.trustwave.com Updated October 9, Trustwave DbProtect Upgrade Guide Version 6.4.9

Transcription

1 .trustwave.com Updated October 9, 2007 Trustwave DbProtect Upgrade Guide Version 6.4.9

2 Legal Notice Copyright 2017 Trustwave Holdings, Inc. All rights reserved. This document is protected by copyright and any distribution, reproduction, copying, or decompilation is strictly prohibited without the prior written consent of Trustwave. No part of this document may be reproduced in any form or by any means without the prior written authorization of Trustwave. While every precaution has been taken in the preparation of this document, Trustwave assumes no responsibility for errors or omissions. This publication and features described herein are subject to change without notice. While the authors have used their best efforts in preparing this document, they make no representation or warranties with respect to the accuracy or completeness of the contents of this document and specifically disclaim any implied warranties of merchantability or fitness for a particular purpose. No warranty may be created or extended by sales representatives or written sales materials. The advice and strategies contained herein may not be suitable for your situation. You should consult with a professional where appropriate. Neither the author nor Trustwave shall be liable for any loss of profit or any commercial damages, including but not limited to direct, indirect, special, incidental, consequential, or other damages. The most current version of this document may be obtained by contacting: Trustwave Technical Support: Phone: support@trustwave.com Trademarks Trustwave and the Trustwave logo are trademarks of Trustwave. Such trademarks shall not be used, copied, or disseminated in any manner without the prior written permission of Trustwave. Revision History Version Date Changes 1.0 June Initial release of draft 2.0 July Final release for version May Final release for version June Final release for version January 5, 2017 Initial release for version Copyright 2017 Trustwave Holdings, Inc. All rights reserved. ii

3 Formatting Conventions This manual uses the following formatting conventions to denote specific information. Formats and Symbols Blue Underline Bold Code Italics [Square brackets] Meaning A blue underline indicates a link to a Web site or address. Bold text denotes UI control and names such as commands, menu items, tab and field names, button and checkbox names, window and dialog box names, and areas of windows or dialog boxes. Text in Courier New 9 pt in blue indicates computer code or information at a command line. Italics denote the name of a published work, the current document, or another document, and are also used for text emphasis, to introduce a new term, and for path names. Square brackets indicate a placeholder for values and expressions. Notes, Tips, and Cautions Note: This symbol indicates information that applies to the task at hand. Tip: This symbol denotes a suggestion for a better or more productive way to use the product. Caution: This symbol highlights a warning against using the software in an unintended manner. Copyright 2017 Trustwave Holdings, Inc. All rights reserved. iii

4 Table of Contents Legal Notice ii Trademarks... ii Revision History... ii Formatting Conventions iii Notes, Tips, and Cautions... iii List of Tables vi 1 Introduction What s new in DbProtect Upgrading from or to Prerequisites for Your Current Environment System Requirements for DbProtect Scan Engine Compatibility Pre-Upgrade Tasks Upgrade Steps Install and Runtime Privilege Upgrading from to Schema Component Setup SHATTER Knowledgebase Setup Data Warehouse Setup Message Collector Setup Analytics Upgrade DbProtect Scan Engine Upgrade steps Post Upgrade Tasks Upgrading from to Prerequisites for your Current Environment System Requirements for DbProtect Pre-Upgrade Tasks Upgrade Steps Install and Runtime Privilege Upgrading from to Schema Component Setup SHATTER Knowledgebase Setup Data Warehouse Setup Copyright 2017 Trustwave Holdings, Inc. All rights reserved. iv

5 Message Collector Setup Upgrading from to 6.4.9, Part Analytics Upgrade DbProtect Scan Engine Upgrade steps Post Upgrade Tasks Upgrade Checklist 44 About Trustwave 45 Copyright 2017 Trustwave Holdings, Inc. All rights reserved. v

6 List of Tables Table 1: Prerequisites for DbProtect Table 2: System Requirements for DbProtect Table 3: Scan Engine Compatibility Table 4: Prerequisites for DbProtect Table 5: System Requirements for DbProtect Copyright 2017 Trustwave Holdings, Inc. All rights reserved. vi

