set of rules will allow the AWS user to enable network traffic flow logs at VPC levels. This policy allows Cloud Workload Security to discover network traffic logs. { "Version": " ", "Statement": [ McAfee Cloud Workload Security Installation Guide 11

12 2 Configuring cloud accounts and your security products Register an AWS cloud account } ] { } "Sid": "", "Effect": "Allow", "Action": [ "logs:createloggroup", "logs:deleteloggroup", "logs:describeloggroups", "logs:describelogstreams", "logs:filterlogevents", "logs:getlogevents", "logs:createlogstream", "logs:putlogevents", "iam:passrole", "ec2:createflowlogs", "ec2:deleteflowlogs" ], "Resource": [ "*" ] Create an IAM role with flow logs for your AWS account An IAM role with flow log policies enables you to access the IP traffic flow in your virtual networks. You can view the IP traffic flows of your Virtual networks in the Cloud Workload Security. 1 Log on to your Amazon Web Services management console. 2 Click All services Security, Identity & Compliance IAM to load the IAM dashboard. 3 Select Roles Create role. 4 Select EC2 for EC2 instances. 5 Click Next: Permissions. 6 Click Next: Review. 7 In the Role name field, enter McafeeFlowLogger, and type a meaningful description. 8 Select Create role. 9 Type a name for your role. 10 Under Permissions, choose Add inline policy. 12 McAfee Cloud Workload Security Installation Guide

13 Configuring cloud accounts and your security products Register an AWS cloud account 2 11 Select the JSON tab and copy this policy and paste it. { } "Version": " ", "Statement": [ { "Action": [ "logs:createloggroup", "logs:createlogstream", "logs:putlogevents", "logs:describeloggroups", "logs:describelogstreams" ], "Effect": "Allow", "Resource": "*" } ] 12 Select Review policy. Type a name for your policy and select Create policy. 13 Select Edit trust relationship. Delete any existing policy document. 14 Copy and paste this policy, and click Update trust policy. { } "Version": " ", "Statement": [ { "Sid": "", "Effect": "Allow", "Principal": { "Service": "vpc-flow-logs.amazonaws.com" }, "Action": "sts:assumerole" } ] 15 From the Summary page, take note of the ARN for your role to create your flow log. Assign the policy to a user Assign the required policy to the user on the AWS management console to provide necessary permissions to the user. Before you begin Ensure that you have created a new user. Ensure that you have created the required permissions policy. 1 Log on to AWS management console. 2 Click All services Security, Identity & Compliance IAM to load IAM dashboard. 3 Select the user from the Users section. 4 On the Summary page, select the policy that you created, then click Attach policy. McAfee Cloud Workload Security Installation Guide 13

14 2 Configuring cloud accounts and your security products Register an AWS cloud account 5 Go back to the Summary page, then click the Security Credentials tab. 6 Click Create access key. Secret access key is generated when you create the Access key. Use the access key and the secret access key when registering your cloud account using McAfee epo. Register an AWS account Register an AWS account with McAfee epo so that McAfee epo can communicate with the AWS cloud. Before you begin Ensure that these conditions are met: You have your AWS account and its details ready. AWS users have an access key ID and a secret access key set up for them in the AWS console. AWS users have permissions to use Cloud Workload Security. The account you are registering with McAfee epo has an IAM role with flow log policies to view IP address of the traffic flows in your virtual network. You installed the Cloud Workload Security extension on McAfee epo. Your McAfee epo system date and time are synchronized with the current date and time. The McAfee epo server and the VMs in the AWS cloud must communicate with each other. AWS users must have permissions to read CloudWatch events and access Auto Scaling Groups. 1 Log on to the McAfee epo server as an administrator. 2 Select Menu Systems Cloud Workload Security, to open the Cloud Workload Security page. 3 From the Accounts pane, click Add to open the Registered Cloud Account pane. 14 McAfee Cloud Workload Security Installation Guide

