Release Notes ================ IBM Security Guardium. Release: v10.0. Completion Date: Guardium v10.0 release notes

Transcription

1 Release Notes ================ Product: IBM Security Guardium Release: v10.0 Version Guardium v10 Completion Date: IBM Guardium offers the most complete database protection solution for reducing risk, simplifying compliance and lowering audit cost. The IBM Security Guardium solution is offered in three versions: IBM Security Guardium Database Activity Monitoring (DAM) IBM Security Guardium for Applications - GFA masks sensitive data in web applications dynamically without changing the web applications themselves. IBM Security Guardium File Activity Monitoring (FAM) - Use Guardium file activity monitoring to extend monitoring capabilities to file servers. The IBM Guardium products provide a simple, robust solution for preventing data leaks from databases and files, helping to ensure the integrity of information in the data center and automating compliance controls. 1

2 Version 10.0 Release Notes Controlled Upgrade Program To ensure overall client success, the Guardium team has put together a team of experts to implement a controlled upgrade program. For a limited time, the Guardium team will work closely with customers that wish to upgrade their Guardium v9 64-bit to v10. The effort will include assistance for a small scale environment or a small subset of a larger environment. This initiative will provide IBM a better understanding of the upgrade from the customers point of view thereby enhancing the upgrade experience for all. Note: For the period of time that the controlled upgrade program is running, the upgrade package will not be available on Passport Advantage or on Fix central. For more information on this program, please contact Carrie Rogers, carriero@us.ibm.com Identify the correct upgrade scenario The best approach for upgrading to Guardium depends on multiple factors, including the Guardium version you are upgrading from, the hardware of your system, and any special partitioning requirements you may have. Determine your current Guardium version and patch level by clicking the? icon in the main user interface and selecting About Guardium. See the table on the next page. 2

3 Use the following to identify the best approach for upgrading your systems to Guardium v10. Table 1. v10 Upgrade Scenarios Version Architecture Partitioning System Type Action Before version 9 Version 9 before GPU 200 Version 9 GPU 200 or later Any Any Any Upgrade to version 9 GPU 500 or above and then revisit this topic to continue your upgrade to version bit Any Any Visit the Guardium KnowledgeCenter for information about upgrading to version 9 GPU 500 or above. 32-bit Any Any Upgrade to version 10 following a backup, rebuild, and restore upgrade 32-bit Any Any procedure. 64-bit Nonstandard or GPT (GUID Partition Table) Any Standard Central Manager or standalone Upgrade to version 10 using the standard upgrade patch. Managed unit Upgrade to version 10 using either the standard upgrade patch or the network upgrade patch. Important: The standard upgrade patch for V10.0 is greater than 2 GB in size while the network upgrade patch for V10.0 is approximately 50 KB in size. For this reason, consider using the network upgrade patch when upgrading managed units in an environment with a Central Manager. SSLv3 must be disabled before upgrading to V10.0. To disable SSLv3 on systems at or above V9 GPU 200 but below V9 GPU 500, download patches 9501 and 9502 from Fix Central and follow the instructions in the patch release notes or upgrade to V9 GPU500. All Guardium systems in your environment must have SSLv3 disabled before upgrading to V10.0. Note: Guardium for Applications is not available when upgrading via patch from v9.5, since there is no Guardium for Applications function in v9.5. A full rebuild as a v10.0 Guardium for Applications system is required. 3

4 Upgrading Summary Latest Health Check is required. Health Check installed prior to GPU must be re-installed prior to V10 upgrade. SSLv3 must be disabled For a discussion of SSLv3 protocol vulnerability and Guardium Central Manager, see page 4 in the Guardium v9.5 release notes (March 2015), Upgrade only supports 64-bit systems Upgrade only supported for v9.0 GPU200 or higher Collector-based Central Managers are not supported in v10.0. Upgrade will convert to Aggregator Manager. Order of Upgrade Upgrade IBM Guardium appliances in following required top-down order: 1. Central Manager 2. Aggregator 3. Collector 4. GIM agent 5. S-TAP agent Please make sure that each step in the sequence above successfully completed before proceeding to the next step. The upgrade process usually cannot be done simultaneously on all appliances (Central Manager, Aggregator, Collector and Managed Units) and all S-TAPs at the same time. During the upgrade transition, the customer will have a hybrid version of different v9.x and v10.0 Guardium systems. While this "hybrid mode" is supported by Guardium, many functions are limited until all components are at the same version. Therefore, it is strongly recommended to complete the upgrade in a timely manner and have all Guardium components at the same version and the same patch level. 4