7 1 Introduction DbProtect is a database security and compliance solution that helps organizations control their database security processes in a smart and streamlined way. Designed to scale from small to medium sized business to large enterprises, DbProtect boosts operational efficiency and streamlines key database security activities, while enabling organizations to achieve database security, minimize risk, and achieve regulatory compliance. DbProtect is comprised of three feature modules: Vulnerability Management: capability to locate, examine, and report on database security vulnerabilities and misconfigurations in any database. Rights Management: capability to examine and report on an organization s database user and object privileges, ownership, and access controls. Activity Monitoring: capability to track, identifies, and alert on all database activities, suspicious behavior, and threats. This guide provides instructions on upgrading DbProtect from earlier versions to version For more information about the various features and how to use DbProtect, refer to the DbProtect Getting Started Guide. DbProtect includes a rollup of all patches released through the support portal for users of previous versions of DbProtect. 1.1 What s new in DbProtect 6.4 The DbProtect 6.4 product series introduces a new look and feel, and a new workflow that simplifies running scans, viewing results, and generating reports. DbProtect users can easily access and share the security information specifically needed to do their jobs, without exposing data they are not authorized to see all without running multiple scans on the same assets. A more granular set of role-based access controls and a new organizational management system help organizations break down the communication silos among information security teams, database groups, and other stakeholders. Other improvements include: Redesigned User Interface Enhances User Experience Correlation Engine Detects Toxic Combinations Optimized Operational Model Enhances Efficiency Streamlined Administration Simplifies Management Scan Setup Wizard Speeds Deployment New Job Management Improves Operations Introduction Copyright 2017 Trustwave Holdings, Inc. All rights reserved. 7

8 Redesigned Asset and Credential Management Simplifies Administration Enhanced User and Organization Management Streamlines Deployment Role Based Access Controls Offer Separation of Duties Introduction Copyright 2017 Trustwave Holdings, Inc. All rights reserved. 8

9 2 The following table describes the typical production deployment specifications for various upgrade scenarios. The supported upgrade scenarios are: Version or to (you must upgrade to before upgrading to 6.4.9) See Upgrading from to below. Version to See Upgrading from to on page 26 for information on upgrading from to Version or above to Follow the steps for upgrading from to If you are using a version of DbProtect that is older than 6.4.2, you must upgrade to version before following any of the above scenarios. To upgrade from a version that is older than 6.4.2, contact support@trustwave.com. Microsoft SQL Server 2005 as a backend is no longer supported from version An Upgrade Checklist is provided on page 44 that you can print and use during the upgrade. 2.1 Upgrading from or to If you have DbProtect version or 6.4.3, you must upgrade to version before upgrading to version Copyright 2017 Trustwave Holdings, Inc. All rights reserved. 9

10 2.1.1 Prerequisites for Your Current Environment The following must be in place for your environment before you upgrade to Table 1: Prerequisites for DbProtect Assumption A working environment exists Description DbProtect is working correctly and can be accessed. You are using at least Microsoft Windows Server 2003 SP2 You have access to a DbProtect SuperAdmin user. The Host Admin user you used to install is still available (you must upgrade with the same user that was used to install version 6.4.2). A sysadmin account exists. You plan to either upgrade DbProtect with this user, or you are able to log in with this user during the upgrade process. You have access to a sysadmin account on the DbProtect backend database. This can be either the user used to install DbProtect, or a SQL login. You plan on upgrading in place and retain as much data as possible. You plan on leaving your Windows Service user and SQL Server authentication and credentials the same System Requirements for DbProtect Before upgrading to 6.4.4, ensure that your system meets the requirements. Table 2: System Requirements for DbProtect Specification Memory Processor x64 Processor 2.0 GHz+ Disk Details GB 2-8+ cores 30 GB for application 250+ GB for temp/output NOTE: Our benchmarking has shown that disks (whether physical or virtual) having sequential read and write speeds in excess of 100 MB/s yield acceptable performance. This is true for disks on the application server and for the SQL repository. Copyright 2017 Trustwave Holdings, Inc. All rights reserved. 10

11 Specification Operating System Details One of the following: Windows Server 2003 SP2 Windows Server 2008 Windows Server 2008 R2 Windows Server bit Standard Editions or higher Minimum Windows requirement update: Microsoft Windows Server 2003 SP2 SQL Server Repository Considerations One of the following: SQL Server 2005 SQL Server 2008 SQL Server 2008 R2 SQL Server bit Standard Editions or higher The repository should be installed on a separate host from the application server, typically in a high-performance SQL farm, and actively managed by DBA operations teams. Note: For UAT environments that want to estimate production level responsiveness, even if a production SQL farm is not used, the I/O responsiveness of the underlying disk and the SQL Server memory/processor configuration should be comparable since they play a key role in performance. Scan Engines Virtual Environments Two or more scan engines, with one or more deployed on independent hosts. It is essential for optimal system performance that virtual environment resources not be oversubscribed. On heavily used virtualization hosts, placing the DbProtect and repository VMs in resource groups with reserved resources will yield the best product experience. Copyright 2017 Trustwave Holdings, Inc. All rights reserved. 11

