Getting Started. A Getting Started Guide for Locum SecureAudit MANUAL RELATIVE TO VERSION 17.0 LOCUM SOFTWARE SERVICES LIMITED

Transcription

1 Getting Started A Getting Started Guide for Locum SecureAudit MANUAL RELATIVE TO VERSION 17.0 LOCUM SOFTWARE SERVICES LIMITED Locum House, 84 Brown Street, Sheffield, S1 2BS, England Telephone: +44 (0) enquiries@locumsoftware.com Web:

2 Contents Contents... i System Requirements... 3 Windows Requirements... 3 MCP Requirements... 3 Network Requirements... 3 License Requirements... 3 Pre-requisites... 4 Installing SecureAudit and SecurityCenter on a Windows System... 4 Privilege Requirements... 4 First Steps... 5 Familiarise yourself with SecureAudit... 5 The SecureAudit Client Main Window... 5 Configuring a Connection... 7 About Connections... 7 Creating a New Connection... 7 The SecureAudit Client Database... 9 Creating a SecureAudit Client Database... 9 Reports To Create a Report Scheduling Reports Importing Scheduled (Host) Reports Correlation Reports Exporting Files to PDF The Visual Data Manager dialog Graphs The Generate Graph dialog Bar Graphs Line Graphs Pie Charts Role-Based Access Control Best Practices Index... i Contents i

3 System Requirements Windows Requirements SecureAudit Client runs on various Windows operating systems. Refer to the appropriate compatibility matrix on the Unisys Product Support Website. The matrices are accessible from the Compatibility link on the left pane. MCP Requirements SecureAudit requires an MCP version level equivalent to the SecureAudit version level, or one version higher or lower. For example, a 17.0 version of SecureAudit will run on MCP versions 16.0, 17.0 and Network Requirements SecureAudit Client expects the following port numbers to be available to the MCP host through any local firewalls: 139 NetBios 445 SMB SecureAudit non-ssl connection SecureAudit SSL connection License Requirements For customers who have the full Safe & Secure product marketed by Locum, the SecureAudit license will be embedded in the Safe & Secure license. The following explanation is valid for customers who have acquired SecureAudit via the Unisys release mechanisms, and who do not have the full Safe & Secure package marketed by Locum. No license key is required to run SecureAudit in Summary mode. For full functionality you must have a Unisys-supplied license key for SecureAudit (style xxx-lse-lse) that is compatible with the version of SecureAudit Host that is installed. For example, to use SecureAudit Host version , key LSE-LSE is required. This key will be valid on any MCP level from 57.1 to 59.1, providing it is used with the 17.0 level of SecureAudit Host. To order license keys and to obtain pricing information, contact your system supplier or Unisys representative. For a full explanation of the Unisys License Key mechanism, refer to the Guide to Unisys Licensing document, available in the Support section of the Locum website at Note that Try & Buy keys are available to allow a short evaluation period for the software. Try & Buy keys offer full functionality for a limited time and are available online at System Requirements 3

4 Pre-requisites Installing SecureAudit and SecurityCenter on a Windows System To be able to use SecureAudit Client, the Unisys SecurityCenter software must have previously been installed on both the Security Administrator Windows workstation and its MCP component on the MCP server. For information on how to install SecurityCenter, refer to the following Unisys documentation: Simple Installation Operations Guide Installation Center Operations Guide To install SecurityCenter client, access to the SecurityCenter directory of the INSTALLS share of your MCP server is necessary. The INSTALLS share should be visible by browsing the MCP host in the Windows network. For convenience, a local disk drive can also be mapped to the INSTALLS share after browsing to the appropriate location. Please refer to the Unisys Client Access Services Guide for information on how to connect to an MCP share. If no current version of SecurityCenter exists on the security administrator's workstation, run the 'SecurityCntr.msi' file in the INSTALLS\SecurityCenter directory. If a current version does exist, and this is an update to the current IC level of the current mark release, then ICUpdate.vbs should be run. If this is an update to a newer mark level, you must remove the current version, using Windows Add/Remove Programs, before installing the newer version. Refer to the Migration Guide for guidance in this area. Once SecurityCenter has been installed on the Windows workstation, SecureAudit Client will then be available as a snap-in within the SecurityCenter software. Privilege Requirements After installing the software for the first time, a user must have a minimum privilege of PU (Privileged User) status to run SecureAudit. If security administrator status is authorised, only a security administrator (a user marked as SECADMIN) can run SecureAudit. Such a user is allowed access to all the functions of the software. SecureAudit is enabled to use the Unisys RBAC (Role Based Access Control) implementation for applications. This is an alternative mechanism to the traditional privileges and allows the customer to define with fine granularity which users are allowed to use which functions of the software. For more information on this topic, refer to the Role Based Access Control section of this document. Pre-requisites 4