15 Configuring cloud accounts and your security products Register an AWS cloud account 2 4 Select Amazon Web Service from the drop-down list, and type these details. Option Account Name GovCloud AWS China Access Key ID Definition A name for the AWS account in McAfee epo. Account names can include characters a z, A Z, 0 9, and [_. ], without space. Select if the AWS account belongs to the AWS GovCloud (US) region. Select if the AWS account belongs to China region. Type the access key ID used by AWS connector to log on to AWS. Each user can be configured to have an Access Key ID in AWS console. For details, see Create an AWS user. Secret Key ID Type the secret access key used by AWS connector to log on to AWS. Each user can be configured to have a Secret Access key in AWS console. For details, see Create an AWS user. Validate Assessment Policy McAfee epo Tags (separated by commas) Sync Interval (In Minutes) Enable Traffic Discovery Click to validate the account details and verify the connection to the AWS cloud. Click Assessment Policy to select the policy to be applied to your AWS account, or click to go to the Policy Catalog page to create or select a policy. List of McAfee epo tags that are applied on VMs discovered for this AWS account. Tag name can include characters a z, A Z, 0 9, and [_. ], with space. For details about Tag usage, see the product documentation for McAfee epo. Specify the interval for McAfee epo to AWS synchronization (the default value is 5 minutes. The maximum value is 60 minutes). If you specify the sync interval as 5 minutes, the next sync is scheduled 5 minutes after the completion of the current sync. Select to discover and view traffic flow logs for instances in your AWS accounts. 5 (Optional) Under Windows Domain Logon Credentials, type the credentials to deploy the McAfee Agent package. 6 Click Submit to register the cloud account. This action registers the AWS cloud and imports all discovered VMs, which are unmanaged, into the System Tree. The instances are imported with the structure and hierarchy of the AWS cloud. The VMs that are already added and managed by McAfee epo are retained with the existing policy settings. 7 View the imported VMs: s Select Menu Systems Cloud Workload Security on McAfee epo to view, assess, and remediate your cloud asset information. Select Menu System Tree in McAfee epo. You can find your AWS account under the group AWS. The virtual machines from AWS are logically grouped with the hierarchy AWS Cloud account name Region Availabilty zone instances. Create an IAM role to access other AWS accounts on page 16 IAM roles are a secure way to grant permissions to trusted entities. Creating an IAM role to access other accounts allow you to build trust relationships with third party AWS accounts. Register sub-accounts for your AWS account on page 16 You can register multiple sub-accounts under an AWS cloud account using the same access key and secret key. Creating sub-accounts resolves customer key rotation in AWS. McAfee Cloud Workload Security Installation Guide 15

16 2 Configuring cloud accounts and your security products Register an AWS cloud account Create an IAM role to access other AWS accounts IAM roles are a secure way to grant permissions to trusted entities. Creating an IAM role to access other accounts allow you to build trust relationships with third party AWS accounts. 1 Log on to your Amazon Web Services management console. 2 Click All services Security, Identity & Compliance IAM to load the IAM dashboard. 3 Select Roles Create role. 4 Select Another AWS account under Select type of trusted entity in the Create role section. 5 In the Account ID field, type an existing AWS account ID from which you want to grant access to your account resources. 6 Click Next: Permissions and select a permission. 7 Click Next: Review. 8 Type a role name in the Role name field. 9 Click Create Role. Register sub-accounts for your AWS account You can register multiple sub-accounts under an AWS cloud account using the same access key and secret key. Creating sub-accounts resolves customer key rotation in AWS. Before you begin Ensure that these conditions are met: You have your AWS account and its details ready. AWS users have an access key ID and a secret access key set up for them in the AWS console. AWS users have permissions to use Cloud Workload Security. The account you are registering with McAfee epo has an IAM role with flow log policies to view IP address of the traffic flows in your virtual network. The account that you are registering with McAfee epo has an IAM role to build trust relationships with third party AWS accounts. You installed the Cloud Workload Security extension on McAfee epo. Your McAfee epo system date and time are synchronized with the current date and time. 1 Log on to the McAfee epo server as an administrator. 2 Select Menu Systems Cloud Workload Security, to open the Cloud Workload Security page. 3 From the Accounts pane, click Add Account, to open the Registered Cloud Account pane. 16 McAfee Cloud Workload Security Installation Guide