12 2.1.3 Scan Engine Compatibility The following table describes the compatibility of various Scan Engines with supported DbProtect releases. Ensure that your Scan Engine is compatible with the version of DbProtect you are upgrading to. FC=Fully Compatible. Can register and will be supported after upgrade. PC=Partially Compatible. Will work after the upgrade but will not register as new. NS=Not Supported. Table 3: Scan Engine Compatibility 6.4.4/SE Proxy /SE Proxy /SE Proxy /SE Proxy /SE Proxy /SE Proxy /SE Proxy 3.2 Scan Engine 2.1 Scan Engine 2.2 Scan Engine 2.4 Scan Engine 2.7 Scan Engine 2.8 Scan Engine 2.9 Scan Engine 2.10 NS NS NS NS NS NS NS NS NS NS NS NS NS NS NS NS NS NS NS NS NS NS NS NS NS NS NS NS FC NS NS NS NS NS NS FC FC NS NS NS NS NS NS FC FC NS NS NS NS Scan Engine 2.11 NS FC (if on SHATTER KB 4.50 or higher) FC NS NS NS NS Scan Engine 2.12 Scan Engine 3.0 Scan Engine 3.2 NS NS NS FC NS NS NS NS NS NS NS FC FC FC NS NS NS NS FC FC FC Copyright 2017 Trustwave Holdings, Inc. All rights reserved. 12

13 2.1.4 Pre-Upgrade Tasks 1. Confirm the hardware and Operating System specifications on the system that has the Console installed. 2. Verify backups were taken of the OS. If working with a Virtual Appliance, ensure that you take a snapshot or backup of the appliances prior to upgrading. 3. Verify that a backup of the Databases was taken. 4. Confirm you are using the same user that ran the original install, or have access to that user. 5. Execute the verification script. 6. Execute system help check scripts and check for free space on the database host. Free some log file space if necessary. 7. Check for 30 GB plus free disk space on the host and drive where the Console is being installed. 8. Verify you have an admin user that has sysadmin rights on the database for schema change commands. 9. Check whether or not you have URR data this will require extensive transaction log space during the upgrade. 10. Download the DbProtect Suite and DbProtect Scan Engine Installer files. 11. Download Analytics Content and SHATTER Knowledgebase updates if available for the version you are upgrading to. After the install is complete, you can then specifically upgrade the Analytics Content and SHATTER Knowledgebase to ensure that you have the latest monthly update Upgrade Steps 1. Verify that your server meets the minimum system requirements in regard to RAM, disk space and backend database. DbProtect Suite will run a system verifier. If any requirements are not met, you will not be able to continue with the upgrade. See Table 2 for the system requirements. 2. Verify that you will be able to upgrade all your Scan Engines following the DbProtect Suite upgrade. 3. Make a full backup or copy of all of the DbProtect backend databases - AppDetective, DbPAnalytics, DbPStaging, and DbPDataWarehouse. 4. Prepare to back up your DbProtect licenses, policies, filters, credential profiles, asset lists and custom dictionaries just in case problems occur during the upgrade. 5. Make a backup of your License files from the C:\Program Files (x86)\dbprotect\licenses directory. 6. Export your custom Vulnerability Management Policies and exceptions. For further information please review the following Knowledge Base article on our customer portal: 7. Export your custom Activity Monitoring Policies and filters. For further information see the aforementioned Knowledge Base article. 8. Log out of DbProtect and close your browser. 9. Stop any local Scan Engines or local Sensors you might have running on the DbProtect server. 10. Run the DbProtect Suite installer to start the upgrade. This takes you through a series of interactive installation wizards which will upgrade the various DbProtect components on your server. Copyright 2017 Trustwave Holdings, Inc. All rights reserved. 13