5 Upgrading and Installing - Quick Search for Enterprise During the.iso installation of V10 and on any pre-v9.0p500 upgrades to V10, the default search mode for Enterprise search is cm_only, which means that you can do Enterprise search on only the Central Manager and local search on managed collectors. When you click on the search button in the Guardium application GUI on a managed aggregator, you will see the following message in the search window: "Enterprise search may not be enabled, for future information look at the V10 documentation section, GuardAPI Quick Search for Enterprise Functions". To enable Enterprise search on the aggregator, you need to run the CLI command, grdapi set_enterprise_search_options distributed_search=all_machines To disable enterprise search on the aggregator and prevent the message, you need to log in to the Central Manager and run the GuardAPI command grdapi set_enterprise_search_options distributed_search=cm_only S-TAP Reminders when Upgrading Make sure that current guard_tap.ini parameters are preserved. If a guard_monitor process is running, turn it off and, after the upgrade, turn it back on. UNIX S-TAP 64-bit session key This function decreases the likelihood of collisions on the key causing traffic losses. A 64-bit session key was introduced in V9.0 with Sniffer Update p4038. If v9.0 or v10.0 Guardium customers want to use v10 S-TAPs, the Sniffer version must be p4038 and above. Note: A V10 S-TAP and a V9.0 collector is not a recommended configuration. The collector should be the same level as its agents. Note: Upgrading from V10 Beta is not supported. v8.2 S-TAPs are not supported for v10 Guardium systems. v8.2 GIM works, but v8.2 S- TAPs will not connect. As a rule for S-TAPs, Guardium supports one version back from the Guardium system version. 5

6 Limitations of a v9/v10 Mixed Guardium Environment During the upgrade to v10, it is possible for the managed environment to enter a mixed state. A mixed environment is comprised of a v10 CM and v9 MUs at patch level 200 or above. IBM Security Guardium v10 does not support mixed environments with MUs below GPU200. Although a mixed environment is supported, there is an associated set of limitations that must be considered in any upgrade plan, as it means certain capabilities will not be available until the entire environment is brought up to v10. It is for this reason that it is recommended to upgrade the entire environment to v10 as soon as possible. The following are the limitations that exist in a mixed environment. 1. Unable to distribute any configurations from v10 CM to v9p200+ MU 2. The following reports will result in a SQL error when viewed on v9p200+ managed units: Agg/Archive Log Connections Quarantined Installed Patches Inactive Inspection Engines S-TAP Verification 6

7 3. Unable to register additional v9p200+ MUs after upgrading CM to v10 Note: Units registered before the upgrade will remain registered after the upgrade. 4. Unable to distribute policies on v9p200+ MUs via v10 CM Note: Policies already installed on the MUs prior to the upgrade will remain unchanged. Portal sync will continue synching between v10 CM and v9p200+ MUs. 5. Unable to distribute PATCH BACKUP settings from v10 CM to v9p200+ MUs Note: PATCH BACKUP settings defined before the upgrade will remain unchanged. 7

8 6. UI layout customization and distribution is not supported from v10 CM to v9p200+ MUs 7. Quick Search for Enterprise will work in a mixed environment that consists of a v10 CM managing v9p530+ MUs. The GUI will need to be restarted in order to reinitialize enterprise quick search. Managed units prior to GPU500 will be unable to take advantage of enterprise search, although local Quick Search is still available. 8. Unable to view remote data on v10 CM from v9p200+ MUs. This extends to any report that relies on the use of remote data sources. 9. Aside from Enterprise Buffer Usage Monitor, data from v9p200+ MUs is not accessible in the following enterprise reports on the v10 CM due to underlying Database changes: Enterprise S-TAP Verification Enterprise Load Balancing Events 8

