Symantec Control Compliance Suite Getting Started Guide. Version: 11.0

Transcription

1 Symantec Control Compliance Suite Getting Started Guide Version: 11.0

2 Symantec Control Compliance Suite Getting Started Guide The software described in this book is furnished under a license agreement and may be used only in accordance with the terms of the agreement. Documentation version: 11.0 Legal Notice Copyright 2012 Symantec Corporation. All rights reserved. Symantec, the Symantec Logo and the Checkmark Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. This Symantec product may contain third party software for which Symantec is required to provide attribution to the third party ( Third Party Programs ). Some of the Third Party Programs are available under open source or free software licenses. The License Agreement accompanying the Software does not alter any rights or obligations you may have under those open source or free software licenses. Please see the Third Party Legal Notice Appendix to this Documentation or TPIP ReadMe File accompanying this Symantec product for more information on the Third Party Programs. The product described in this document is distributed under licenses restricting its use, copying, distribution, and decompilation/reverse engineering. No part of this document may be reproduced in any form by any means without prior written authorization of Symantec Corporation and its licensors, if any. THE DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE. The Licensed Software and Documentation are deemed to be commercial computer software as defined in FAR and subject to restricted rights as defined in FAR Section "Commercial Computer Software - Restricted Rights" and DFARS , et seq."rights in Commercial Computer Software or Commercial Computer Software Documentation", as applicable, and any successor regulations. Any use, modification, reproduction release, performance, display or disclosure of the Licensed Software and Documentation by the U.S. Government shall be solely in accordance with the terms of this Agreement. Personal Information. You may configure the Licensed Software to collect personal information, including but not limited to, IP address, domain name, domain users, user name, login passwords, security logs, server logs, which is stored on Your system only and

3 is not transmitted to Symantec. Please contact Your network administrator for further details. Telemetry Option; Non-Personal Information. The Licensed Software contains a telemetry feature which may collect non-personal information. Such non-personal information may include, without limitation, machine configuration, SQL server details, license status, and system performance and will not be correlated with any personal information. Unless You affirmatively opt-out of this feature, telemetry will be automatically enabled to transmit such non-personal information to Symantec so we can better understand the usability and supportability of the product. Symantec Corporation 350 Ellis Street Mountain View, CA

4 Technical Support Contacting Technical Support Symantec Technical Support maintains support centers globally. Technical Support s primary role is to respond to specific queries about product features and functionality. The Technical Support group also creates content for our online Knowledge Base. The Technical Support group works collaboratively with the other functional areas within Symantec to answer your questions in a timely fashion. For example, the Technical Support group works with Product Engineering and Symantec Security Response to provide alerting services and virus definition updates. Symantec s support offerings include the following: A range of support options that give you the flexibility to select the right amount of service for any size organization Telephone and/or Web-based support that provides rapid response and up-to-the-minute information Upgrade assurance that delivers software upgrades Global support purchased on a regional business hours or 24 hours a day, 7 days a week basis Premium service offerings that include Account Management Services For information about Symantec s support offerings, you can visit our Web site at the following URL: All support services will be delivered in accordance with your support agreement and the then-current enterprise technical support policy. Customers with a current support agreement may access Technical Support information at the following URL: Before contacting Technical Support, make sure you have satisfied the system requirements that are listed in your product documentation. Also, you should be at the computer on which the problem occurred, in case it is necessary to replicate the problem. When you contact Technical Support, please have the following information available: Product release level

5 Hardware information Available memory, disk space, and NIC information Operating system Version and patch level Network topology Licensing and registration Customer service Router, gateway, and IP address information Problem description: Error messages and log files Troubleshooting that was performed before contacting Symantec Recent software configuration changes and network changes If your Symantec product requires registration or a license key, access our technical support Web page at the following URL: Customer service information is available at the following URL: Customer Service is available to assist with non-technical questions, such as the following types of issues: Questions regarding product licensing or serialization Product registration updates, such as address or name changes General product information (features, language availability, local dealers) Latest information about product updates and upgrades Information about upgrade assurance and support contracts Information about the Symantec Buying Programs Advice about Symantec's technical support options Nontechnical presales questions Issues that are related to CD-ROMs, DVDs, or manuals

6 Support agreement resources If you want to contact Symantec regarding an existing support agreement, please contact the support agreement administration team for your region as follows: Asia-Pacific and Japan Europe, Middle-East, and Africa North America and Latin America

7 Getting started with Symantec Control Compliance Suite This document includes the following topics: What is CCS? How do I achieve my objectives with CCS? How do I collect asset data to achieve my objectives? What are the components of CCS? What are the minimum hardware and software requirements for installing the CCS components? How do I install CCS for the first time? How do I upgrade to CCS 11.0? What configurations are required for collecting data from my network? How do I use CCS to manage the IT assets? How do I use CCS for assessing technical controls? How can I use CCS to plan for internal and external audits? How can I use CCS to assess IT risk? How can I use CCS to evaluate exposure to external threats, and assess procedural and data controls? How do I collect and monitor data in CCS?

