Security Content Update Release Notes. Versions: CCS 11.1.x and CCS 11.5.x

Transcription

1 Security Content Update Release Notes Versions: CCS 11.1.x and CCS 11.5.x

2 SCU Release Notes for CCS 11.1.x and CCS 11.5.x Legal Notice Copyright 2017 Symantec Corporation. All rights reserved. Symantec, the Symantec Logo, and the Checkmark Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. The product described in this document is distributed under licenses restricting its use, copying, distribution, and decompilation/reverse engineering. No part of this document may be reproduced in any form by any means without prior written authorization of Symantec Corporation and its licensors, if any. THE DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE. Symantec Corporation 350 Ellis Street Mountain View, CA

3 Technical Support Contacting Technical Support Symantec Technical Support maintains support centers globally. Technical Support s primary role is to respond to specific queries about product features and functionality. The Technical Support group also creates content for our online Knowledge Base. The Technical Support group works collaboratively with the other functional areas within Symantec to answer your questions in a timely fashion. For example, the Technical Support group works with Product Engineering and Symantec Security Response to provide alerting services and virus definition updates. Symantec s support offerings include the following: A range of support options that give you the flexibility to select the right amount of service for any size organization Telephone and/or Web-based support that provides rapid response and up-to-the-minute information Upgrade assurance that delivers software upgrades Global support purchased on a regional business hours or 24 hours a day, 7 days a week basis Premium service offerings that include Account Management Services For information about Symantec s support offerings, you can visit our website at the following URL: All support services will be delivered in accordance with your support agreement and the then-current enterprise technical support policy. Customers with a current support agreement may access Technical Support information at the following URL: Before contacting Technical Support, make sure you have satisfied the system requirements that are listed in your product documentation. Also, you should be at the computer on which the problem occurred, in case it is necessary to replicate the problem. When you contact Technical Support, please have the following information available: Product release level Hardware information

4 Available memory, disk space, and NIC information Operating system Version and patch level Network topology Licensing and registration Customer service Router, gateway, and IP address information Problem description: Error messages and log files Troubleshooting that was performed before contacting Symantec Recent software configuration changes and network changes If your Symantec product requires registration or a license key, access our technical support Web page at the following URL: support.symantec.com Customer service information is available at the following URL: Customer Service is available to assist with non-technical questions, such as the following types of issues: Questions regarding product licensing or serialization Product registration updates, such as address or name changes General product information (features, language availability, local dealers) Latest information about product updates and upgrades Information about upgrade assurance and support contracts Information about the Symantec Buying Programs Advice about Symantec's technical support options Nontechnical presales questions Issues that are related to CD-ROMs, DVDs, or manuals

5 Support agreement resources If you want to contact Symantec regarding an existing support agreement, please contact the support agreement administration team for your region as follows: Asia-Pacific and Japan Europe, Middle-East, and Africa North America and Latin America

6 Contents Technical Support... 3 Chapter 1 Prerequisites for Security Content Updates... 7 Prerequisites... 7 Chapter 2 What's New... 9 New features... 9 New technical standards Updated technical standards Deprecated technical standards New regulatory framework Addition in predefined platforms Modified files Chapter 3 Resolved Issues Resolved issues... 18

7 Chapter 1 Prerequisites for Security Content Updates This chapter includes the following topics: Prerequisites Prerequisites The following are the prerequisites to install a Security Content Update (SCU): Symantec Control Compliance Suite 11.1 or later versions Before you install a Security Content Update (SCU), you must have Symantec Control Compliance Suite 11.1 or later versions installed on your computer. The Security Essentials for Junos OS 15.x Devices standard will be available after you upgrade to CCS (Product Update ). New signing certificate for CCS files A new signing certificate is used for all CCS files that are signed after March 3, To install SCU or later using the LiveUpdate feature, you need this certificate. The certificate is valid till March 03, Before you install the SCU, you must install the updated CCS certificate information necessary to validate the new signing certificate. For this update, you must install either of the following: Quick Fix To install the SCU or later, you must apply Quick Fix The Quick Fix includes the Symantec.CSM.AssemblyVerifier.dll file, which contains the updated CCS certificate information necessary to validate the certificate. You can download the Quick Fix from the following location:

8 Prerequisites for Security Content Updates Prerequisites 8 Symantec Control Compliance Suite (Product Update ) This Product update recognizes and validates Symantec binaries that are signed using the new certificate, in addition to recognizing the older binaries. Note: The Symantec.CSM.AssemblyVerifier.dll file for new signing certificate is included in the CCS_11_1_<version number>_scu_win.exe for SCU or later. So, if you install SCU or later manually, the Symantec.CSM.AssemblyVerifier.dll is installed with the SCU.