14 If you are installing on a Windows 2008 server, you must use the right-click option to install as administrator to elevate privileges to the highest level Install and Runtime Privilege The DbProtect Services can be run either as LocalSystem or a specific Domain user. The services can only be run as a LocalSystem when the DbProtect backend repository is running on the same machine as the DbProtect Console or when a SQL Server Authenticated User is used to communicate with the backend repository. If you choose to run services as a specific Domain/Windows user, ensure that it has the Logon as a service privilege. The selected user must be allowed to connect to the Active Directory domain (for such operations as checking user credentials during logon to the DbProtect Console) and must have access to the DbProtect backend databases when using Windows Integrated Authentication. During the upgrade the Database account should also have sysadmin rights on the SQL Server Instance Upgrading from to Right click on the Executable file and select Run as administrator. The DbProtect Suite installer opens, with all components selected that need to be installed. 2. Check the I have read and accept the license agreement check box and click Install. After some components are installed, the DbProtect Enterprise Service Host Setup Wizard displays. Copyright 2017 Trustwave Holdings, Inc. All rights reserved. 14

15 3. Click Next to begin the wizard. 4. On the Service Log On Credentials page, select Run service as LocalSystem or Run Service as (and enter the account and user). 5. Test the credentials (only if Run service as is selected) and click Next. Copyright 2017 Trustwave Holdings, Inc. All rights reserved. 15

16 6. Click Next. The DbProtect Enterprise Services Host Service can be run as LocalSystem only when the backend database is on the same machine as the Console OR when a SQL Server Authenticated User is used to communicate with the remote backend at runtime (see next steps for details). If this condition is not in place, a Domain/Windows Account can be used to run this Service. 7. On the Ready to install DbProtect Enterprise Services Host page, click Install Schema Component Setup 1. Click the Finish button to exit the Setup wizard. The DbProtect Schema Component Setup wizard displays. 2. Click Next to start the DbProtect Schema Component Setup. The Database Run Time Credentials page displays. Copyright 2017 Trustwave Holdings, Inc. All rights reserved. 16

17 Ensure that the Database runtime account is dbo for all four DbProtect databases. 3. Select Windows Authentication or SQL Authentication and click Test Connection. If you select SQL Authentication, you must also enter a Login and Password. 4. Click Next. 5. Click Install to begin the installation SHATTER Knowledgebase Setup 1. Click Finish to exit the DbProtect Schema Component Setup wizard. The Trustwave SHATTER Knowledgebase Setup Wizard displays. Copyright 2017 Trustwave Holdings, Inc. All rights reserved. 17

18 2. Click Next to start the SHATTER knowledgebase Setup. 3. Click Install to start the installation Data Warehouse Setup 1. Click on Finish to exit the Setup Wizard. The DbProtect Data Warehouse Setup wizard displays. 2. Click Next. The Database Creation Credentials page displays. Copyright 2017 Trustwave Holdings, Inc. All rights reserved. 18

19 3. Select either Windows Authentication or SQL Authentication to create the database. If you select SQL Authentication, you must provide a Login and Password. 4. Click Test Connection and then click Next. The Database Run Time Credentials page displays. Ensure that the Database runtime account is dbo for all four DbProtect databases. 5. Select either Windows Authentication or SQL Authentication to create the database. If you select SQL Authentication, you must provide a Login and Password. Copyright 2017 Trustwave Holdings, Inc. All rights reserved. 19

20 6. Click Test Connection and then click Next. 7. Click Install to install the Data Warehouse Message Collector Setup 1. Click Finish to exit the DbProtect Data Warehouse Setup wizard. The DbProtect Message Collector Setup Wizard displays. 2. Click Next. The Server Log On Credentials page displays. Copyright 2017 Trustwave Holdings, Inc. All rights reserved. 20

21 3. On the Service Log On Credentials page, select Run service as LocalSystem or Run Service as (and enter the account and password). 4. If you select Run service as, click Test Credentials. 5. Click Next. 6. Click Install to begin the installation of the DbProtect Message Collector Analytics Upgrade 1. Click Finish to exit the setup wizard. The DbProtect Analytics Upgrade window displays. 2. Click Next. The Cognos 10 Service Log On Credentials page displays. Copyright 2017 Trustwave Holdings, Inc. All rights reserved. 21

