McAfee Rogue Database Detection For use with epolicy Orchestrator Software

Transcription

1 McAfee Rogue Database Detection For use with epolicy Orchestrator Software

2 COPYRIGHT Copyright 2012 McAfee, Inc. Do not copy without permission. TRADEMARK ATTRIBUTIONS McAfee, the McAfee logo, McAfee Active Protection, McAfee AppPrism, McAfee Artemis, McAfee CleanBoot, McAfee DeepSAFE, epolicy Orchestrator, McAfee epo, McAfee EMM, McAfee Enterprise Mobility Management, Foundscore, Foundstone, McAfee NetPrism, McAfee Policy Enforcer, Policy Lab, McAfee QuickClean, Safe Eyes, McAfee SECURE, SecureOS, McAfee Shredder, SiteAdvisor, SmartFilter, McAfee Stinger, McAfee Total Protection, TrustedSource, VirusScan, WaveSecure, WormTraq are trademarks or registered trademarks of McAfee, Inc. or its subsidiaries in the United States and other countries. Other names and brands may be claimed as the property of others. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 McAfee Rogue Database Detection 1.0.0

3 Contents Preface 5 About this guide Audience Conventions Find product documentation Introduction 7 How McAfee Rogue Database Detection works Deployment Installation and setup 9 Install the RDD extension Check in the RDD agent package Deploy the RDD agent on the client system Configure database detection policy Uninstall the RDD extension On-demand scans 13 Create an RDD client task Deploy an RDD client task Scan results 15 View scan results Index 17 McAfee Rogue Database Detection

4 Contents 4 McAfee Rogue Database Detection 1.0.0

5 Preface This guide provides the information you need to configure, use, and maintain your McAfee product. Contents About this guide Find product documentation About this guide This information describes the guide's target audience, the typographical conventions and icons used in this guide, and how the guide is organized. Audience McAfee documentation is carefully researched and written for the target audience. The information in this guide is intended primarily for: Administrators People who implement and enforce the company's security program. Users People who use the computer where the software is running and can access some or all of its features. Conventions This guide uses the following typographical conventions and icons. Book title or Emphasis Title of a book, chapter, or topic; introduction of a new term; emphasis. Bold User input or Path Code Text that is strongly emphasized. Commands and other text that the user types; the path of a folder or program. A code sample. User interface Hypertext blue Words in the user interface including options, menus, buttons, and dialog boxes. A live link to a topic or to a website. Note: Additional information, like an alternate method of accessing an option. Tip: Suggestions and recommendations. Important/Caution: Valuable advice to protect your computer system, software installation, network, business, or data. Warning: Critical advice to prevent bodily harm when using a hardware product. McAfee Rogue Database Detection

6 Preface Find product documentation Find product documentation McAfee provides the information you need during each phase of product implementation, from installation to daily use and troubleshooting. After a product is released, information about the product is entered into the McAfee online KnowledgeBase. Task 1 Go to the McAfee Technical Support ServicePortal at 2 Under Self Service, access the type of information you need: To access... User documentation Do this... 1 Click Product Documentation. 2 Select a product, then select a version. 3 Select a product document. KnowledgeBase Click Search the KnowledgeBase for answers to your product questions. Click Browse the KnowledgeBase for articles listed by product and version. 6 McAfee Rogue Database Detection 1.0.0

7 1 Introduction 1 McAfee Rogue Database Detection (RDD) extends the abilities of McAfee Rogue System Detection (RSD) by providing the ability to find and identify databases in the network that are not being managed by McAfee epolicy Orchestrator (McAfee epo). Contents How McAfee Rogue Database Detection works Deployment How McAfee Rogue Database Detection works RDD uses the following to discover and report rogue databases: RDD extension, installed on the McAfee epolicy Orchestrator server RDD agent, a Windows native agent, which is managed by and communicates with McAfee epo using the McAfee agent RDD settings, configured as policy and task settings The RDD agent is deployed on one or more client systems and discovers databases by detecting open ports and by using database communication protocols. RDD can be used in these ways: Passive detection: The RDD agent and the RSD sensor are deployed on the machine, with the RDD agent scanning the nodes detected by the RSD sensor. Active detection: The RDD agent searches for systems and checks them for databases according to the scan policy defined in a client task. The detected rogue databases can be added to the System Tree, enabling them to be managed by the McAfee Vulnerability Manager for Databases and included in future database vulnerability scans. Deployment Before RDD can detect rogue databases, you must install the product extension on McAfee epo. Required components McAfee epolicy Orchestrator version or later McAfee Vulnerability Manager for Databases extension version or later McAfee Rogue Database Detection