17 Configuring cloud accounts and your security products Registering a Kubernetes account 2 4 From the Select Account Type drop-down list, select Amazon Web Service, and type these details. Option Name Access Key ID Definition A name for the AWS account in McAfee epo. Account names can include characters a z, A Z, 0 9, and [_. ], without space. Type the access key ID used by AWS connector to log on to AWS. Each user can be configured to have an Access Key ID in AWS console. For details, see Create an AWS user. Secret Key ID Type the secret access key used by AWS connector to log on to AWS. Each user can be configured to have a Secret Access key in AWS console. For details, see Create an AWS user. Validate Add Sub-accounts Click to validate your AWS account. Click to add sub-accounts for your AWS account. 5 In the Add Sub-accounts pane, then select one of these options. Select Enter Accounts Manually and enter the following details. Option Sub-account Name Role ARN Definition A name for the AWS sub-account in McAfee epo. Account names can include characters a z, A Z, 0 9, and [_. ], without space. Type the Amazon Resource Name (ARN) for the AWS sub-account in McAfee epo. The role ARN format is arn:<partition>:<service>::<account_id>:<resource>. For example, arn:aws:iam:: :role/crossac. Select Upload CSV and click Choose file to upload the.csv file that contains role ARN details, then click Upload. The.csv file has two columns without column headers. The first column is account name and the second is ARN number. Registering a Kubernetes account Register a Kubernetes cluster with McAfee epo so that McAfee epo can communicate with the Kubernetes account which manages container applications. Deploy McAfee pod You must deploy McAfee Pod before registering a Kubernetes cluster account in McAfee epo. Before you begin Ensure that you have these conditions are met: You have installed Kubernetes or later hosted on any of these environments bare metal Google Kubernetes Engine (GKE) Google Compute Engine (GCE) Amazon Web Services (AWS) McAfee Cloud Workload Security Installation Guide 17

18 2 Configuring cloud accounts and your security products Registering a Kubernetes account Microsoft Azure (for unmanaged Kubernetes cluster) On-premise VMware vsphere You have CNI network plug-in that supports network policies. You have a container image registry to host Docker images. By default, the McAfee pod is deployed in the kube-system namespace. The Docker images must be hosted on a Docker registry for the ease of deployment of McAfee pod on multiple clusters and nodes. For example, the Docker registry, registry.my-company.com is a container image registry. You can download the Docker images from the Software Download Manager. Best Practice: We recommend that you create a LoadBalancer to expose the McAfee service that controls, configures, and reports the security posture of the cluster. 1 Load the Docker images locally on a Linux system on which the Docker engine is running. $ docker load -i mfe-apiserver:v5.1.0 $ docker load -i mfe-security:v5.1.0 $ docker load -i mfe-cert-issuer:v Tag the images with a registry host name and push them into the registry. $ docker tag mfe-apiserver:v5.1.0 registry.my-company.com/mfe-apiserver:v5.1.0 $ docker tag mfe-security:v5.1.0 registry.my-company.com/mfe-security:v5.1.0 $ docker tag mfe-cert-issuer:v5.1.0 registry.my-company.com/mfe-cert-issuer:v5.1.0 $ docker push registry.my-company.com/mfe-apiserver:v5.1.0 $ docker push registry.my-company.com/mfe-security:v5.1.0 $ docker push registry.my-company.com/mfe-cert-issuer:v (Optional) Create a persistent volume for McAfee pod, then enter a new storageclassname. You need not perform this step if the vendor environment supports dynamic volume. apiversion: v1 kind: PersistentVolume metadata: name: mfe-persistent-volume namespace: kube-system spec: capacity: storage: 1Gi accessmodes: - ReadWriteOnce persistentvolumereclaimpolicy: Retain storageclassname: my-storage-class # Uncomment the relevant volume type # AWS example, EBS volume must already exist # awselasticblockstore: # volumeid: vol # fstype: ext4 # GCE example, PD must already exist # gcepersistentdisk: # pdname: my-data-disk # fstype: ext4 # vsphere example, VMDK volume must already exist # vspherevolume: # volumepath: "[DatastoreName] volumes/mydisk" # fstype: ext4 18 McAfee Cloud Workload Security Installation Guide