22 3. Select Run service as LocalSystem or Run Service as (and enter the account and password). The Cognos Service can be run as LocalSystem if the backend database is installed on the same machine as the DbProtect Console OR if the Run Time User Account (specified in the next step) is a SQL Server Authenticated user. 4. Click Test Credentials (if you selected Run service as). 5. Click Next. The Content Store Run Time User Credentials page displays. The account that is used in the above step needs to be a dbo for all four backend databases. Copyright 2017 Trustwave Holdings, Inc. All rights reserved. 22

23 6. Select either Windows Authentication or SQL Authentication to create the database. If you select SQL Authentication, you must provide a Login and Password. A SQL Server Authenticated account has to be used if the backend is installed on a different machine than the DbProtect Console and the Cognos Service is being run as LocalSystem. 7. Click Test SQL Connection (only if you select SQL Authentication). 8. Click Next. 9. Click Install to begin the installation. 10. Click Finish to exit the DbProtect Analytics Upgrade. The DbProtect Analytics Content Setup Wizard displays. 11. Click Next to start the wizard. 12. Click Finish to exit the DbProtect Analytics Content Setup Wizard. 13. Click OK when you see the successfully installed prompt DbProtect Scan Engine Upgrade steps You must perform these upgrade steps on every host where a Scan Engine is installed. 1. Right click on the Scan engine executable and select Run as administrator. The Trustwave Scan Engine installer displays. Copyright 2017 Trustwave Holdings, Inc. All rights reserved. 23

24 2. Check the I have read and accepted the license agreement box and click Install. The Trustwave Scan Engine Host Upgrade Information page displays. Copyright 2017 Trustwave Holdings, Inc. All rights reserved. 24

25 3. Click Next to begin the setup wizard. The Service Log On Credentials page displays. 4. Provide the service log on credentials. The Service can either be run as LocalSystem or using Domain/Windows account. 5. If you select Run Service as, you must enter an Account and Password. The Domain/Windows Account must have Log On as Service rights. 6. Click on Test Credentials (if you selected Run Service as) and click Next. 7. On the Port Selection page, enter a port number or accept the default (20001) by clicking Test Port and then clicking Next. 8. Click Install to begin the Scan Engine host Installation. 9. Click Finish to close the Wizard. 10. Click Close to exit out of the installer Post Upgrade Tasks 1. Log in to DbProtect. 2. Check that organizations and assets are visible. 3. Restart any Scan Engines and Sensors that were stopped prior to the upgrade. 4. Force ETL (extraction, transformation, loading of data into the Data Warehouse). 5. Check that you can access the dashboards and the report library. 6. Run the system diagnostic tool. 7. Create and run test job. 8. Export your check result data. 9. Install any downloaded monthly updates to the Analytics Content and the SHATTER Knowledgebase. Copyright 2017 Trustwave Holdings, Inc. All rights reserved. 25

26 10. Run a report on the data. 11. Set up your jobs. 2.2 Upgrading from to If you are currently using DbProtect (or you have upgraded from to 6.4.4), you can upgrade to version Prerequisites for your Current Environment The following must be in place for your environment before you upgrade to Table 4: Prerequisites for DbProtect Assumption A working environment exists Description DbProtect is working correctly and can be accessed. You are using at least Microsoft Windows Server 2008 (for upgrade in place). You are using at least Microsoft SQLServer You have access to a DbProtect SuperAdmin user. The Host Admin user you used to install is still available. A sysadmin account exists. You plan to either upgrade DbProtect with this user, or you are able to log in with this user during the upgrade process. You have access to a sysadmin account on the DbProtect backend database. This can be either the user used to install DbProtect, or a SQL login. You plan on upgrading in place and retain as much data as possible. You plan on leaving your Windows Service user and SQL Server authentication and credentials the same System Requirements for DbProtect Before upgrading to 6.4.9, ensure that your system meets the requirements. Table 5: System Requirements for DbProtect Specification Memory Processor x64 Processor 2.0 GHz+ Disk Details GB 2-8+ cores 30 GB for application Copyright 2017 Trustwave Holdings, Inc. All rights reserved. 26