8 8 Getting started with Symantec Control Compliance Suite What is CCS? Where can I find more information about CCS? What is CCS? Symantec Control Compliance Suite (CCS) automates key IT risk and compliance management tasks. CCS ensures the coverage of external mandates through written policy creation, dissemination, acceptance logs, and exception management. CCS demonstrates compliance to both external regulatory mandates and internal policies. CCS allows customers to link the written policy to specific technical and procedural standards. Customers can assess these policies using a highly scalable agent-less or agent-based tool. CCS scores assessment results against specified risk criteria. CCS supports automated assessment of the system security configuration, permissions, patches, and vulnerabilities. CCS also supports the assessment of procedural controls and entitlement review through a manual attestation process. CCS includes system reporting capabilities. CCS is an integrated solution comprising of different modules. You can use a combination of these modules to meet your objectives. You can recover the CCS components in case of a failure. This document provides disaster recovery and migration procedures for the following scenarios. See How do I achieve my objectives with CCS? on page 8. How do I achieve my objectives with CCS? The following table lists the CCS features that you can use to achieve your objectives:

9 Getting started with Symantec Control Compliance Suite How do I achieve my objectives with CCS? 9 Table 1-1 How to achieve your business objective with CCS Business objective to achieve Plan for internal and external audits Assess technical controls How CCS helps achieve the objective Policy Manager CCS hosts more than 150 customizable sample policies and templates. The policies are mapped to technical and procedural controls that let you measure a given a control and use the results across multiple mandates. You can also import your own data from the existing data collection solution to use the CCS Policy Manager Standards Manager CCS provides a capacity to assess the security compliance of the assets against a set of standards. You can use pre-defined standards or can create custom standards to evaluate your assets. You can also import your own data from the existing data collection solution to use the CCS Policy Manager Evaluate exposure to external threats Assess procedural controls External Data Integration CCS provides a capability to integrate with external data systems. CCS also supports Vulnerability Manager as a pre-integrated external data systems. You can use the Vulnerability Manager to prevent threats to critical assets by quickly identifying vulnerabilities in your most sensitive servers, Web-based applications, operating systems, and databases. External Data Integration CCS provides a capability to integrate with external data systems. CCS also supports Response Assessment Module (RAM) as a pre-integrated external data systems. You can use RAM for procedural controls with its built-in content and mandates. Assess data controls External Data Integration CCS provides a capability to integrate with external data systems. CCS also supports Data Loss Prevention (DLP) as a pre-integrated external data systems. You can use DLP to scans your network, endpoints, and servers to check the loss of sensitive data

10 10 Getting started with Symantec Control Compliance Suite How do I collect asset data to achieve my objectives? Table 1-1 How to achieve your business objective with CCS (continued) Business objective to achieve Assess IT risk How CCS helps achieve the objective Risk Manager CCS enables you to Transform IT risk into business-relevant risk metrics that can be shared with key stakeholders to drive awareness, accountability, and action. You can visualize current risk exposure and analyze historical trends to illustrate how your IT risk and compliance program systematically reduces risks to the business over time. You can prioritize remediation efforts based on business risk rather than technical severity. You can work with key business stakeholders to make consistent plans for better security practices within their business and monitor progress against these plans on an ongoing basis. Report on IT risk and compliance posture Reports and Dynamic dashboards CCS supports various predefined reports and dynamic dashboards to present a snapshot of the compliance posture of your system. How do I collect asset data to achieve my objectives? You must collect asset data from your enterprise network in order to achieve your objectives using CCS. Following are the ways in which you can collect asset data from your enterprise network. You can decide the deployment model based on the data collection solution that you choose to collect data for the assets. The different solutions available for data collection are listed in the table below. Table 1-2 Use case Raw-data based Deployment model based on the data collection solution Description Raw-data based collection lets you collect asset data from your enterprise network. The collected data is then evaluated against a standard in CCS. You can collect raw-data using the agent-less method or the agent-based method.

11 Getting started with Symantec Control Compliance Suite How do I collect asset data to achieve my objectives? 11 Table 1-2 Use case Message based Deployment model based on the data collection solution (continued) Description Message based collection lets you collect and interpret asset data from your enterprise network before sending the data to CCS. The CCS Agent installed on each computer in the enterprise network performs the actual task of data collection and interpretation. The CCS Agent interprets the data against the standards or policies and presents the data to CCS in the form of messages. External data integration External data integration lets you seamlessly import data from an application that is external to CCS and represent the data in CCS as a data schema. The collected data is then evaluated against a standard in CCS. Both agent-less and agent-based methods allow you to collect asset data from the following platforms: Windows UNIX Oracle Microsoft SQL Server In addition to this, you can deploy the RMS information server for collecting raw data from the following platforms: Exchange VMware Message based data collection allows you to collect data from the following additional platforms: DB2 Sybase VMware