5 Familiarise yourself with SecureAudit First Steps Locum SecureAudit is a powerful auditing tool for checking ClearPath MCP systems and reporting on a wide range of events. It can be used in conjunction with Locum Software s full Safe & Secure suite to provide a comprehensive package to analyse and secure your systems. SecureAudit has two components: the Host, which runs on ClearPath MCP systems, and the Windows PC-based Client which provides a graphical user interface (GUI). While you can run SecureAudit Host in stand-alone mode directly on ClearPath MCP systems, the Client provides a user-friendly method of easily selecting and running reports. Reports run directly on the ClearPath MCP system are presented in a text format, but reports run through the SecureAudit Client can be viewed in a number of different ways, including bar and line graphs, and pie charts and can be output to PDF format. It is also possible to schedule reports and to import them from the host at a later time. For more information, see the Reports section. The SecureAudit Client Main Window The SecureAudit Client Main Window is divided into five areas. At the top of the Main Window are the Menu Bar and the Toolbar. On the left is the console tree. In the middle is the Main Window, on the right is the action pane and at the bottom of the main window is the status bar. This displays information about whatever you have currently selected. You can choose which elements of the SecureAudit Client window to show or hide by using the Customize View dialog. To access this, select either the Customize View option on the Program menu on the Toolbar, or the Customize option from the View menu on the Menu Bar. From the Customize View dialog, you can choose to show or hide the following items: Console tree Standard menus (Action and View) Standard toolbar Status bar Description bar Taskpad navigation tabs Action pane Snap-in Menus Snap-in Toolbars First Steps 5

6 The SecureAudit Client Main Window The SecureAudit Client Menu Bar The Menu Bar contains the Program and Help menus., File, Action, View, Favorites, Window The SecureAudit Client Toolbar The Toolbar contains a number of shortcut icons. Consulting the Online Help To access SecureAudit s Online Help, select Help Topics from the Help menu on the Menu Bar. Alternatively, many of SecureAudit s dialog boxes contain either a Help button or icon you can click to view the Help topic specific to the dialog you are viewing. First Steps 6

7 About Connections Configuring a Connection Connection icons represent ClearPath MCP systems to which SecureAudit may connect, and appear in the connections pane of the Main Window. The Installation process may have created a connection icon for each licensed system. If a connection was not created via the Installation process, you will need to create a connection for each ClearPath MCP system on which you intend to perform administrative functions. It is possible to arrange connections in to logical groups. You can also copy an existing connection. When connecting to a ClearPath MCP system you will be asked to supply your logon details. A successful logon will cause the colour of the connection icon for that system to change from red to green and various menus on the Menu Bar to become available. Creating a New Connection To create a new connection, follow these steps: 1. In the Console tree view panel, select, and then click on the Toolbar. The Host Details dialog will open. 2. This dialog contains three property pages: General contains general options relating to the new connection. Options allows you to specify an RBAC preferred role. Advanced contains logging options. 3. Fill out the following options on the General page: Group Name allows you to organise connections into groups. Type in a new group name or select a group from the dropdown menu. Connection Name type in the name of the new connection. This does not have to be the same as the server you are connecting to. Hostname or IP Address type in the name of the system you want to connect to, or type in the IP address of the system. Socket type in the socket number that you want to use. The default socket number is 28350, and it is recommended that this not be changed unless there is a conflict with other applications. Startup Job enter the location of the SecureAudit WFL job which initiates SecureAudit Host on the ClearPath MCP system. For example: locum\secureaudit\wfl Family this field is optional. It specifies the MCP family location of the SecureAudit WFL job. If left blank, the family specification of the running usercode will be used. 4. Click OK. The Connection will be created. Configuring a Connection 7

8 Establishing Multiple Connections You do not need to disconnect from one ClearPath MCP system before connecting to another. If you wish to establish multiple connections, repeat the logon procedure for each system you wish to connect to. Configuring a Connection 8