27 Specification Details 250+ GB for temp/output NOTE: Our benchmarking has shown that disks (whether physical or virtual) having sequential read and write speeds in excess of 100 MB/s yield acceptable performance. This is true for disks on the application server and for the SQL repository. Operating System One of the following (all 64-bit): Windows Server 2008 SP2 Windows Server 2008 R2 SP1 Windows Server 2012 Note: Service pack requirements are updated to support.net Framework 4.6 SQL Server Repository Considerations One of the following: SQL Server 2008 SQL Server 2008 R2 SQL Server bit Standard Editions or higher The repository should be installed on a separate host from the application server, typically in a high-performance SQL farm, and actively managed by DBA operations teams. Note: For UAT environments that want to estimate production level responsiveness, even if a production SQL farm is not used, the I/O responsiveness of the underlying disk and the SQL Server memory/processor configuration should be comparable since they play a key role in performance Pre-Upgrade Tasks 1. Confirm the hardware and Operating System specifications on the system that has the Console installed. 2. Verify backups were taken of the OS. If working with a Virtual Appliance, ensure that you take a snapshot or backup of the appliances prior to upgrading. 3. Verify that a backup of the Databases was taken. 4. Confirm you are using the same user that ran the original install, or have access to that user. 5. Execute the verification script. 6. Execute system help check scripts and check for free space on the database host. Free some log file space if necessary. 7. Check for 30 GB plus free disk space on the host and drive where the Console is being installed. 8. Verify you have an admin user that has sysadmin rights on the database for schema change commands. 9. Check whether or not you have URR data this will require extensive transaction log space during the upgrade. Copyright 2017 Trustwave Holdings, Inc. All rights reserved. 27

28 10. Download the DbProtect Suite and DbProtect Scan Engine Installer files. 11. Download Analytics Content and Knowledgebase updates if available. After the install is complete, you can then specifically upgrade the Analytics Content and SHATTER Knowledgebase to ensure that you have the latest monthly update Upgrade Steps 1. Verify that your server meets the minimum system requirements in regard to RAM, disk space and backend database. DbProtect Suite will run a system verifier. If any requirements are not met, you will not be able to continue with the upgrade. See Table 5 for the system requirements. 2. Verify that you will be able to upgrade all your Scan Engines following the DbProtect Suite upgrade. 3. Make a full backup or copy of all of the DbProtect backend databases - AppDetective, DbPAnalytics, DbPStaging, and DbPDataWarehouse. 4. Prepare to back up your DbProtect licenses, policies, filters, credential profiles, asset lists and custom dictionaries just in case problems occur during the upgrade. 5. Make a backup of your License files from the C:\Program Files (x86)\dbprotect\licenses directory. 6. Export your custom Vulnerability Management Policies and exceptions. For further information please review the following Knowledge Base article on our customer portal: 7. Export your custom Activity Monitoring Policies and filters. For further information see the aforementioned Knowledge Base article. 8. Log out of DbProtect and close your browser. 9. Stop any local Scan Engines or local Sensors you might have running on the DbProtect server. 10. Run the DbProtect Suite installer (Part 1 of 2) to start the upgrade. This takes you through a series of interactive installation wizards which will upgrade the various DbProtect components on your server. If you are installing on a Windows 2008 server, you must use the right-click option to install as administrator to elevate privileges to the highest level Install and Runtime Privilege The DbProtect Services can be run either as LocalSystem or a specific Domain user. The services can only be run as a LocalSystem when the DbProtect backend repository is running on the same machine as the DbProtect Console or when a SQL Server Authenticated User is used to communicate with the backend repository. If you choose to run services as a specific Domain/Windows user, ensure that it has the Logon as a service privilege. The selected user must be allowed to connect to the Active Directory domain (for such operations as checking user credentials during logon to the DbProtect Console) and must have access to the DbProtect backend databases when using Windows Integrated Authentication. During the upgrade the Database account should also have sysadmin rights on the SQL Server Instance. Copyright 2017 Trustwave Holdings, Inc. All rights reserved. 28

29 2.2.6 Upgrading from to The DbProtect installation is divided into two executable files. Be sure to run Part 1 and allow all items in this part to finish, and restart the computer if required, before you run Part Right click on the Part 1 of 2 Executable file and select Run as administrator. The DbProtect Suite installer Part 1 of 2 opens, with all components selected that need to be installed. Copyright 2017 Trustwave Holdings, Inc. All rights reserved. 29

30 2. Check the I have read and accept the license agreement check box and click Install. The System Verifier and prerequisite installations run. Note: The.NET Framework 4.6 installation may require a system restart. After restart, the installer runs automatically. 3. The DbProtect Enterprise Service Host Setup Wizard displays. 4. Click Next to begin the wizard. 5. On the Service Logon Credentials page, select Run service as LocalSystem or Run Service as local or domain user (and enter the account and password). Copyright 2017 Trustwave Holdings, Inc. All rights reserved. 30