8 1 Introduction Deployment McAfee Rogue System Detection (RSD) version 4.7 or later McAfee Agent version 4.6 or later 8 McAfee Rogue Database Detection 1.0.0

9 2 2 Installation and setup For McAfee Rogue Database Detection to be used within epolicy Orchestrator software, you must first download and install the product extension, then check in and deploy the RDD agent package. Contents Install the RDD extension Check in the RDD agent package Deploy the RDD agent on the client system Configure database detection policy Uninstall the RDD extension Install the RDD extension To activate and use Rogue Database Detection, install the RDD extension in McAfee epolicy Orchestrator. Before you begin Back up the epo back-end database. Task For option definitions, click? in the interface. 1 From the McAfee website, download the dbsecrdd<version><build>.zip file to a temporary location. 2 From the epolicy Orchestrator console, click Menu Software Extensions. 3 In the Extensions pane, click Install Extension. 4 Browse to and select dbsecrdd<version><build>.zip, then click OK. The file is automatically extracted, and the Install Package dialog box is displayed. 5 Select the Rogue DBMS Detection package for installation, then click OK. The installation begins (it might take several minutes to complete). McAfee Rogue Database Detection

10 2 Installation and setup Check in the RDD agent package Check in the RDD agent package After you install the RDD extension, check in the RDD agent package that you will deploy to client systems. Before you begin Install the RDD extension Task For option definitions, click? in the interface. 1 From the epolicy Orchestrator console, click Master Repository, then click Check In Package. 2 In the Check In Package page, select Product or Update (.ZIP) as the package type. 3 Click Browse to locate and select the RDD_Agent-<version><build>.zip file, then click Next. 4 Select the Current branch, select the More existing packages... checkbox, then click Save. The package is listed in the Master Repository. Deploy the RDD agent on the client system Deploy the RDD agent to client sytems to allow network discovery of databases. The McAfee agent package and the RDD agent package must be deployed on the same client system. Before you begin Check in the RDD agent package Verify that the McAfee agent package has been checked in and deployed The RDD agent runs on Windows platforms only. Task For option definitions, click? in the interface. 1 From the epolicy Orchestrator console, click Menu Policy Client Task Catalog. 2 Click McAfee Agent Product Deployment. 3 Click New Task. The Edit Task page is displayed. 4 In the Task Name field, enter a name for the task. We recommend that the name clearly reflect the nature of the task. 5 In Target platforms section, select Windows. 6 In Products and components section: a b Select Rogue DBMS Detection Agent. From the Action drop-down list, select Install. If you want to remove a deployed agent, select Remove from the Action drop-down list. 10 McAfee Rogue Database Detection 1.0.0

11 Installation and setup Configure database detection policy 2 7 Click Save. 8 In the Client Task Catalog, click the task's Assign link to select the agents to perform the install, then schedule the task. For more information, see the epolicy Orchestrator documentation. The agent package is deployed. Configure database detection policy Use the RDD polilcy in epolicy Orchestrator to configure the global settings for rogue database detection, and enable or disable Rogue DBMS detection for all databases types. For each database type, you can configure the ports or port ranges to scan. You can also configure RDD to guess database instance names (depending on the database type). Task For option definitions, click? in the interface. 1 From the epolicy Orchestrator console, click Menu Policy Rogue DBMS Detection. 2 In the Rogue DBMS Database section, select or deselect Enabled to enable or disable RDD. If this option is not selected, RDD is not available for any of the database type. 3 For each database type: a b c d Select or deselect Enabled to enable or disable RDD for that type of database. Select or deselect Scan Default Ports to scan the default port range. In the Additional Ports field, specify additional ports or port ranges to scan. Select or deselect Guess... instance names as applicable. 4 (Optional) If passive scanning is in use, you can exclude workstations from the scan by selecting Ignore Workstations. 5 If you have received specific parameters from your support group, you can enter them in the Advanced Parameters field. 6 Click Save. Uninstall the RDD extension Use epolicy Orchestrator to remove the McAfee Rogue Database Detection extension. Uninstalling an extension permanently deletes its data. Task 1 From the epolicy Orchestrator console, click Menu Software Extensions. 2 From the Extensions list, select Rogue Database Detection and the corresponding Help Content extension, then click Remove. 3 When prompted to confirm, click OK. Note: Selecting the Force removal... option is not recommended. McAfee Rogue Database Detection