9 The SecureAudit Client Database The SecureAudit Client database is an SQLite database which contains data from the MCP host systems according to the report queries which have been run. When report queries are run, they retrieve the relevant information from the selected MCP system. This data is then stored in the database. Report queries are saved to the database under their respective report categories. When they are opened, the query is re-run and the report produced again. You do not have to have an active connection to view a saved report query. Note that newer versions of SecureAudit Client may contain reports which are unavailable in older versions of the Client. Please ensure you are running the latest version of SecureAudit Client in order to be able to access all reports. Creating a SecureAudit Client Database When you run SecureAudit Client for the first time, you will be prompted to specify a database. This is where SecureAudit Client will store connection details and any reports you produce. You can only have one database at a time. It is possible to share your database among SecureAudit Clients installed on multiple PCs, as long as they all have network access to the location where the database is stored. Multiple SecureAudit Clients can access the shared database concurrently. To create a database, follow these steps: 1. When you run SecureAudit Client for the first time, you will be prompted to create a new database or open an existing file. Browse to the location on your PC or a network drive where you want to save the database. 2. Type in a name for the database. The file must have the file extension.db. 3. Click OK. An empty database will be created. Accessing a Saved Database 1. Click on the Toolbar. The Create new database or open existing dialog will open. 2. Browse to the location where the database you want to access is stored, and select it. 3. Click OK. SecureAudit Client will open the database. The SecureAudit Client Database 9

10 Reports SecureAudit Client allows you to create the following reports: COMS Cfile Events DMSII Database Events File Accesses File Status Events Guardfile Activity Installation Records Logon Violations MCS Initializations Password Changes Privileged Actions Program Executions Role Based Access Control Run-time Usercode Changes Session Information System Commands System Security Violations Unauthorised File Accesses Unsuccessful Password Changes User Validations Userdata Changes Window Accesses The following reports are only available if you have Safe & Secure installed on the host system: Administrator Audit Censor Command Usage Chain Events DMSII File Activity Overdue Users Timestamp Verification Web-originated Accesses Reports 10

11 To Create a Report 1. Click on the Toolbar. The Request Data dialog will open. 2. Complete the required fields on the Source Data tab: Host system select the required host from the dropdown list. Timerange select Today, Yesterday, Last n days, or Custom: the latter option allows you to select a time period you want to run reports for. 3. On the Reports tab, choose the report(s) you want to run by checking the checkbox beside each one, or click the All button to run all reports. 4. Click Start to begin creating reports. If you are creating more than one report, this may take a little time. Once the report creation has finished, if you have created a single report, the report will be displayed on your screen. If you have created multiple reports, they will automatically be saved to the database. The Request Data Dialog- Source Data Tab Reports 11

12 Scheduling Reports You can schedule reports to be run automatically on MCP systems and have the resulting data imported into the SecureAudit Client database for you to view at a later time. You may create up to five schedules per usercode per host. To create a schedule, follow the subsequent steps: 1. Select the host that you want to create a schedule for, and either: a. From the Action menu on the Menu Bar select Schedule Options or b. Click the button on the Toolbar. 2. The Create/Modify Schedule on [host name] dialog will open. Click the New Schedule button. 3. The Schedule details on the General tab will be set to their defaults. Alter the schedule details as required. 4. Click the Reports tab. Alter the Report Timerange options as required and select the reports that you want to run automatically. You can select all reports by clicking the All button. 5. Click Apply to send the schedule to the host system. The reports generated will be placed into the specified output directory under the user s usercode. Importing Scheduled (Host) Reports When a Schedule sessions runs, SecureAudit Host will write a file with an.sca extension to the location specified when the schedule was created, or by default, to the primary family for the usercode under which SecureAudit host is running. The next time you connect from SecureAudit Client, the host will look for.sca files created under your connecting usercode. A message will be displayed telling you how many.sca files there are, if any. To import the.sca files, follow the instructions below. 1. Select the host from which you want to import the.sca file(s). You must have an open connection to the selected host. Either from the Action menu on the Menu Bar, select the Import Host Reports option or click the button on the Toolbar. The [host name]: Available Report Files dialog will open. 2. A list of available.sca files will be displayed. These will have been created under the usercode with which you are currently connected to the host. Select the file you want to import, and click the Import File button. 3. Upon confirmation, the file will be imported. When the import has finished, a message will be displayed listing the number or reports, the number of duplicate or incompatible reports which have been dropped from the import, and the total number of reports which have been successfully imported. Reports 12