12 12 Getting started with Symantec Control Compliance Suite What are the components of CCS? What are the components of CCS? CCS consists of a number of components that work together. The components collect, store, and analyze data from the network, then transmit that data to clients in a usable form. In some instances, a single computer can serve in more than one role. Other roles require a dedicated server. See Figure 1-1 on page 12. illustrates how the CCS components work together. Figure 1-1 CCS Infrastructure Architecture Diagram The various components of CCS can be described as follows:

13 Getting started with Symantec Control Compliance Suite What are the components of CCS? 13 Table 1-3 Components of CCS Component Application Server Description The CCS Application Server is the hub of CCS. The Directory Service in the CCS Application Server stores information about business objects, preferences, and other information. In addition, the Directory Service hosts the certificate authority for the CCS system, and issues and validates certificates. Certificates are used to ensure secure communications between the CCS components. CCS jobs flow from the CCS Console to the Application Server and then to one of the CCS Manager Load Balancers. When reports are complete, the Application Server retrieves the report from the reporting database and sends it to the console for display to the user. In addition, the Application Server manages data storage and manages the scheduled jobs and workflow in the production database. CCS Manager CCS Manager performs up to five different duties in CCS. Each of these duties is called a role. A single instance of the CCS Manager can provide more than one role simultaneously. Normally, a CCS deployment includes many servers that each hosts a CCS Manager installation. When a deployment contains multiple CCS Manager installations, each CCS Manager performs a single role. CCS Agent The CCS Agent resides on the computers in your network. The CCS Agent collects data about the target computer and forwards the data to the CCS Manager. The CCS Agent can: Collect and interpret data about the security of the computer. The resulting data is forwarded to the CCS Manager. Collect data about the security of the computer and forward the data to the CCS Manager.

14 14 Getting started with Symantec Control Compliance Suite What are the minimum hardware and software requirements for installing the CCS components? Table 1-3 Component Databases Components of CCS (continued) Description CCS hosts the production and reporting databases. CCS Console CCS Console is a Windows application that runs on a client computer. The console allows access to the full range of CCS activities. Only users who have been assigned to roles that allow them to work in the console can perform activities in the console. Web Console CCS Web Console lets users access a subset of the CCS functionality using Internet Explorer 8.0. What are the minimum hardware and software requirements for installing the CCS components? The following table contains the minimum requirements for each component. Table 1-4 CCS server requirements Component name Hardware requirements Required operating system Software requirements Application Server and Web Console server Minimum memory: 4 GB Minimum processor: 2.8 GHz Minimum hard disk space: 20 GB Windows Server 2003 Enterprise or Standard edition SP2 x64, R2 SP2 x64 Windows Server 2008 Enterprise or Standard edition SP2 x64, R2 x64 Note: You can perform a fresh installation of the CCS Application Server version 11.0 only on a computer running a 64 bit operating system. However, you can upgrade an existing CCS Application Server installed on a computer running a 32 bit operating system, to CCS Application Server version Microsoft visual C redistributable framework. Microsoft.NET 4.0 framework. Microsoft.NET Framework 3.5 SP1. ADAM SP1 / ADLDS. Microsoft Core XML Service(MSXML) 6.0. Symantec LiveUpdate Client Internet Information Services (IIS) 6.0, 7.0 or 7.5. Static Content and Windows Authentication required for IIS 7.0 and above.

15 Getting started with Symantec Control Compliance Suite What are the minimum hardware and software requirements for installing the CCS components? 15 Table 1-4 CCS server requirements (continued) Component name Hardware requirements Required operating system Software requirements Production database or Reporting database Minimum memory: 4 GB Minimum processor: 2.8 GHz Minimum hard disk space: 50 GB Windows Server 2003 Enterprise or Standard edition SP2, SP2 x64, R2 SP2, R2 SP2 x64 Windows Server 2008 Enterprise or Standard edition SP1, SP1 x64, SP2, SP2 x64, R2 x64 Microsoft SQL Server 2005 SP2 or later Microsoft SQL Server 2008 SP1, SP2 Microsoft SQL Server 2008 R2 CCS supports 32 bit and 64 bit versions of the SQL Server. CCS Manager Minimum memory: 2 GB Minimum processor: 2.8 GHz Minimum hard disk space: 20 GB Windows Server 2003 Enterprise or Standard edition SP2, SP2 x64, R2 SP2, R2 SP2 x64 Windows Server 2008 Enterprise or Standard edition SP1, SP1 x64, SP2, SP2 x64, R2 x64 Ensure that the computer on which you install the CCS Manager has the latest Windows Service Pack along with the latest updates. Note: CCS 11.0 does not support CCS Manager installation on the Windows Core operating system. Microsoft visual C redistributable framework. Microsoft.NET 4.0 framework. Crystal Reports 2010 for CCS Manager in a reporting role. SQL DMO Oracle Instance Client for collecting data from Oracle. Microsoft Access Database Engine Internet Information Services (IIS) 6.0, 7.0 or 7.5. Static Content and Windows Authentication required for IIS 7.0 and above. CCS Agent Minimum memory: 1 GB Minimum processor: 1.33 GHz Minimum hard disk space: 2 GB Swap space: 1 GB For information on supported target computers for agent-based data collection, see the Symantec Control Compliance Suite Planning and Deployment Guide. For information on supported databases for agent-based data collection, see the Symantec Control Compliance Suite Planning and Deployment Guide.