19 Configuring cloud accounts and your security products Registering a Kubernetes account 2 4 Customize mfe-deployment-v5.1.0.yaml. Change image tags. For example, registry.my-company.com/mfe-security:v Change storageclassname. For example, my-storage-class. Change default targetport 8080 to a port which can expose McAfee services to perform security posture assessment. Make sure that you set the same port number in Network Policy ingress field. 5 Deploy McAfee pods. kubectl create: $ kubectl create -f mfe-deployment-v5.1.0.yaml serviceaccount "mfe-svc-accnt" created persistentvolumeclaim "mfe-storage" created clusterrolebinding "mfe-role-binding" created clusterrole "mfe-role" created deployment "mfe-security" created service "mfe-service" created networkpolicy "mfe-network-policy" created Validating McAfee pod You can validate the McAfee pod after deploying them. To validate McAfee pod, check if these resources are created. Check if the namespace kube-system contains the service account mfe-svc-accnt. $ kubectl get serviceaccount -n kube-system mfe-svc-accnt NAME SECRETS AGE mfe-svc-accnt 1 11m Check if the namespace kube-system contains the persistent volume claim mfe-storage, and status Bound state. $ kubectl get persistentvolumeclaim -n kube-system mfe-storage NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS AGE mfe-storage Bound mfe-persistent-volume 1Gi RWO manual 12m Check if the namespace kube-system contains cluster role binding mfe-role-binding and cluster role mfe-role. $ kubectl get clusterrolebinding -n kube-system mfe-role-binding NAME AGE mfe-role-binding 16m $ kubectl get clusterrole -n kube-system mfe-role NAME AGE mfe-role 16m Check if the namespace kube-system contains the deployment mfe-security. $ kubectl get deployment -n kube-system mfe-security NAME DESIRED CURRENT UP-TO-DATE AVAILABLE AGE mfe-security m Check if the namespace kube-system contains the service mfe-service, and check if the load balancer has an IP address or FQDN to access the McAfee service outside the cluster. $ kubectl get service -n kube-system mfe-service NAME CLUSTER-IP EXTERNAL-IP PORT(S) AGE mfe-service acfe801473a2a :31185/TCP 17m McAfee Cloud Workload Security Installation Guide 19

20 2 Configuring cloud accounts and your security products Registering a Kubernetes account Delete McAfee pod You can delete the deployed McAfee pod when you no longer need it. 1 Delete the deployed McAfee pod using: $ kubectl delete -f mfe-deployment-v5.1.0.yaml serviceaccount "mfe-svc-accnt" deleted persistentvolumeclaim "mfe-storage" deleted deployment "mfe-security" deleted clusterrolebinding "mfe-role-binding" deleted clusterrole "mfe-role" deleted service "mfe-service" deleted networkpolicy "mfe-network-policy" deleted 2 Delete the Transport Layer Security (TLS) secrets created by McAfee pod using: $ kubectl delete secret -n kube-system mfe-tls mfe-server mfe-client secret "mfe-tls" deleted secret "mfe-server" deleted secret "mfe-client" deleted Using RBAC authorization Role Based Access Control (RBAC) uses an API group to take authorization decision and configure policies through Kubernetes API. The role in the RBAC API contains rules that represent a set of permissions. These roles allow you to create a minimal RBAC. apiversion: v1 kind: ServiceAccount metadata: name: mfe-epo-accnt --- apiversion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: mfe-epo-binding roleref: apigroup: rbac.authorization.k8s.io kind: ClusterRole name: mfe-epo subjects: - kind: ServiceAccount name: mfe-epo-accnt namespace: default --- apiversion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: mfe-epo rules: - apigroups: - "" resources: - pods - services - namespaces verbs: - get - list - apigroups: - "networking.k8s.io" resources: - networkpolicies 20 McAfee Cloud Workload Security Installation Guide