9 Chapter 2 What's New This chapter includes the following topics: New features New technical standards Updated technical standards Deprecated technical standards New regulatory framework Addition in predefined platforms Modified files New features The Security Content Update (SCU) contains the following new features: Command-based data collection support for UNIX platform Automated MS SQL password management in agent-based data collection Data collection support for SUSE Linux Enterprise Server 12 platform Data collection support for Windows Server Core platform Data collection support on 64-bit CCS agent for RHEL 7.x server assets Command-based data collection support for UNIX platform From SCU onwards, command-based data collection support for UNIX platform is available in CCS. The support is available for both the agent-based and the agentless methods of data collection. Why use this feature?

10 What's New New features 10 You must use this feature to meet the following use cases: To collect data and assess security configuration of middleware and third-party applications that are currently not supported out-of-the-box by CCS. To create customized command-based checks for data collection for the UNIX assets in your system. Any prerequisites? The following are the prerequisites for using the Commands entity for UNIX: CCS (Product Update ) CCS UNIX agent (11.5 or later) Agent Content Update (ACU) How to use this feature? The following is a high-level workflow to use this feature: 1. Upgrade to CCS and install SCU Import UNIX assets to the CCS asset system. 3. Configure credentials for asset import and data collection. 4. Create a standard, add a section (or use an existing standard and a section), and create a command-based check for the Commands entity for UNIX. 5. Whitelist the commands to be used for data collection by the check. 6. Run a collection-evaluation-reporting (CER) job or a data collection job. 7. View and analyze evaluation results. Note: For comprehensive information about this feature, refer to the Security Content Update Getting Started Guide (Versions: CCS 11.1.x and CCS 11.5.x). Automated MS SQL password management in agent-based data collection From SCU , the agent-based support to automate MS SQL password management is available in CCS. This support is available both for standalone SQL Server assets and for SQL Server clusters. Why use this feature? You must use this feature to meet the following use cases: To automate the process of managing passwords of the MS SQL Server users that are configured on SQL Server agent for data collection

11 What's New New features 11 To quickly ensure that MS SQL user passwords are changed as per the password policy of your organization To improve the security practices of your organization by managing passwords without any human intervention How to use this feature? The following is a high-level workflow to use this feature: 1. Install SCU Run the Agent Content Update (ACU) job on the SQL agent computers. 3. Run the CCSSQLSetup tool and configure credentials for the SQL Server instances in your environment. The tool is available on the agent at the following location: <Agent installation directory>\esm\bin\dcmodules\control\sqlserver 4. Configure input parameters (frequency at which password must be changed, length of password, and permissible special characters in a password, among others) in the following ways: Configure password settings for all the agents from the CCS console. Configure agent-specific password settings in a ccssqlenv.dat environment configuration file. This file is available on each SQL agent. 5. Run the data collection job for the configured MS SQL Server assets. Passwords for MS SQL user accounts are managed in CCS as per the input parameters that you configure. Note: For comprehensive information about this feature, refer to the Security Content Update Getting Started Guide (Versions: CCS 11.1.x and CCS 11.5.x). Data collection support for Windows Server Core platform From SCU onwards, data collection support for assets that run Windows Server Core operating systems is available in CCS. The support is available for both the agent-based and the agentless methods of data collection. After you install the Symantec CCS agent for Windows Server Core operating systems, Microsoft Access Database Engine 2010 Redistributable is also installed on the agent to support data collection. If you uninstall CCS Windows Core agent, Microsoft Access Database Engine 2010 Redistributable is uninstalled automatically.