16 16 Getting started with Symantec Control Compliance Suite How do I install CCS for the first time? Table 1-4 CCS server requirements (continued) Component name Hardware requirements Required operating system Software requirements CCS Console Minimum memory: 2 GB Minimum processor: 2.8 GHz Minimum hard disk space: 20 GB Note: The hardware requirements would differ if you are installing and launching the CCS Console as a stand-alone component on a separate computer. Windows XP Professional SP2 x64, SP3 Windows Vista Business or Enterprise SP1, SP1 x64, SP2, SP2 x64 Windows 7, x64 Windows Server 2003 Enterprise or Standard edition SP2, SP2 x64, R2 SP2, R2 SP2 x64 Windows Server 2008 Enterprise or Standard edition SP1, SP1 x64, SP2, SP2 x64, R2 x64 Microsoft visual C redistributable framework. Microsoft.NET 4.0 redistributable framework. CCS Setup installs some prerequisite software while installing the CCS components. For detailed information about the software requirements, network ports requirements and the user privileges required for installing the components and databases, see the Symantec Control Compliance Suite Planning and Deployment Guide. How do I install CCS for the first time? The CCS setup consists of separate installers for installing the following CCS components: CCS Suite: The CCS Suite consists of the CCS Application Server and the CCS Manager. CCS Application Server is the core component of CCS. Installing the CCS Application Server also installs the CCS Console, the CCS Web Console and the Certificate Management Console on the same computer. CCS Manager: The CCS Manager setup is used to install a stand-alone CCS Manager for a scale-out deployment. The CCS Manager also installs the CCS Agent on the

17 Getting started with Symantec Control Compliance Suite How do I install CCS for the first time? 17 same computer. You must create certificates using the Certificate Management Console, for installing stand-alone CCS Managers. CCS Agent: The CCS Agent setup is used to install the CCS agents on target computers, for agent-based data collection. You can install CCS Agents on Windows or UNIX computers. In addition, the CCS setup also contains installer for installing the CCS Content for evaluating asset data with the standards. You must install the CCS Suite before installing the CCS content. For message based data collection, you require to install and configure the application modules on CCS Agents. The CCS setup contains the application modules and related documentation. Let us assume that you want to deploy CCS and collect data from two sites as displayed in the following diagram: Figure 1-2 Example of CCS deployment Site A has the CCS core components: CCS Application Server, CCS Consoles and the databases. Site A also has a CCS Manager with the roles of Load Balancer and Data Collector, collecting data from Windows targets and SQL targets.

18 18 Getting started with Symantec Control Compliance Suite How do I upgrade to CCS 11.0? Similarly, Site B has a CCS Manager with the role of Data Collector collecting data from Windows targets in two domains ABC.com and PQR.com, and collecting data from UNIX targets using the CCS agents, and also collecting data from Oracle targets. For detailed information and procedures for installing the CCS components, see the Symantec Control Compliance Suite Planning and Deployment Guide. How do I upgrade to CCS 11.0? The upgrade to the latest release version of the Control Compliance Suite (CCS) lets you access the new and updated features and functionality of the product. If you are using RMS or ESM to collect asset data, you can upgrade to CCS to benefit from new and improved data collection features offered by CCS CCS 11.0 introduces the CCS Manager and CCS Agents for data collection. This not only reduces the number of components previously required for performing data collection, but also deploy a system that is more cohesive and tightly integrated than have separate set of products performing the data collection and evaluating the data. CCS 11.0 supports direct upgrade from CCS 10.0 and CCS For upgrading ESM deployments, CCS 11.0 supports direct upgrade from ESM Service Pack 2, ESM 9.0, ESM and ESM Upgrade the ESM Console to ESM Console ESM console is required to initiate policy runs for message based data collection. While upgrading from a version earlier than CCS , before you begin with the upgrade process, verify that the data migration of the previous CCS installation is complete. Symantec recommends that you complete the data migration of the previous CCS installation and then begin with the upgrade process followed by data migration again. After you upgrade the CCS components, you must migrate the databases to the latest database schema. The following table gives the various upgrade paths that are supported.