31 6. Test the credentials (only if Run service as local or domain user is selected) and click Next. Note: The DbProtect Enterprise Services Host Service can be run as LocalSystem only when the backend database is on the same machine as the Console OR when a SQL Server Authenticated User is used to communicate with the remote backend at runtime (see next steps for details). If this condition is not in place, a Domain/Windows Account can be used to run this Service. 7. On the Ready to install DbProtect Enterprise Services Host page, click Install. 8. Click the Finish button to exit the Setup wizard. 9. If prompted to close the DbProtect Scan Engine Proxy, select Automatically close applications and attempt to restart them after setup is complete. Older versions are removed. The database schema is installed. Copyright 2017 Trustwave Holdings, Inc. All rights reserved. 31

32 Schema Component Setup 1. The DbProtect Schema Component Setup wizard displays. 2. Click Next to start the DbProtect Schema Component Setup. The Database Runtime Credentials page displays. The Database runtime account has to be dbo for all four DbProtect databases. Copyright 2017 Trustwave Holdings, Inc. All rights reserved. 32

33 3. Select Windows Authentication or SQL Authentication and click Test Connection. If you select SQL Authentication, you must also enter a Login and Password. 4. Click Next. 5. Click Install to begin the installation. 6. Click Finish to exit the DbProtect Schema Component Setup wizard. The Trustwave SHATTER Knowledgebase Setup Wizard displays. Copyright 2017 Trustwave Holdings, Inc. All rights reserved. 33

34 SHATTER Knowledgebase Setup 1. Click Next to start the SHATTER knowledgebase Setup. A page displays indicating that Lotus Notes and Domino Server are no longer supported. 2. Select the I understand that Lotus Notes and Domino Server asset types have been desupported. I agree to proceed with this upgrade check box. 3. Click Next. 4. Click Install to start the installation. Copyright 2017 Trustwave Holdings, Inc. All rights reserved. 34

35 Data Warehouse Setup 1. Click on Finish to exit the Setup Wizard. The DbProtect Data Warehouse Setup wizard displays. 2. Click Next. The Database Creation Credentials page displays. 3. Select either Windows Authentication or SQL Authentication to create the database. If you select SQL Authentication, you must provide a Login and Password. The database account for this step requires sysadmin rights. 4. Click Test Connection and then click Next. The Database Runtime Credentials page displays. Copyright 2017 Trustwave Holdings, Inc. All rights reserved. 35

36 The Database runtime account has to be dbo for all four DbProtect databases. 5. Select either Windows Authentication or SQL Authentication to create the database. If you select SQL Authentication, you must provide a Login and Password. 6. Click Test Connection and then click Next. 7. Click Install to install the Data Warehouse. 8. Click Finish to exit the DbProtect Data Warehouse Setup wizard. The DbProtect Message Collector Setup Wizard displays. Copyright 2017 Trustwave Holdings, Inc. All rights reserved. 36

37 Message Collector Setup 1. Click Next. The Server Logon Credentials page displays. 2. On the Service Logon Credentials page, select Run service as LocalSystem or Run Service as local or domain user (and enter the account and password). 3. If you select Run service as local or domain user, click Test Credentials. 4. Click Next. 5. Click Install to begin the installation of the DbProtect Message Collector. 6. Click Finish to exit the setup wizard. This completes part 1 of the DbProtect installer Upgrading from to 6.4.9, Part 2 Right click on the Part 2 of 2 Executable file and select Run as administrator. The DbProtect Suite installer Part 2 of 2 opens, with all components selected that need to be installed. Copyright 2017 Trustwave Holdings, Inc. All rights reserved. 37

38 Analytics Upgrade 1. Check the I have read and accept the license agreement check box and then click Install. The DbProtect Analytics Upgrade window displays. 2. Click Next. The Reporting Engine Service Logon Credentials page displays. 3. On the Reporting Engine Service Logon Credentials page, select Run service as LocalSystem or Run Service as local or domain user (and enter the account and password). 4. If you select Run service as local or domain user, click Test Credentials. 5. Click Next. The Content Store Runtime User Credentials page displays. Copyright 2017 Trustwave Holdings, Inc. All rights reserved. 38