21 Configuring cloud accounts and your security products Registering a Kubernetes account 2 verbs: - delete - get - list - patch - update - watch - create --- Register a Kubernetes cluster Register a Kubernetes cluster with McAfee epo so that McAfee epo can communicate with the Kubernetes account which manages container applications. Before you begin Ensure that these conditions are met: You have your Kubernetes account and its details ready. You have Kubernetes endpoint URL and access token details ready. The RBAC for access token has minimum required role. You have deployed McAfee pod. Kubernetes users have permissions to use Cloud Workload Security. You installed the Cloud Workload Security extension on McAfee epo. 1 Log on to the McAfee epo server as an administrator. 2 Select Menu Systems Cloud Workload Security, to open the Cloud Workload Security page. 3 From the Accounts pane, click Add Account, to open the Registered Cloud Account pane. McAfee Cloud Workload Security Installation Guide 21

22 2 Configuring cloud accounts and your security products Configuring Microsoft Azure cloud accounts 4 From the Select Account Type drop-down list, select Kubernetes Cluster, and type these details. Option Account Name Kubernetes Account URL Definition A name for the Kubernetes cluster in McAfee epo. Account names can include characters a z, A Z, 0 9, and [_. ], without space. The endpoint URL to log on to Kubernetes cluster. Use kubectl cluster-info command to obtain the endpoint URL. We recommend that you use HTTPS protocol. It is not recommended to mention port name in the endpoint URL. Port The name of the port. The default port is 443. Access Token The token obtained from the Kubernetes cluster. Use kubectl describe <service account name created using minimal RBAC> command to get TLS secret, then use kubectl describe secret <secret name obtained from previous command> to obtain the access token. Assessment Policy Click Assessment Policy to select the policy to be applied to your Kubernetes account, or click to go to the Policy Catalog page to create or select a policy. Select Assessment Rules - Container category in the Policy Catalog page. Sync Interval (In Minutes) Specify the interval for McAfee epo to Kubernetes synchronization (the default value is 5 minutes. The maximum value is 60 minutes). If you specify the sync interval as 5 minutes, the next sync is scheduled 5 minutes after the completion of the current sync. 5 Click Test Connection to validate the account details and verify the connection to the Kubernetes cluster. 6 Click Next. Cloud Workload Security display certificates for Kubernetes API cluster and McAfee pod. 7 Click Accept to accept the certificates. 8 Click Submit to register the cluster. Configuring Microsoft Azure cloud accounts You can configure and register your Microsoft Azure account on McAfee epo, then view your cloud account details in the System Tree and on the Cloud Workload Security dashboard. Create an application in the Microsoft Azure console Create an application in Microsoft Azure Active Directory to access the resources in your subscription. This application will allow you to create default roles only. Before you begin Ensure that these conditions are met: You have installed Azure Resource Manager modules in Microsoft Azure PowerShell. You have registered Microsoft.insights provider under User Account My Permissions Resource provider status. You can get your client ID, tenant ID, and configure your Client key after creating the application. 22 McAfee Cloud Workload Security Installation Guide

23 Configuring cloud accounts and your security products Configuring Microsoft Azure cloud accounts 2 1 Log on to the Microsoft Azure portal and select Active Directory from the left pane. 2 Select the directory that you want to use for creating the application. 3 Click Applications and then click Add. 4 On the What do you want to do? page, select Add an application my organization is developing. 5 Type a name for your application and select WEB APPLICATION AND/OR WEB API and click Next. 6 Type the properties for your application. For SIGN-ON URL, give the URI to a website that describes your application. The existence of the website is not validated. For APP ID URI, provide the URI that identifies your application. The uniqueness or existence of the endpoint is not validated. 7 Click Complete to create your application. Create an application using PowerShell script Create an application using power shell scripts to create custom roles. You can access the tenant ID, client ID, and client key from the automatically generated MicrosoftAzurecloudaccountdetails.txt file. Before you begin Ensure that these conditions are met: You have installed Azure Resource Manager modules in Microsoft Azure PowerShell. You have registered Microsoft.insights provider under User Account My Permissions Resource provider status. For more information about Azure PoweShell, see overview?view=azurermps and KB Download the required PowerShell script and copy it to the PowerShell installation folder. Ensure that you have downloaded the correct script according to your Cloud Workload Security version. 2 Log on to PowerShell as administrator. 3 Enter cd "PowerShell directory path" to change the directory. 4 Enter.\ MicrosoftAzure_Prerequisite.ps1 to run the script. 5 Enter the required parameters according to your subscription. You must register Microsoft.insights provider for traffic discovery. For a single logged on user, select one of these in the Register Cloud Accounts window. McAfee CWS Basic This set of rules allows you to discover Azure instances and Network Security Groups (NSG) rules. McAfee CWS Advanced This set of rules allows you to discover Azure instances and NSG rules, and remediate NSG rules. McAfee Cloud Workload Security Installation Guide 23