19 Getting started with Symantec Control Compliance Suite How do I upgrade to CCS 11.0? 19 Table 1-5 Supported upgrade paths Supported upgrade path CCS to CCS 11.0 Description Use the following sequence to upgrade: 1 Upgrade CCS to CCS OR CCS to CCS Then CCS 10.5 to CCS Upgrade CCS 10.0 / CCS to CCS If you are upgrading from CCS 10.0 to 11.0, ensure that data migration till 10.0 is already complete before you upgrade 10.0 to You must perform data migration again after upgrading to Data migration is not required if you are upgrading from CCS to CCS CCS 10.0 to CCS 11.0 Upgrade CCS 10.0 to CCS Ensure that data migration till 10.0 is already complete before you upgrade 10.0 to You must perform data migration again after upgrading to CCS 10.5 to CCS 11.0 Use the following sequence to upgrade: 1 Upgrade CCS 10.5 to CCS Upgrade CCS to CCS Data migration is not required if you are upgrading from CCS to CCS CCS to CCS 11.0 Upgrade CCS to CCS Data migration is not required if you are upgrading from CCS to CCS ESM to CCS 11.0 ESM 9.0 to CCS 11.0 Upgrade ESM to CCS Note: CCS 11.0 supports upgrading ESM Agent SP2 or later to CCS Agent and ESM Manager 9.0 or later to CCS Manager. Upgrade ESM 9.0 to CCS 11.0.

20 20 Getting started with Symantec Control Compliance Suite How do I upgrade to CCS 11.0? Table 1-5 Supported upgrade paths (continued) Supported upgrade path ESM to CCS 11.0 ESM 10.0 to CCS 11.0 Description Upgrade ESM to CCS Upgrade ESM 10.0 to CCS Upgrading an RMS deployment If you are using RMS to collect asset data you can move your RMS-only deployment to CCS In which case you will have to install CCS Suite and then upgrade the BV-Control for UNIX agents to CCS Agents. If your existing deployment contains a CCS installation, you can upgrade the following CCS components: Upgrade CCS Application Server and CCS Directory Server. Upgrade Data Processing Service to CCS Manager. You can replace the following RMS components in your deployment: Replace the BV-Control for UNIX Agents with the CCS Agents: In your existing deployment, if you are collecting data from UNIX computers using the BV-Control for UNIX Agents, you can replace those agents with the CCS Agents. It is recommended that until you complete the upgrade and perform data collection from the new deployment for the first time, you should maintain a co-existence of the BV-Control for UNIX Agents and the CCS Agents. Later, once you are sure that you are able to collect data from the new CCS Agents, you can remove the BV-Control for UNIX Agents from the target computers, and perform a remote upgrade of the remaining BV-Control for UNIX Agents through the CCS Console. Replace the RMS Information Server with the CCS Manager: You can replace the RMS Information Server with the CCS Manager for performing data collection. The new CCS Manager has built in capabilities for performing both agent-less and agent-based data collection. As such the CCS Manager also supports message based data collection. Replace the Windows Query Engines with CCS Manager. In your existing deployment, if you are collecting data from Windows computers, you may have Query Engines performing data collection. You can replace 4 such Query Engines with 1 CCS Manager. If your existing domains contain less number of Query Engines, and you require to place a CCS Manager for query engines from multiple domains, then ensure that there is a domain trust relationship between the domains that host the CCS Manager and the Query Engines.

21 Getting started with Symantec Control Compliance Suite How do I upgrade to CCS 11.0? 21 It is recommended that until you complete the upgrade and perform data collection from the new deployment for the first time, you should maintain a co-existence of the existing components with the new components of CCS Later, once you are sure that you are able to collect data from the new components, you can remove the existing components. Let us assume that your existing deployment is as displayed in the following diagram: Figure 1-3 Example of existing CCS + RMS deployment Site A has the CCS Reporting and Analytics components: CCS Application Server, CCS Directory Server, CCS Consoles and the databases. Site A also has a Data Processing Service (DPS) with the roles of Load Balancer and Data Collector, with an RMS information server collecting data from Windows targets using Query Engines, and also collecting data from SQL targets. Similarly, Site B has a DPS with the role of Data Collector and an RMS information server collecting data from Windows targets in two domains ABC.com and PQR.com, and collecting data from UNIX targets using the BV-Control for UNIX agents, and also collecting data from Oracle targets. Refer to the following diagram to upgrade the existing deployment to CCS 11.0:

22 22 Getting started with Symantec Control Compliance Suite How do I upgrade to CCS 11.0? Figure 1-4 Example of upgraded deployment to CCS 11.0 In Site A, you can upgrade the CCS Reporting and Analytics components: CCS Application Server and CCS Directory Server to CCS Upgrading the core components also upgrades the CCS Consoles. You can upgrade the DPS to CCS Manager with the roles of Load Balance and Data Collector. As the CCS Manager performs all the roles of the Data Processing Service and also provides built-in support to collect data directly from agent-less and agent-based target computers, the RMS Information Server, Enterprise Configuration Service (ECS) and the Master Query Engine (MQE) components are no longer required. You can configure the CCS Manager to collect data directly from the Windows and SQL targets. In Site B, you can upgrade the DPS to CCS Manager with the role of Data Collector. The CCS Manager can collect data directly from the target computer. As displayed in the diagram if the CCS Manager is in the domain ABC.com, ensure that there is a domain trust relationship between domains ABC.com and PQR.com, for the CCS Manager to collect data from targets in the domain PQR.com. Upgrade the BV-Control for UNIX agents to CCS Agents and configure the CCS Manager to collect data directly from the Windows, UNIX and Oracle targets. Upgrading an ESM deployment If you are using ESM to collect asset data you can move your ESM-only deployment to CCS In which case you will have to install CCS Suite and then upgrade the ESM components.