12 What's New New technical standards 12 Note: On Server Core for Windows Server 2008 and Windows Server 2008 R2, the DHCP Server: Scope Information <FORM> field in the Machines entity is not supported. Data collection support for SUSE Linux Enterprise Server 12 platform From SCU onwards, data collection support for SUSE 12 assets is available in CCS. The Security Essentials for SUSE Linux Enterprise Server 12 standard is listed in the Predefined folder in the tree pane of the CCS Standards view. Using this standard, you can assess the compliance posture of the SUSE Linux Enterprise Server 12 assets in your environment. For information about the how to collect data by using a predefined technical standard, refer to the Working with standards topic in the Symantec Control Compliance Suite User Guide. Data collection support on 64-bit CCS agent for RHEL 7.x server assets From SCU onwards, data collection support on 64-bit agent for Red Hat Enterprise Linux 7.x server assets is available in CCS. Earlier, only 32-bit agent was supported for this platform. Now, you can use the Symantec RHEL 64-bit agent for this data collection. New technical standards SCU contains the following new technical standards: CIS Benchmark for Red Hat Enterprise Linux 6, v2.0.2 CIS Benchmark for Cisco IOS 15, v4.0.0 (level 1 profile) The following standards, which were released in the recent Express Security Content Updates, are now integrated with SCU : Security Essentials for Junos OS 15.x Devices Any prerequisites? You must install CCS (Product Update ) for using the Security Essentials for Junos OS 15.x Devices standard.

13 What's New Updated technical standards 13 Note: To use the Security Essentials for Junos OS 15.x Devices standard, use the data collection, evaluation, and reporting workflow for the Generic Devices data collector. For information about the support for Generic Devices, refer to the Data collection support for Generic Devices topic in the Security Content Update Getting Started Guide (Versions: CCS 11.1.x and CCS 11.5.x). Security Essentials for SUSE Linux Enterprise Server 12 Note: When you upgrade from SCU or an earlier version to SCU using LiveUpdate, the Generic Devices platform is not installed. If you want to install this platform, launch the CCS 11.5 installation wizard from the Add/Remove Programs or the Programs and Features window of your computer. In the Maintenance panel of the CCS 11.5 installation wizard, select Add/Upgrade, and then click Next. In the list of CCS components in the Add Components section, select the Generic Devices Technical Standards Pack box. Updated technical standards The following predefined technical standard is updated in SCU : CIS Red Hat Enterprise Linux 7.x Benchmark v2.1.1 The CIS benchmark version for this standard is updated to Deprecated technical standards What is a deprecated standard? A deprecated technical standard is a standard which customers can still use for data collection for the asset types that it covers, but for which technical support or updates are no longer available from Symantec. A technical standard is marked as 'Deprecated' in CCS Standards Manager in the following cases: A CCS standard corresponding to a CIS Benchmark is deprecated if the support for a platform is ended by the platform vendor. A lower version of a CCS standard corresponding to a CIS Benchmark is deprecated if a higher version of the CCS standard is available for the same platform. A Security Essentials standard is deprecated if it is superseded by a CIS Benchmark for the same platform. A standard is marked as 'Deprecated' in the user interface (UI) for two consecutive SCUs. After that, it is removed from the SCU installer. For uninterrupted technical

14 What's New New regulatory framework 14 support for a platform, Symantec recommends that customers switch to a CIS Benchmark CCS standard that supersedes a deprecated standard. Note: Data that is already collected by using a deprecated standard remains unaffected even after the standard is removed from the SCU installer. The following technical standards are deprecated in SCU : Table 2-1 Deprecated technical standards in SCU Platform SQL Windows OS or Application Version Microsoft SQL Server 2005 Windows Server 2003 SP2 Windows XP SP3 Windows Vista SP2 Deprecated Standard CIS Security Configuration Benchmark for Microsoft SQL Server 2005 v1.1.1 RBC standards CIS Legacy Security Settings Benchmark for Windows 2003 Domain Controller v2.0 CIS Windows Server 2003 Legacy Security Settings for Domain Member Servers v2.0 MBC standards CIS Legacy Security Settings Benchmark for Windows 2003 Domain Controller v2.0 CIS Windows Server 2003 Legacy Security Settings for Domain Member Servers v2.0 CIS Legacy Settings Benchmark for Windows XP Professional v2.01 US Federal Desktop Core Configuration Standard (FDCC) V1.0.1 for Windows Vista New regulatory framework SCU contains the following new regulatory framework: Australian Government Information Security Manual (ISM) 2016 Release The AUS ISM 2016 regulatory framework is produced by the Australian Signals Directorate (ASD). This is a standard that governs the security of government ICT systems. This standard is complementary to the Australian Government Protective Security Policy Framework, which contains controls to protect Australian people, information, and assets, at home and overseas.