24 2 Configuring cloud accounts and your security products Configuring Microsoft Azure cloud accounts For multiple subscriptions associated with one account: Create a web application for: Selected subscriptions All subscriptions In the Register Cloud Accounts window, select: McAfee CWS Basic McAfee CWS Advanced NSG flow logs allow Network Watcher to view information about the traffic in the NSG. When Network Watcher is enabled, the retention period set by Cloud Workload Security for NSG flow logs is 15 days. You can reconfigure the retention period under Network Watcher in the Azure portal. For more information, see 24 McAfee Cloud Workload Security Installation Guide

25 Configuring cloud accounts and your security products Configuring Microsoft Azure cloud accounts 2 Finding Subscription ID, Tenant ID, and Client ID After creating your application, you can make a note of the subscription ID, tenant ID and client ID. The subscription ID for your Microsoft Azure account is listed in Subscriptions SUBSCRIPTION ID. Select the application that you created and click the Configure to see your Client ID. Click VIEW ENDPOINTS to see App Endpoints page. Your tenant ID is given after the URLs for all the attributes in this page. McAfee Cloud Workload Security Installation Guide 25

26 2 Configuring cloud accounts and your security products Configuring Microsoft Azure cloud accounts Configure client key Configure your client key on Microsoft Azure Active Directory for your application. Before you begin Ensure that you have created an application in your Microsoft Azure Active Directory. 1 Log on to the Microsoft Azure portal. 2 Select the application that you created and click Configure. 3 Scroll down to the Keys section and select how long you would like your password to be valid. 4 Select the duration and click Save to create the key. Copy the key displayed in the application. You will not be able to retrieve it after you leave this page. Set delegated permissions Set the delegated permissions to access the web APIs from the registered account. Before you begin Ensure that you have created your application. 1 Log on to the Microsoft Azure portal. 2 Select the application that you created, then click Configure. 3 Select Add Application. 4 From the list in the Name field, select Windows Service Management API, then click Complete. 5 From Permissions to other applications, for Windows Azure Service Management, set the Delegated Permission as Access Azure Service Management as organization. Assign the application to your subscription Assign a role to your application and also assign it to your Microsoft Azure subscription. Before you begin You created an application in the Microsoft Azure console. You configured Client key for your application and set the delegated permissions. 1 On the Microsoft Azure console, click Subscription. 2 Select your subscription, and click Access icon. 3 Click Add Select a role and select your role as Contributor. 4 Click Add users and search for your application, click Select and click OK. Your application is assigned to your subscription. 26 McAfee Cloud Workload Security Installation Guide

27 Configuring cloud accounts and your security products Configuring Microsoft Azure cloud accounts 2 Register a Microsoft Azure account Register a Microsoft Azure account with McAfee epo so that McAfee epo can communicate with the Microsoft Azure cloud. Before you begin Ensure that these conditions are met: You have your Microsoft Azure account and its details ready. You have created an application in the Microsoft Azure console. You have the Client ID and Tenant ID from the Microsoft Azure console after creating the application. You have configured the Client key for your application. You have set the delegated permissions for your application. You have assigned the newly created application to a role and to your Microsoft Azure cloud account subscription. You have installed the Cloud Workload Security extension on McAfee epo. Your McAfee epo system date and time are synchronized with the current date and time. 1 Log on to the McAfee epo server as an administrator. 2 Select Menu Systems Cloud Workload Security, to open the Cloud Workload Security page. 3 From the Accounts pane, click Add Account, to open the Registered Cloud Account pane. McAfee Cloud Workload Security Installation Guide 27