23 Getting started with Symantec Control Compliance Suite How do I upgrade to CCS 11.0? 23 You can upgrade the following ESM components while moving from an ESM only deployment to CCS 11.0: Upgrade ESM Managers to CCS Managers Upgrade the ESM utilities installed on the ESM Managers after upgrading the ESM Managers to CCS Managers. Upgrade ESM Agents to CCS Agents Upgrade ESM Console to ESM Console 11.0 If you are using ESM Manager for UNIX, upgrade to ESM Manager 11.0 for UNIX. If your existing deployment contains a CCS installation, you can upgrade the following CCS components: Upgrade CCS Application Server and CCS Directory Server. Upgrade Data Processing Service to CCS Manager. Let us assume that your existing deployment is as displayed in the following diagram:

24 24 Getting started with Symantec Control Compliance Suite How do I upgrade to CCS 11.0? Figure 1-5 Example of existing CCS + ESM deployment Site A has the CCS Reporting and Analytics components: CCS Application Server, CCS Directory Server, CCS Consoles and the databases. Site A also has a Data Processing Service (DPS) with the roles of Load Balance and Data Collector, and an ESM Manager with ESM Console, RDMS and ESM Agents collecting data on target computers. Similarly, Site B has a DPS with the role of Data Collector and an ESM Manager on UNIX with ESM Console and ESM Agents collecting data on target computers. Refer to the following diagram to upgrade the existing deployment to CCS 11.0:

25 Getting started with Symantec Control Compliance Suite How do I upgrade to CCS 11.0? 25 Figure 1-6 Example of upgraded deployment to CCS 11.0 In Site A, you can upgrade the CCS Reporting and Analytics components: CCS Application Server and CCS Directory Server to CCS Upgrading the core components also upgrades the CCS Consoles. You can upgrade the DPS to CCS Manager with the roles of Load Balance and Data Collector. You can upgrade the ESM Manager to CCS Manager, ESM Console to ESM Console 11.0 and ESM Agents to CCS Agents. In Site B, you can upgrade the DPS to CCS Manager with the role of Data Collector. The ESM Manager for UNIX to ESM Manager 11.0 for UNIX, ESM Console to ESM Console 11.0 and ESM Agents to CCS Agents. For reporting purposes, if you are using a RDBMS, and RDLs to connect to this database from ESM Managers, you can continue to use the RDBMS and RDLs after you upgrade to CCS Managers. You can also use the reporting and dashboard capabilities of CCS 11.0.

26 26 Getting started with Symantec Control Compliance Suite What configurations are required for collecting data from my network? For detailed information and procedures for upgrading the CCS components, see the Symantec Control Compliance Suite Planning and Deployment Guide. What configurations are required for collecting data from my network? In Control Compliance Suite 11.0, you can perform raw data based and message based data collection on various platforms using CCS Manager. Before actually performing the data collection you must configure the CCS Managers and CCS Agents to collect data. The following tables lists the supported platforms for raw-data and message based data. Table 1-6 Supported platforms for raw-data and message based data. Platform Windows UNIX SQL Oracle Exchange VMware NDS NetWare Sybase DB2 Raw data collection Yes Yes Yes Yes Yes Yes Upgrade only Upgrade only No No Message based data collection Yes Yes Yes Yes No Yes Upgrade only Upgrade only Yes Yes Note: CCS 11.0 supports NDS and NetWare data collectors only in case you are upgrading from a previous release of CCS and the CCS deployment was configured to collect data from NDS or NetWare platforms. You must perform the following configurations before you can actually asset collect data from your network. Configure CCS Manager and CCS Agents for data collection:

27 Getting started with Symantec Control Compliance Suite What configurations are required for collecting data from my network? 27 The CCS Manager contains data collectors for collecting data from the above mentioned platforms. You require to configure each of the required data collectors to perform data collection on the desired platforms. For agent-less data collection configure the CCS Manager to collect data using CSV files, ODBC-compliant database, or Directory Server. A CSV data collector is configured to collect data from the CSV files. An ODBC data collector is defined and configured to collect data from the ODBC-compliant databases. A Directory Server is defined and configured for data collection. For agent-based data collection enable the CCS Manager for collecting message based data and then install and configure the application modules and security content on CCS Agents. You must then import the security content from the CCS Agents to the CCS Manager. For information on the supported databases for agent-based data collection and on installing and configuring the application modules refer to the respective platform specific application module documentation or the see the Symantec Control Compliance Suite Planning and Deployment Guide. For raw data collection on VMware or Exchange platforms, you require to install the RMS Information Server and then configure the CCS Manager with the information server connection details. For information on installing and configuring RMS Information Server, see the Symantec Control Compliance Suite Installation Guide version For message based data collection on DB2, Sybase or VMware platforms, install the ESM Console to create policies on the such platforms. You must then map the ESM policies to CCS standards using the ESM Policy to CCS Standard Migration Utility. For information on installing the ESM Console, see the Symantec Enterprise Security Manager Installation Guide. Configure credentials: Control compliance Suite lets you manage credentials for agent-less and agent-based targets at a central location. The credentials can be used either for assets or to centrally store user name and password for WINDOWS, UNIX, SQL, Oracle users and use them in platform configuration. For agent-less data collection, configure common platform and folder credentials. For agent-based data collection, add common platform and folder credentials, and set the appropriate agent configuration parameters in the agent.conf file. Configure routing rules: Routing rules let you define a particular site or a CCS manager to perform the tasks that are related to your assets or your agents. A few asset-based tasks that you can manage with routing rules are as follows: Data collection