39 6. Select either Windows Authentication or SQL Authentication to create the database. If you select SQL Authentication, you must provide a Login and Password. 7. Click Test Connection and then click Next. 8. Click Install to begin the installation of DbProtect Analytics Content. The DbProtect Analytics Content Setup Wizard displays. 9. Click Next to start the wizard. 10. Click Finish to exit the DbProtect Analytics Content Setup Wizard. Copyright 2017 Trustwave Holdings, Inc. All rights reserved. 39

40 11. Click OK when you see the successfully installed prompt. Copyright 2017 Trustwave Holdings, Inc. All rights reserved. 40

41 2.2.8 DbProtect Scan Engine Upgrade steps You must perform these upgrade steps on every host where a Scan Engine is installed. Before starting, note the Operating System service pack requirements for.net Framework 4.6 (see Table 5). 1. Right click on the Scan engine executable and select Run as administrator. The Trustwave Scan Engine installer displays. 2. Check the I have read and accepted the license agreement box and click Install. Prerequisites are installed if necessary. Note: The.NET Framework 4.6 installation may require a system restart. Copyright 2017 Trustwave Holdings, Inc. All rights reserved. 41

42 3. After prerequisites have been installed, the Trustwave Scan Engine Host Upgrade Information page displays. 4. Click Next to begin the setup wizard. The Service Log On Credentials page displays. 5. Provide the service log on credentials. The Service can either be run as LocalSystem or using Domain/Windows account. 6. If you select Run Service as, you must enter an account and password. The Domain/Windows Account must have Log On as Service rights. Copyright 2017 Trustwave Holdings, Inc. All rights reserved. 42

43 7. Click on Test Credentials (if you selected Run Service as). 8. Click Next. 9. On the Port Selection page, enter a port number or accept the default (20001) by clicking Test Port and then clicking Next. 10. Click Install to begin the Scan Engine host Installation. 11. Click Finish to close the Wizard. 12. Click Close to exit out of the installer Post Upgrade Tasks Note: As a result of security enhancements in DbProtect 6.4.9, you must re-register all Sensors. 1. Log in to DbProtect. 2. Check that organizations and assets are visible. 3. Make a note of the Alias of each Sensor, and then un-register all Sensors. You may need to forcibly unregister. 4. On each Sensor host, un-register the Sensor (using..\sensor\util\force_unregister). 5. From the Console, register each Sensor using the same Alias used previously. 6. Restart any Scan Engines and Sensors that were stopped prior to the upgrade. 7. Force ETL (extraction, transformation, loading of data into the Data Warehouse). 8. Check that you can access the dashboards and the report library. 9. Run the system diagnostic tool. 10. Create and run test job. 11. Export your check result data. 12. Run a report on the data. 13. Set up your jobs. 14. Install any downloaded monthly updates to the Analytics Content and the SHATTER Knowledgebase. Copyright 2017 Trustwave Holdings, Inc. All rights reserved. 43

44 3 Upgrade Checklist Use the list below to track your progress during each upgrade procedure. Pre-Upgrade Tasks Confirm hardware specs on system that has the Console installed are adequate for the installation of the new version Confirm Operating System version and Service Pack is adequate for the installation (note service packs required have been updated to support.net 4.6) Confirm SQL Server version is adequate for the installation Verify backups were taken of OS Verify backup was taken of Databases Confirm you are using the same user that ran the original install or have access to it Execute verification script Execute system help check scripts and check for free space on the database host & free log file space Check for 30 GB + free disk space on the host and drive where console is being installed Verify you have an admin user that has sysadmin on the database for schema change commands Check whether or not you have URR data this will require extensive transaction log space during the upgrade Download the DbProtect Suite and DbProtect Scan Engine Installer files Download Analytics Content and Knowledgebase updates Export credentials Upgrade Tasks Uninstall System Verifier (Only required if not installing with original install user) Execute DbProtect Suite Installer Execute Scan Engine Installer Upgrade Checklist Copyright 2017 Trustwave Holdings, Inc. All rights reserved. 44

45 About Trustwave Trustwave helps businesses fight cybercrime, protect data and reduce security risk. With cloud and managed security services, integrated technologies and a team of security experts, ethical hackers and researchers, Trustwave enables businesses to transform the way they manage their information security and compliance programs. More than three million businesses are enrolled in the Trustwave TrustKeeper cloud platform, through which Trustwave delivers automated, efficient and cost-effective threat, vulnerability and compliance management. Trustwave is headquartered in Chicago, with customers in 96 countries. For more information about Trustwave, visit