28 2 Configuring cloud accounts and your security products Configuring Microsoft Azure cloud accounts 4 Select Microsoft Azure from the drop-down list, and type the details. Option Account Name GovCloud Azure Endpoint Definition Specify a name for the cloud account in McAfee epo. Account names can include characters a z, A Z, 0 9, and [_. ], without space. Select if the account belongs to the Microsoft Azure GovCloud (US) region. Specify the URL of Microsoft Azure endpoint. For Microsoft Azure cloud account, the endpoint is pre-populated. Do not change the endpoint URL unless confirmed by the cloud provider. Subscription ID Tenant ID Client ID Client Key Assessment Policy McAfee epo Tags (separated by commas) Sync interval (In Minutes) Enable Traffic Discovery Specify the subscription ID of your account. For details, see Where to find Subscription ID, Tenant ID, and Client ID. Specify the unique ID of the organization in Microsoft Active Directory. For details, see Where to find Subscription ID, Tenant ID, and Client ID. Specify the unique ID of the application. For details, see Where to find Subscription ID, Tenant ID, and Client ID. Specify the client key of the application. For details, see Configure Client Key. Click Assessment Policy to select the policy to be applied to your Azure account, or click to go to the Policy Catalog page to create or select a policy. Specify McAfee epo tag that is applied on the VMs discovered for this cloud account. Tag name can include characters a z, A Z, 0 9, and [_. ], with space. For details about Tag usage, see the product documentation for McAfee epo. Specify the interval for McAfee epo to the cloud synchronization (the default value is 5 minutes. The maximum value is 60 minutes). If you specify the sync interval as 5 minutes, the next sync is scheduled 5 minutes after the completion of the current sync. Select to discover and view traffic flow logs for instances in your Microsoft Azure accounts. 5 (Optional) Under Windows Domain Logon Credentials, type the credentials to deploy the McAfee Agent package. 6 Click Test Connection to validate the account details and verify the connection to the cloud. 7 Click Submit to register the cloud account. This action registers the Microsoft Azure cloud account and imports all discovered VMs, which are unmanaged, into the System Tree. The instances are imported with the structure and hierarchy of the Azure cloud. The VMs that are already added and managed by McAfee epo are retained with the existing policy settings. 8 View the imported VMs: Select Menu Systems Cloud Workload Security on McAfee epo to view, assess, and remediate your cloud asset information. Select Menu Systems System Tree in McAfee epo. After the discovery, you can find your account under the group Azure. The VMs from each Microsoft Azure account are logically grouped under different geographical zones in McAfee epo. 28 McAfee Cloud Workload Security Installation Guide

29 Configuring cloud accounts and your security products Register a VMware vsphere account from the Accounts pane 2 Register a VMware vsphere account from the Accounts pane Register a VMware vsphere account with McAfee epo so that McAfee epo communicates with the VMware vcenter, which manages the ESXi servers. Before you begin Ensure that: The VMware vcenter server that manages the ESXi servers is configured to host the guest VMs. The Cloud Workload Security extension is installed on McAfee epo. 1 Log on to McAfee epo as an administrator. 2 Select Menu Systems Cloud Workload Security, to open the Cloud Workload Security page. 3 From the Accounts pane, click Add Account, to open the Registered Cloud Account pane. 4 From the Select Account Type drop-down list, select VMware vsphere. 5 In the vcenter Account Details page, type these details. Option Account Name Server Address vcenter Username vcenter Password Assessment Policy McAfee epo Tags (seperated by commas) Port Sync Interval (In Minutes) Definition A name for the vcenter account in McAfee epo. Account names can include characters a z, A Z, 0 9, and [_. ], without space. Specify the URL of VMware VSphere endpoint. Type the vcenter user name to log on to VSphere. Type the vcenter password to log on to VSphere. Click Assessment Policy to select the policy to be applied to your vcenter account, or click to go to Policy Catalog page to create or select a policy. List of McAfee epo tags that are applied on VMs discovered for this vcenter account. Tag name can include characters a z, A Z, 0 9, and [_. ], with space. For details about Tag usage, see McAfee epo product documentation. Specify the port name. Specify the interval for McAfee epo to vcenter synchronization (the default value is 5 minutes. The maximum value is 60 minutes). If you specify the sync interval as 5 minutes, the next sync is scheduled 5 minutes after the completion of the current sync. 6 (Optional) Under Windows Domain Logon Credentials, type the credentials to deploy the McAfee Agent package. Make sure that the McAfee epo server and the VMs in the vsphere cloud can communicate with each other. 7 Click Test Connection to validate VMware vcenter account details and verify the connection to the VMware vcenter, then click Next to open the vcenter Summary page. The summary page has vcenter, vcns, and NSX summary. 8 Click Accept to accept the certificates. McAfee Cloud Workload Security Installation Guide 29