13 Correlation Reports A correlation report is a customisable report which allows you to select the query you want to run on a selected host system. It allows you to set specific parameters to produce targeted reports. For example, you can produce a query which checks to see all events on a particular host system involving a specified originating usercode and where the associated text includes password over the last 7 days. To access the Correlation Report dialog, click the Toolbar. button on the The Correlation Report dialog contains three tabs: Originating Host this tab contains a dropdown list of all SecureAudit host systems that you have defined within SecureAudit Client. From here you may select the SecureAudit host system on which you want to run your query. Time Range this tab contains options allowing you to define your query s time range. Conditions this tab allows you to add one or more conditions to your query. Note that you must set at least one condition in order to run the query. The Correlation Report Dialog Reports 13

14 Exporting Files to PDF You can export report files to a PDF (portable document format) file, which can be saved then printed in a readable format. There are two ways to export a report to PDF. You can either: 1. Select the report you want to print and click the button on the Toolbar, or; 2. From the database, select the report and open it, then click the Print to PDF button. The Print to PDF dialog will open and you will be able to alter page setup options. The report will be saved in PDF format, which you can then open up and print. Files are named SCA_DDMMYYYY_hhmmss.pdf. To change the destination of saved PDF files, see the Client Options section of the Online Help Reports 14

15 The Visual Data Manager dialog The Visual Data Manager dialog provides a useful overview of the SecureAudit database and the information contained within it. To access the Visual Data Manager dialog, either right-click on the connection or the database and choose Visual Data Manager from the Database option on the contextual menu, or go to the Action Menu on the Menu Bar, select Database, and then Visual Data Manager. The Visual Data Manager Dialog- General/Info Tab The dialog contains the General tab and the Data Manager tab. The General tab The top part of the report contains the following information about your database: The Visual Data Manager dialog 15

16 Location the location where your database is stored, including the full name of your database. Jet Version the version of Microsoft s Jet Engine which was used to create the database. Size (on disk) the size of the database in Mb and bytes. Date Created the date on which the database was created. The bottom part of the dialog contains two further tabs: Info contains statistical information on the data stored in the database: o The number of saved queries you have saved in the database. o The number of connections to MCP SecureAudit Host systems you have defined within your database. o Each type of query together with the number of records stored for each query. Graph provides a bar chart of all query types, showing in visual form the numbers of records each query has. This should demonstrate if you have an abnormally high number of any particular event in comparison with the other events as shown in your records. The Visual Data Manager Dialog- General/Graph Tab The Visual Data Manager dialog 16

17 The Data Manager tab The Data Manager tab contains two further tabs: Actions allows you to compact the database. This tab also displays when the database was last compacted. If you choose to compact the database, a message will be displayed to inform you if the operation has been successful or not. Data Retention allows you to specify how long you wish data and report queries to be stored in the database. The policy is disabled by default; to enable the policy, check the Enable Retention Policy checkbox. The Visual Data Manager Dialog- Data Manager/Data Retention Tab The Visual Data Manager dialog 17

18 Graphs There are several kinds of graphs which you can generate within SecureAudit Client, depending on which report you want to view in graph form. You can only produce a graph for one report at a time. You can produce the following graphs for all reports except the Correlation report, for which no graphs are available: Vertical Bar Chart Line Graph Pie Chart The Generate Graph dialog The Generate Graph dialog can be accessed via the button on the Toolbar once you have selected a report in the Main Window, or from the Create Graph button when you have a report open. You can also access the Generate Graph dialog by right-clicking a report and selecting Create Graph from the contextual menu. The Generate Graph Dialog- Data Source Tab Graphs 18

19 The Generate Graph dialog consists of three sections: Graph Type allows you to select the type of graph you want to create. Data Source tab allows you to specify what data is included in your graph. Graph Options tab allows you to specify viewing options for each graph type, for example, whether the legend or a grid is displayed, whether percentages and labels are included, and line thickness. It is possible to save a graph by clicking the Save button from an open graph. You can choose to save the graph as the following file types: jpg bmp gif png pcx Bar Graphs The Bar Graph is designed to help you view the change in records over time. To this end, you can either choose to display daily change or monthly change from the Data Source tab, Frequency section. An example Bar Graph for the System Security Violations Report Graphs 19