9 New for V10 features/functions and enhancements New for V10 Use the product more easily through an intuitive user interface. From the new GUI banner (a powerful control center with alerts and to-dos), search the User Interface to quickly navigate to a tool or report and search Data or Files (Quick Search). Create dashboards to easily organize and review your most commonly used reports. A dashboard is a user-personalized space in which you can drop reports and organize reports for easy access. Extend monitoring of sensitive data to include data stored in files as well as in databases - File Activity Monitoring. (Note: FAM is a separately-licensed Guardium product.) You can use Guardium file activity monitoring to extend monitoring capabilities to file servers. File activity monitoring is similar to database activity monitoring in many respects. In both cases, you discover the sensitive data on your servers and configure policies to create rules about data access and actions to be taken when rules are met. File activity monitoring is supported for a wide variety of Linux platforms (including Power and s390), AIX and Windows. Discovery and classification platform support is less extensive. Guardium v10.0 is a 64-bit application running on RedHat Linux 6.5. Scenario-based task flow to discover and protect sensitive data and audit process Easy UI customization and managing role permissions Easily customize the Guardium navigation menu using a simple drag-and-drop interface. Customizations are supported for individual users and for roles, allowing administrators to create navigation menus that give users only the tools they need. New online help system with a more powerful search engine Service status dashboard and consolidated support and maintenance view The Services Status panel is a centralized place to check status of services such as CAS or alerter, and if necessary, enable or disable each service. Optimize the scheduling of jobs by creating dependencies The Guardium collector has many tasks such as Policy Installation, Audit Processes, Group updates, etc. that are scheduled to run periodically. The Job dependencies feature finds all jobs that have a direct relationship and impact on the success of the execution of the task you are trying to schedule. 9

10 New support for Definition Import/Export (including Computed Attributes, Datamarts, Dashboard (preview), Discover Sensitive Data (DSD), Query-Rewrite, and MongoDB datasource). New License acceptance process - For new installs from.iso or when adding new licenses to an upgraded system, there is a licensing UI where users can read and review licensing terms before accepting the license. It integrates with licenses added from the API by showing those licenses in an added-but-not-yet-accepted state--essentially, just waiting for the user to come review and accept the terms. Enhancements for V10 Quick Search for Enterprise and Investigation Dashboards First introduced in V9.5, Quick Search for Enterprise enables quick search across multiple collectors in a managed environment. The investigation dashboard works hand-in-hand with Quick Search by providing a set of interrelated charts that display relationships and activity. Click on a cell in a chart to automatically filter all data in the dashboard and drill down into particular areas of interest. You can also create and save multiple dashboards to support different investigative use cases. Preview: animation chart Available as a technology preview, the animation chart is also available from the investigation dashboard. This chart uses animated circles to represent activity over the last 48 hours, based on user-specified x and y axes. The data is auto-played, where each frame is an hour in time. Add format-preserving encryption and tokenization to Guardium for Applications data masking. (Note: GFA is a separately-licensed Guardium product.) To mask data, you must create and configure Guardium data masking polices that specify the data that is to be masked. The procedure that you use to create data masking policies is similar to the procedure that you use to create other types of Guardium policies. Help you to identify the best collector to manage new S-TAPs - S-TAP Load Balancer Load balancing automatically allocates managed units to S-TAP agents when new S-TAPs are installed and during fail-over when a managed unit is unavailable. The load balancing application also dynamically balances loaded or busy managed units by relocating S-TAP agents to less-loaded managed units. Enhanced instance discovery - no further dependence on Java or external libraries Protect data by rewriting queries. Perform fine-grained access control for databases by intercepting database queries and rewriting them based on criteria defined in security policies. 10

11 Vulnerability Assessment - Assess the vulnerability of new databases (MongoDB, DB2 for i, AsterDB, SAP HANA). Vulnerability Assessment - STIG benchmark for Oracle11gR2 and SQL Server Entitlements reports for DB2 for i GIM Enhancements Automate kernel upload via GIM and automated BUNDLE creation Auto-discovery report for GIM Listeners Classifier - Discovery and classification for unstructured data Accelerators are now included in main release, no need for separate accelerator patches. Auto discovery auto-detect.pl is also included by default, no need for separate patch. Enhanced patch signing for V10 V10 and Developerworks For more information, see the Guardium V10 articles on IBM Developerworks: nityuuid=432a9382-b250-4e55-98d7-8e9ee6cbf90e What's new in IBM Security Guardium V10 (Developerworks) Analyze, adapt, and protect For V10 For a list of V10 databases and operating systems, go to: V10.0 System Requirements (Platforms Supported) (August 2015) 11