28 28 Getting started with Symantec Control Compliance Suite How do I use CCS to manage the IT assets? Queries SCAP A few agent-based tasks that you can manage with routing rules are as follows: Agent content update Agent settings Agent ping You can use routing rules to route CCS jobs based on your network environment or for achieving better load balancing. You can configure routing rules for assets based on IP range, Subnet, Expressions or Asset groups. For detailed information on configuring CCS Manager data collectors, credentials and routing rules, see the Symantec Control Compliance Suite 11.0 User Guide. How do I use CCS to manage the IT assets? You can use the Asset Management module of CCS for managing your IT assets. In Control Compliance Suite, an asset is defined as a managed object in the system that has value, has an owner, has controlled access, and can have authority. To define the known assets that need protection is the first step in the IT process governance. The primary goal of the asset management system is to present a consolidated view of the assets that are present in the organization. The asset system lets you manage the assets in the organization. The system also lets you exchange the context-specific information about the assets so that you can look at your organization from different perspectives. You can use the asset system to manage and monitor the assets that are valuable to your organization. Using Asset Management you can: Import the primary assets for the first time with the predefined reconciliation rules. Create reconciliation rules for further asset imports. Apply tags to the assets. Create asset groups. Import the secondary assets. For information on managing the IT assets, see the Symantec Control Compliance Suite 11.0 User Guide.

29 Getting started with Symantec Control Compliance Suite How do I use CCS for assessing technical controls? 29 How do I use CCS for assessing technical controls? You can use the Standards Manager module of CCS for accessing technical controls. The Standards management module in CCS automates the assessment of technical controls and security standards and helps you to evaluate the security posture and compliance status of your enterprise network. Using the Standards Manager you can: Assess the security compliance of the assets against a set of standards. Use pre-defined standards or create custom standards to evaluate your assets. Import your own data from the existing data collection solution to use the CCS Standards Manager. Standards provide the means for assessing the compliance of an asset. In Control Compliance Suite, a standard is a hierarchical organizational structure of sections and checks. Control Compliance Suite makes available a set of predefined standards that are installed along with the product. These standards are mostly derived from some published guidelines by established organizations such as CIS or NSA. You can also create new standards that are based on your specific requirements. For information on using the Standards Manager for assessing technical controls, see the Symantec Control Compliance Suite 11.0 User Guide. How can I use CCS to plan for internal and external audits? You can use the Policy Manager module of CCS for planning for internal and external audits. The Policy management module of CCS simplifies the process of complying with multiple mandates to improve the security and compliance posture of your environment. The module provides pre-shipped policy content mapped to technical and procedural controls. Policy updates are done on changes to regulations and frameworks. Using the Policy Manager you can: Manage, publish, and track your policies across the organization. Manage and publish policies with more than 150 customizable sample policies and templates. Map policies to technical and procedural controls that let you measure a given a control and use the results across multiple mandates. Collect evidence of due care of policy compliance.

30 30 Getting started with Symantec Control Compliance Suite How can I use CCS to assess IT risk? Import your own data from the existing data collection solution to use the CCS Policy Manager. Policies are mapped to the control statements that in turn are mapped to regulations and frameworks. Mapping helps you to see the existing gaps in the current policies of your organization. These gaps can exist between your current policies and the mandates with which your organization must comply. Mapping also helps you to meet the requirements of the mandates with which the organization must comply. For information on using the Policy Manager to plan for internal and external audits, see the Symantec Control Compliance Suite 11.0 User Guide. How can I use CCS to assess IT risk? You can use the Risk Manager module of CCS to assess IT risk of your organization. The Risk management module of CCS allows you to create a view of IT risks related to key business processes, groups, or functions. The module lets you define business related risk objectives, group together the associated assets, and report your performance against the risk thresholds. Business stakeholders can make informed decisions based on a business criticality instead of a technical severity. Using the Risk Manager you can: Transform IT risk into business-relevant risk metrics that can be shared with key stakeholders to drive awareness, accountability, and action. Visualize current risk exposure and analyze historical trends to illustrate how your IT risk and compliance program systematically reduces risks to the business over time. Prioritize remediation efforts based on business risk rather than technical severity. Work with key business stakeholders to make consistent plans for better security practices within their business and monitor progress against these plans on an ongoing basis. Risk management involves four major areas that are risk modeling, risk assessment, risk monitoring, and risk action. For information on using the Risk Manager to assess IT risk, see the Symantec Control Compliance Suite 11.0 User Guide.