30 2 Configuring cloud accounts and your security products Register an OpenStack account 9 Click Submit to register the cloud account. This action registers the VMware vcenter and imports all discovered virtual machines, which are unmanaged, into the McAfee epo System Tree. The instances are imported with the similar structure and hierarchy present in VMware vcenter. The virtual machines that are already added and managed by McAfee epo are retained with the existing policy settings, but the virtualization properties for these machines are added. 10 View the imported VMs: Select Menu Systems Cloud Workload Security on McAfee epo to view your cloud asset information. Select Menu Systems System Tree in McAfee epo. After the discovery, you can find your vcenter account under the group vsphere. The clusters and hosts from vcenter are logically grouped under each Data Center group in McAfee epo. Register an OpenStack account Register an OpenStack account with McAfee epo so that McAfee epo can communicate with the OpenStack cloud. Before you begin Ensure that you have your OpenStack account and its details ready. The OpenStack account is generic because you can provide the URL of the OpenStack implementation under Identity Service Endpoint and configure the cloud account. OpenStack extension for Cloud Workload Security version supports OpenStack Pike release. 1 Log on to the McAfee epo server as an administrator. 2 Select Menu Systems Cloud Workload Security, to open the Cloud Workload Security page. 3 From the Accounts pane, click Add Account, to open the Registered Cloud Account pane. 30 McAfee Cloud Workload Security Installation Guide

31 Configuring cloud accounts and your security products Register a Network Security Manager account 2 4 From the Select Account Type drop-down list, select OpenStack, and type these details. Option Account Name Identity Service Endpoint Username Password Assessment Policy McAfee epo Tags (separated by commas) Sync Interval (In Minutes) Definition A name for the OpenStack account in McAfee epo. Account names can include characters a z, A Z, 0 9, and [_. ], without space. The URL of the account. The user name of the account in the format <tenant>:<user logon>. For example, tenant:admin. The password of the account. Click Assessment Policy to select the policy to be applied to your OpenStack account, or click to go to the Policy Catalog page to create or select a policy. List of McAfee epo tags that are applied on VMs discovered for this OpenStack account. Tag name can include characters a z, A Z, 0 9, and [_. ], with space. For details about Tag usage, see the product documentation for McAfee epo. Specify the interval for McAfee epo to OpenStack synchronization (the default value is 5 minutes. The maximum value is 60 minutes). If you specify the sync interval as 5 minutes, the next sync is scheduled 5 minutes after the completion of the current sync. 5 (Optional) Windows Domain Logon Credentials: type the credentials to deploy the McAfee Agent package. Make sure that the McAfee epo server and the VMs in the OpenStack cloud can communicate with each other. 6 Click Test Connection to validate the account details and verify the connection to the OpenStack cloud. 7 Click Submit to register the cloud account. This action registers the OpenStack cloud and imports all discovered VMs, which are unmanaged, into the System Tree. The instances are imported with the structure and hierarchy of the OpenStack cloud. The VMs that are already added and managed by McAfee epo are retained with the existing policy settings. 8 View the imported VMs: Select Menu Systems Cloud Workload Security on McAfee epo to view, assess, and remediate your cloud asset information. Select Menu System Tree in McAfee epo. You can find your OpenStack account under the group OpenStack. The virtual machines from OpenStack are logically grouped with the hierarchy OpenStack Cloud account name Region instances. Register a Network Security Manager account Register a McAfee Network Security Manager (Manager) account with McAfee epo so that McAfee epo can communicate with the Manager server. Before you begin Ensure that: You have your Manager account and its details ready. You installed the Cloud Workload Security License extension on McAfee epo. After registering your Manager account, you can deploy vnsp probe to your cloud infrastructure using Cloud Workload Security. McAfee Cloud Workload Security Installation Guide 31