12 2 Installation and setup Uninstall the RDD extension The McAfee Rogue Database Detection extension is uninstalled. Tables containing detected DBMS data are stored in the epo back-end database. These tables are not removed when you uninstall the RDD extension. You can delete these tables by running the mssql_schema _drop_full.sql script, which is available in the "sql" folder of the RDD extension zip file. 12 McAfee Rogue Database Detection 1.0.0

13 3 On-demand 3 scans You can create and deploy client tasks to search for systems and check them for databases according to the scan policy defined in the task. Contents Create an RDD client task Deploy an RDD client task Create an RDD client task Before an IP scan can detect rogue databases, you need to create a client task to run an IP scan. Task For option definitions, click? in the interface. 1 From the epolicy Orchestrator console, click Menu Policy Client Task Catalog. 2 Click Rogue DBMS Detection Rogue DBMS on Demand IP Scan. 3 Click New Task. The Edit Task page is displayed. 4 In the Task Name field, enter a name for the task. We recommend that the name clearly reflect the nature of the task. 5 In the IP Scan Option field, enter the IP address range that you want to scan for rogue databases. 6 Click Save. 7 In the Client Task Catalog, click the task's Assign link to select the agents to perform the scan, then schedule the task. For more information, see the epolicy Orchestrator documentation. The client task is created. Deploy an RDD client task When you deploy an RDD client task you assign the task to client systems in your network and schedule when the task should be run. McAfee Rogue Database Detection

14 3 On-demand scans Deploy an RDD client task Task For option definitions, click? in the interface. 1 From the epolicy Orchestrator console, click Menu Policy Client Task Catalog. 2 Click Rogue DBMS Detection Rogue DBMS on Demand IP scan. 3 In the Rogue DBMS on Demand IP tasks list, click the task's Assign link. 4 In the Select a group to assign the task page, click OK. 5 In the Client Task Assignment Builder wizard, configure the client task object to assign to systems in your network. For more information, see the epolicy Orchestrator documentation. The task is deployed. 14 McAfee Rogue Database Detection 1.0.0

15 4 4 Scan results You can view the rogue databases detected by both Rogue System Detection and on-demand scans. View scan results You can view the results of RDD scans and add the relevant databases (databases that you would like to manage using McAfee Vulnerability Manager for Databases) to the epolicy Orchestrator System Tree. Task For option definitions, click? in the interface. 1 From the McAfee epolicy Orchestrator console, click Menu Systems Detected System. 2 In the Overall System Status section, select Rogue. Rogue systems and databases are listed. The database type appears at the start of each database entry. 3 (Optional) Click the database name to view additional details in a section below the list. 4 Select a database, then select Actions Detected Systems Add to System Tree. The database can now be managed by McAfee Vulnerability Manager for Databases and included in DVM scans. For more information, refer to McAfee Vulnerability Manager for Databases documentation. McAfee Rogue Database Detection

16 4 Scan results View scan results 16 McAfee Rogue Database Detection 1.0.0

17 Index A about this guide 5 agent package deploying RDD 10 C check in agent package 10 conventions and icons used in this guide 5 create client task 13 D deploy RDD agent package on end node 10 deploy scan 13 detected database types 11 detection policy 11 documentation audience for this guide 5 product-specific, finding 6 typographical conventions and icons 5 downloads, Rogue Database Detection extension 9 E extension, McAfee Rogue Database Detection installing 9 uninstalling 11 G guess instance names 11 I installation, McAfee Rogue Database Detection deploying the package 9 downloading the package 9 installation, McAfee Rogue Database Detection (continued) product extension 9 instance names 11 M McAfee ServicePortal, accessing 6 P packages deploying 9 installing 9 installing and downloading 9 R RDD agent package checking in 10 required components 7 Rogue Database Detection deployment 7 enable or disable 11 installation 9 overview 7 policy 11 rogue databases add to System Tree 15 S scan deploy 13 results 15 ServicePortal, finding product documentation 6 T Technical Support, finding product information 6 McAfee Rogue Database Detection

18 00