15 What's New Addition in predefined platforms 15 Addition in predefined platforms SCU contains the following enhancements in the predefined platforms: Table 2-2 Platform UNIX Enhancements in predefined platforms Enhancement Entity and fields The Commands entity is added to the UNIX platform. Note: You can create command-based checks in CCS Standards workspace by using this entity. However, support for ad-hoc queries for this entity is not available. The following fields are added to support data collection by using command-based checks for the Commands entity: Command Standard Output This field returns the standard output of the command. Command Standard Error This field returns the standard error of the command. Command Return Code This field returns the return code of the command. Data collection details for a command-based check also contain the Check Reference column. This column represents mapping of the command-based check with the respective command used for data collection. See the section called Command-based data collection support for UNIX platform on page 9. Target type The following target type is added to support data collection for SUSE Linux Enterprise Server 12 assets: SUSE Linux enterprise Server 12.x Machines

16 What's New Modified files 16 Table 2-2 Platform Junos OS (Generic Devices) Enhancements in predefined platforms (continued) Enhancement Asset group templates The following asset group templates corresponding to the Security Essentials for Junos OS 15.x Devices standard are added to the Junos OS platform: All Junos OS 12.x Devices All Junos OS 13.x Devices All Junos OS 14.x Devices All Junos OS 15.x Devices All Junos OS 16.x Devices Target types The following target types corresponding to the Security Essentials for Junos OS 15.x Devices standard are added to the Junos OS platform: Junos OS 12.x Devices Junos OS 13.x Devices Junos OS 14.x Devices Junos OS 15.x Devices Junos OS 16.x Devices Cisco Network Devices The following fields are added to the Configurations entity to support data collection by using the Security Essentials for Junos OS 15.x Devices standard: EXEC Timeout for Management Lines This fields shows the EXEC timeout values for each management line. Login Authentication for Management Lines This field shows the Login Authentication method for each management line. ACL for SNMP Community This field shows SNMP Community, Access Control List, and whether an Access Control list is defined or not. See New technical standards on page 12. Modified files The following files are modified in SCU :

17 What's New Modified files 17 Cisco.Schema.dll UnixScopes.dll Unix.Schema.dll Symantec.CSM.UnixPlatformContent.Solaris10v4.0.dll Symantec.CSM.CiscoPlatformContent.Cisco15x.dll Symantec.CSM.UnixPlatformContent.RHELv1.0.5.dll Symantec.CSM.UnixPlatformContent.AIXv1.0.1.dll Symantec.CSM.UnixPlatformContent.SLESv1.0.dll Symantec.CSM.UnixPlatformContent.HPUXv1.3.1.dll Symantec.CSM.Content.Localization.Resources.dll Symantec.CSM.AssemblyVerifier.dll symantec.csm.assemblyverifier.x64.dll symantec.csm.assemblyverifier.x86.dll Symantec.CSM.PlatformSettings.SQL.dll Note: The version number for all the files mentioned earlier is

18 Chapter 3 Resolved Issues This chapter includes the following topics: Resolved issues Resolved issues Resolved issues contains the details of the customer issues that are resolved in SCU Table 3-1 Resolved Issues in SCU Issue Resolution Data collection for the Security Essentials for Microsoft SQL Server 2012 standard for the MS SQL Server Integrated Security entity failed and the following error message was displayed: Cannot open database msdb requested by the login. The login failed. Earlier, connection to msdb was set even for data collection fields in the Server Integrated Security entity that did not require such connection. This resulted in data collection failure and the error message mentioned in the issue. Now, the code is modified to connect to msdb only for the fields that require such connection.