12 Simplified GIM Consolidated Installer UNIX/Linux 1. Create directory on the database server: Example: mkdir /var/tmp/gim 2. Copy the "consolidated_installer.sh" script and the three shell installers for BUNDLE-GIM, BUNDLE-STAP, and BUNDLE-FAM (optional) to /var/tmp/gim Example: # ls -l /var/tmp/gim total rwxr-xr-x 1 root root Aug 16 21:31 consolidated_installer.sh -rwxr-xr-x 1 root root Aug 16 21:31 guard-bundle-famfoxhound_r79927_trunk_1-rhel-6-linux-x86_64.gim.sh -rwxr-xr-x 1 root root Aug 16 21:31 guard-bundle-gimfoxhound_r79927_trunk_1-rhel-6-linux-x86_64.gim.sh -rwxr-xr-x 1 root root Aug 16 21:31 guard-bundle-stapfoxhound_r79927_trunk_1-rhel-6-linux-x86_64.gim.sh Run 'chmod a+x /var/tmp/gim/consolidated_installer.sh 3. Execute the script to install GIM, STAP and FAM on the Database server Example: # pwd /var/tmp/gim #./ consolidated_installer.sh --installdir /usr/local/ibm --tapip <db_server_hosname> -- gim_sqlguardip <GIM_SERVER_HOSTAME> --stap_sqlguardip <GUARDIUM_COLLECTOR_HOSNAME> --perl /usr/bin After install complete all BUNDLES that resides in this directory will be installed. 12

13 Simplified GIM Consolidated Installer Windows Set up GIM consolidated installer. 1. In the source directory create a folder and name it "deploy". 2. Copy into this folder two files for each module you wish to install (FAM or S-TAP). For S-TAP guard-winstap-guardium_r79771_1-windows-server-windows-x86_x64_ia64.exe.signed conf.reload.winstap For FAM guard-fam-guardium_r79919_1-windows-server-windows-x86_x64_ia64.exe.signed conf.reload.fam 3. Check the conf.reload files to ensure that the parameters desired are set properly. For STAP there are no required changes. STAP will adopt the TAP_IP and SQLGUARD_IP from GIM. For FAM you will need to set the same minimum requirements as you would for a GIM install. Specifically, you need to set the SOURCE_DIRECTORY. 4. Once the folder is created and configured as described, you can run GIM installation through command line and the modules configured in the deploy folder will be installed once GIM has finished its installation. 13

14 Known Issues and Limitations Issue No. Description Guardium Component Bug # Fixed in 10.0p01 1. V10 is only available in English. 2. Utilization records do not work on the aggregator appliances. 3. Distributing Configuration from Central Manager to Managed Unit will cause the Data Archive to not work on the target Managed Unit. The recommended workaround is to configure the Data Archive locally on the managed unit. Aggregator Yes Aggregator Yes 4. SIEBEL Application User translation does not work in V10. Application User Translation Classifier policy action type of Write to syslog is not working. 6. Guardium customers need to reload custom jar files (MS SQL or Oracle) after upgrade to v No back link for second drill down in Dashboard Reports. 8. Data Archive process failing with TSM protocol. 9. To facilitate search result performance in an enterprise environment, the Object facet results are returned only on demand. Click on the question mark to retrieve the object values. Again to facilitate performance, for any facet (except Guardium Appliance facet) that contains more than 10 distinct values, only the top 10 values are returned. Classifier Custom JAR files Dashboard Data Archive Yes Enterprise Search 14

15 Issue No. Description 10. FAM customers should not use wide open FAM policy parameters to monitor the whole system (or large part of it) or to monitor all users. This might cause system performance issues. 11. Change of FAM configuration parameters ( Design Plan entity, MaxDepth, excluded files, excluded extensions, or excluded folders) does not trigger a FAM rescan. Workaround- When changing only the classification rule, also change deepanalysis to false and then apply it back as true. This change will now be identified and run correctly. Guardium Component Bug # FAM FAM Fixed in 10.0p FAM always monitors subdirectories when using /* wildcard. 13. Turning off FAM by setting FAM_enabled parameter to 0 (Linux FAM) does not stop the ICCM process. FAM FAM A false exception error appears when there are no FAM results to show (This message appears on Central Manager). FAM and Quick Search for Enterprise Yes 15. Monitor gdm_statistics is disabled by default. There will be an error setting it to 1-hour. Workaround is to enable it to 2-hours and, if needed, change back to 1-hour- gdm_statistics. 16. GuardiumProxy support by IBM BigInsights is no longer supported in V10. Customers should use regular Guardium S-TAPs. GDM_ statistics Yes IBM BigInsights 15