20 Line Graphs Line Graphs are designed to help you view the change in records over time. As with Bar Graphs, you can either choose to display daily change or monthly change from the Data Source tab, Frequency section. An example Line Graph for the Logon Violations Report Pie Charts Pie charts are designed to help you view up to 10 items as a percentage value of the total records displayed. You must select between 1 and 10 items from those listed for the report for any one pie chart. An example Pie Chart for the Program Executions Report Graphs 20

21 Role-Based Access Control Role-Based Access Control (RBAC) is available with SecureAudit. RBAC is an effective approach to authorising access for users based on their roles within the organisation. The model is based on the concept of users, roles and permissions. SecureAudit is a member of the Locum realm. The realm may be enabled by the definition of a single role and user within the realm. Note that once the realm is enabled, the traditional MCP privileges of PU and SECADMIN are ignored and the permissions allocated to the user s role are the only determining factor used for authorisation. If a user does not hold a particular permission, the functions associated with that permission are unavailable to the user. Within the Client, these functions will be greyed out. The administration of RBAC, such as the setting up of roles, associating users with roles and allocating permissions to roles, is accomplished through Unisys SecurityCenter Client. The Locum realm and list of permissions within the realm are pre-defined, and established during installation of SecurityCenter. Once you are connected to SecureAudit, the Role Picker dialog will appear, allowing you to select an appropriate role from the Role List. It is possible to switch roles during your session by right-clicking on the connection and selecting Request Role List from the context menu. Role-Based Access Control 21

22 Best Practices Each of the reports has security relevance. The importance of each will vary from site to site, depending on such factors as the size and type of the workload and the complexity of the security policy in force throughout the company. The following table shows the reports which are deemed to be the lowest common denominators, and therefore probably of most use to most sites. Report Security Violations Logon Violations System Commands Unauthorised File Accesses Password Changes Window Accesses COMS Cfile Events File Status Events Run-time Usercode Changes Userdatafile Changes DMSII Database Events Guardfile Activity Suggested Frequency Daily Statistics Daily Statistics Daily Statistics Daily Daily Daily (with window filter) Weekly Daily (with appropriate filter) Daily Daily Daily Daily The Daily Statistics reports give an overview of activity, allowing forensic ad hoc reports (whether full or filtered) to be performed should there be suspicious activity identified by the statistics. Time-line graphs can be performed on a daily or monthly basis and are extremely useful in identifying trends. It is recommended that the reports are generated via the scheduling function, which allows data collection to be performed on the MCP host without the need for SecureAudit Client to be up and running. When the Client is next initiated, the user is presented with the option of downloading and importing the data to the local database. Within the Visual Data Manager, you can use the Retention Policy to manage report queries. You can set up a policy to remove queries and optionally the associated data once they reach a set age, specified in days. Best Practices 22

23 Reports generated by the Client have several output formats. For presentation to auditors, output to PDF is usually advised. Note that you can rearrange the order of the columns on each report to your liking. Do this via the Customised Columns tab on the Client Options dialog. Columns which you don t want to see can be hidden by deselecting the checkbox next to the Data Item. If you have multiple MCP servers, it can be advantageous to use the Group Name field in the Connection Properties dialog to organise connections into groups, for example, Production or Test. As with many other things, security issues are continually evolving. More threats and vulnerabilities become exposed over periods of time. In addition, each MCP release may introduce new security functionality. Because of these, regular and periodic security reviews should be undertaken, and as a result of these, or as part of these, the SecureAudit schedule should be amended accordingly. Best Practices 23

24 Index Best Practices...22 Connections... 7 About... 7 Creating... 7 Multiple... 8 First Steps... 5 Graphs...18 Bar...19 Generate Graph dialog...18 Line...20 Pie Charts...20 Installation... 4 Privilege Requirements... 4 Online Help... 6 RBAC...21 Reports...10 Correlation Creating Exporting Files to PDF Importing Scheduling SecureAudit Client Database... 9 Creating... 9 The Visual Data Manager dialog SecureAudit Client Main Window... 5 Menu Bar... 6 Toolbar... 6 System Requirements... 3 License Requirements... 3 MCP Requirements... 3 Network Requirements... 3 Windows Requirements... 3 Index i