31 Getting started with Symantec Control Compliance Suite How can I use CCS to evaluate exposure to external threats, and assess procedural and data controls? 31 How can I use CCS to evaluate exposure to external threats, and assess procedural and data controls? You can use the External Data Integration module of CCS to evaluate exposure to external threats, and assess procedural and data controls. External data integration lets you seamlessly assimilate data from an external application to Control Compliance Suite (CCS). The external data is represented as a data schema in CCS. Using the External Data Integration you can: Assess the Policy Compliance: Use the imported data to correlate with the CCS assets. You can then gauge the compliance over the assets based on policies, mandates, and regulations. Contribute to CCS Asset Risk Score: Use the imported data to contribute to the CCS asset risk score. A risk score is used to quantify the risk that is associated with an asset in your organization. View Dynamic Dashboards and Reports: Import external data and view the data using CCS dashboards without correlating the external data to CCS assets. Import external data and view the data using CCS dashboards in correlation with the CCS assets. By means of correlation, you basically establish an association between the imported data schema and the existing CCS assets. CCS provides you with the capability to define new schema, which you can map to a CCS schema by matching attributes. You can import external data by using any of the following preconfigured data systems: Symantec CCS Vulnerability Manager Symantec Data Loss Prevention Symantec Response Assessment Module You can also integrate with any third-party application and use the following data connectors to import the required data: ODBC data connector The ODBC connector lets you import data from an external system that stores data in the databases that support ODBC drivers. CSV data connector The CSV connector lets you import data from an external system that stores data in.csv files. Web Services connector

32 32 Getting started with Symantec Control Compliance Suite How do I collect and monitor data in CCS? The Web Services connector lets you import data from an external system that stores data.xml files and can export the data by using APIs. For information on importing external data and using the data to evaluate exposure to external threats, and assess procedural and data controls, see the Symantec Control Compliance Suite 11.0 User Guide. How do I collect and monitor data in CCS? You can use the Jobs module in CCS to perform queries to collect data from your network, and use various predefined reports and dynamic dashboards to present a snapshot of the compliance posture of your system. Various components of Control Compliance Suite (CCS) perform a set of operations sequentially. A job is a specified set of such operations. It is a query with a scope. For example, a query with a scope in the form of assets in a particular domain is called a job. A job is uniquely defined. There are two types of jobs in CCS: System jobs: The jobs that CCS automatically creates. These jobs perform certain predefined functions. User-defined jobs: The jobs that users create. Organizations collect vast amounts of information in the course of completing business transactions. Management studies the data to make decisions. The Reporting feature gives you timely information that you need to make informed decisions about the organization. Control Compliance Suite (CCS) provides a rich set of presentation-level reports. A report lets you collect and present the data in a format that conforms to the organizational needs. A report is a business document that contains a predefined, organized collection of data. A report can be viewed, printed, or analyzed. You can create and customize reports from the Reporting view. You can schedule the report generation or dashboard update jobs from the Jobs view. You can schedule reports and dashboard jobs to run at a specified time. If the report supports the feature, you can export a report in several formats. Dashboards that are created in the Web Console are real-time, visual representations of selected key elements for an organization. Dynamic dashboard is a business tool that displays key performance indicators (KPI), business trends, and other relevant information to management and employees. The panels in a dashboard use 2D and 3D charts to provide high level and relevant information at a glance. CCS provides the following types of dashboards:

33 Getting started with Symantec Control Compliance Suite Where can I find more information about CCS? 33 Tiered: A dashboard that is based on hierarchical dashboards with the sections and the nodes that logically represent your organization in different ways. Web-based: A dashboard that is based on selected key elements of an organization and can be adapted for each viewer. For information on collecting data using Jobs and monitoring data through reports and dashboards, see the Symantec Control Compliance Suite 11.0 User Guide. Where can I find more information about CCS? CCS provides a rich set of documents that cover end to end deployment and usage scenarios. For detailed information about all aspects of deploying and using CCS, refer to the following documents: CCS Planning and Deployment Guide: This document contains detailed information on how to plan and deployment CCS in your environment. The document contains information about the hardware requirements, software requirements, performance and scalability, various data collection methods including data collection from assets located on the cloud, integrating CCS with other Symantec products, upgrading CCS from previous releases and moving to CCS from RMS-only or ESM-only deployments. CCS User Guide: This document contains detailed information about the various features and modules of CCS and how to use the modules to achieve your objectives. The document contains information on how to configure CCS for data collection, manage CCS user for role based access, import assets from our network, collect data using jobs, evaluate the data using standards and view evaluated data through reports and dashboards. Release Notes: This document contains information about the new features introduced in CCS The document contains information about any installation or other issues that users should know before they install the Control Compliance Suite.