19 Resolved Issues Resolved issues 19 Table 3-1 Issue Resolved Issues in SCU (continued) Resolution The following audit checks in the CIS Red Hat Enterprise Linux 6.x Benchmark v1.4.0 standard failed inappropriately even when all the rules in the auditctl file were set as per the suggested check remediation : Are any events recorded which modify Discretionary Access Control Permissions? : Are any events recorded which modify Unsuccessful Unauthorized Access Attempts to files? : Are File Deletion Events by user recorded? Agent-based data collection for Oracle platform failed for an Oracle user that had an invalid shell. For AIX platform, the data collection results for the Is package up to date? field in the Packages entity were incorrect in case more than one patch entry was present in the.dat file for the same package in AIX Other Security APARs. In this case, for the package with a lower version, the Is package up to date? field reported as False. Now, the code is modified to correctly identify the format of the auditctl file when it contains the LIST_RULES control rule definition. The code has been modified. For SYSDBA login, fallback mechanism is introduced to handle data collection for an Oracle user that has an invalid shell. As a result, the data collection is successful. The issue occurred because the patches for a package were considered for evaluation even when the target package version was different than the.dat entry. The code has been modified to resolve this issue. Data collection job for the Comprehensive Windows Patch Assessment standard failed, and the following error message was displayed: The code has been modified to resolve this issue. Now, data collection for the Comprehensive Windows Patch Assessment standard is successful. Performing patch assessment on <SERVERNAME> - The system cannot find the file specified. However, the user could not get any information about the assets for which the data collection failed.

20 Resolved Issues Resolved issues 20 Table 3-1 Issue Resolved Issues in SCU (continued) Resolution The Server NetBIOS Name property for an Oracle asset showed incorrect server name if the Oracle asset was added by using the IP address of a Windows computer. Data collection on this asset failed because it did not find the RPC server named with'10'. The version, check names and check numbering in the CIS Security Benchmark for DB2 v4.0 standard in the CCS Standards Manager did not match the benchmark that was published by CIS. Now, the Server NetBIOS Name asset-type property is populated correctly. Now, the version, check mapping and numbering are rectified as per the CIS benchmark. The CCS standard is renamed as CIS Security Configuration Benchmark v1.1.0 For DB2 v8, v9 and v9.5. The check in the CIS Red Hat Enterprise Linux 6.x Benchmark v1.2.0 and the CIS Red Hat Enterprise Linux 6.x Benchmark v1.4.0 standards failed on some computers when the PASS_MIN_DAYS setting in the /etc/login.defs file was set to 7 or higher. Now, the default value of the check expression is set to True and the check behavior is modified. Now, the check returns the pass or fail results as expected. Note: Both the standards mentioned in the issue are now deprecated. Symantec recommends that you use the CIS Benchmark for Red Hat Enterprise Linux 6, v2.0.2 instead. See Deprecated technical standards on page 13. An additional condition to consider NP users for locked system accounts was required in the expression of the following check in the CIS Solaris 10 Benchmark v4.0 standard: Now, an additional condition for NP users is added as for locked system accounts Has password entries for system accounts been locked? A precondition to check whether CDE was running or installed was required in the following checks in the CIS Solaris 10 Benchmark v4.0 standard: The precondition is added Has the screensaver timeout been set to 10 minutes? Has "locktimout" been set to 10 or less?

21 Resolved Issues Resolved issues 21 Table 3-1 Issue Resolved Issues in SCU (continued) Resolution Data collection on Oracle 11 database assets failed and the following error message was displayed Unspecified error=0d=0a. The code is modified by removing the awk command for Listeners entity for Oracle platform. Now, the data collection is successful. The non-standard LF+CR (\n\r) combination was causing problem in detecting the end of a command. The check numbering in the ESM - CIS Benchmark for Sybase ASE v1.1.0 standard did not match the benchmark that was published by CIS. Now, the LF+CR (\n\r) prompt combination is handled in detecting the end of a command. Now, the check numbering is done as per the CIS benchmark. The CCS standard is renamed as CIS Security Configuration Benchmark v1.1.0 For Sybase ASE 15.0.