16 Issue No. Description 17. When you login as a user who has "user" role assigned to it, then you cannot launch the Investigation dashboard in Quick search. You will see the error message "You are currently not authorized to view this report, please log in and try again". However, you can perform the search operations and see the Search server status view. To correct this situation, add "admin-console-only" role to "user" or add "Administration Console" to the designated role. 18. Managing Roles and Permissions is the help topic for both the Role Browser and Role Permissions GUI pages in the Accessmgr user selection. Select this help topic from the Role Browser GUI page. 19. Dashboard is not customizable for roles. 20. There is an issue with the AIX S-TAP on PureScale systems with RDMA enabled. Customers with this environment should continue to use the V9 STAP. A fix is being developed. This issue does not affect any non- PureScale AIX systems, or any other operating systems. It does not affect PureScale systems using TCP instead of RDMA. Guardium Component Investigation, Quick Search Online Help Bug # UI UNIX S-TAP Fixed in 10.0p01 16

17 Issue No. Description 21. Restart the alerter will resolve instances when the alerter will become unable to send SMTP and SNMP messages after the upgrade. Guardium recommends that the alerter be restarted whenever possible after the upgrade completes as a precaution to prevent this scenario from interrupting alert messages. 22. V9-to-v10 upgrade for Guardium systems with SAN volumes is not supported. 23. Old unused certificates are preserved in Keystore during the upgrade process when the appliance is upgraded directly from the v9.0p200 level appliance. This could cause positive Certificate Expiration warnings. These unused certificates were removed in GPU 300 and later. To avoid this issue, customers with GPU 200 level appliances are encouraged to upgrade to the latest v9.0 GPU before proceeding with a v10.0 upgrade. 24. Adding more than four date fields to VA summary report results in error. 25. Limitations with Google Chrome 44 web browser, see Google bug on this issue, ues/detail?id= Session information may be lost after failover when using the Load Balancer parameter PARTICIPATE_IN_LOAD_BALANC ING and then the Load Balancer managed units are 3 or more. Guardium Component Bug # Upgrade Upgrade Upgrade VA Web browser Windows S-TAP Fixed in 10.0p01 17

18 Issue No. Description 27. The functionality to delete quarantine for type IMS and DB2 for zos is not working. Guardium Component Bug # zos Yes Fixed in 10.0p01 Note: Important issues in this table will be addressed in future V10 maintenance releases. 18

19 Relevant Information for V10 DB2 for i How to use AppEvent from IMS, including the UTF8 restriction The data holding user information of an APP_EVENT DLI call needs to have similar syntax as GuardAppEvent api. The first two bytes represent ccsid of the encoding of the following bytes. For example, 0x04B8 stands for ccsid The following bytes need to have the syntax as below: SELECT GuardAppEvent:Start, GuardAppEventType:type, GuardAppEventUserName:name, GuardAppEventStrValue:string, GuardAppEventNumValue:number, GuardAppEventDateValue:date FROM DUAL For further reference for type, name, string, number, date, check GuardAppEvent API. Currently, only UTF8 encoding is supported. Minimum requirements and search engine for Quick Search for Enterprise When upgrading to Guardium v9.5 and above on systems meeting the minimum requirements for Quick Search for Enterprise (>24 GB and 4 cores), the upgrade replaces the underlying search engine. An additional search process will consume memory as the new search engine builds its index (the default retention period is three (3) days). Once the new index is built, the old process stops and old index data is removed. If possible, avoid running large batch processes during this time. Upgrading to v9.5 and above on hardware that does not meet the minimum requirements for Quick Search for Enterprise (< 24 GB and 4 cores) retains the existing Quick Search engine and functionality. A new search process is not started and a new search index is not built. 19

20 Link to formal Guardium V10 product announcement: 20

21 Online help available via Web The online help is included in the Guardium v10.0 Knowledge Center on the Web at: Search all the product information together at that site. The Knowledge center is updated more frequently than the embedded online help and is the most up-to-date source of information. V10 Detailed Release Notes (August 2015) Links to System requirements/ Technical requirements for v10.0 V10.0 System Requirements (Platforms Supported) (August 2015) 64-bit V10.0 Software Appliance Technical Requirements (August 2015) 64-bit V10.0 S-TAP filenames and MD5Sums (August 2015) October-08 IBM Guardium Version 10.0 Licensed Materials - Property of IBM. Copyright IBM Corp U.S. Government Users Restricted Rights - Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp. IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at Copyright and trademark information ( 21