McAfee Cloud Workload Security Suite Amazon Machine Image Installation Guide

Transcription

1 McAfee Cloud Workload Security Suite Amazon Machine Image Installation Guide

2 COPYRIGHT Copyright 2018 McAfee, LLC TRADEMARK ATTRIBUTIONS McAfee and the McAfee logo, McAfee Active Protection, epolicy Orchestrator, McAfee epo, McAfee EMM, Foundstone, McAfee LiveSafe, McAfee QuickClean, Safe Eyes, McAfee SECURE, SecureOS, McAfee Shredder, SiteAdvisor, McAfee Stinger, True Key, TrustedSource, VirusScan are trademarks or registered trademarks of McAfee, LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 McAfee Cloud Workload Security Suite Amazon Machine Image Installation Guide

3 Contents 1 Introduction 5 Products in Cloud Workload Security Suite AMI Licensing options and cost Prerequisites for launching Cloud Workload Security Suite AMI 7 Recommendations for user permissions Create a user permission policy Policy for EC2 discovery/visibility Policy for Security Groups remediation Policy for Amazon GuardDuty Policy for workload shut down Policy to enable Network Traffic Discovery Create an IAM role for your AWS account Create an IAM role with flow logs for your AWS account Assign the policy to a user Launching Cloud Workload Security Suite AMI 13 Launch Cloud Workload Security AMI Configure and deploy McAfee security products Verifying McAfee security products Terminate the Cloud Workload Security instances on public cloud McAfee Cloud Workload Security Suite Amazon Machine Image Installation Guide 3

4 Contents 4 McAfee Cloud Workload Security Suite Amazon Machine Image Installation Guide

5 1 Introduction 1 McAfee Cloud Workload Security Suite contains McAfee epolicy Orchestrator (McAfee epo ) and a collection of security products designed to manage and secure your Amazon EC2 instances. This suite is specifically designed to manage and secure cloud environment. The products are packed in to a single suite using Cloud Workload Security Amazon Market Images (AMI). When you deploy Cloud Workload Security suite on your cloud instances, you can: Manage your security policies centrally using McAfee epo. Discover EC2 instances. Measure CPU hours used by instances. View your virtual networks, templates, VNet, firewall (security group), and other infrastructure details of your virtual machines (VMs). Protect EC2 instances from malware, remote exploits, and data theft by deploying McAfee security products. Contents Products in Cloud Workload Security Suite AMI Licensing options and cost Products in Cloud Workload Security Suite AMI The Cloud Workload Security Suite AMI contains McAfee epo and Cloud Workload Security. The Cloud Workload Security Suite AMI has the following list of products. You can download or upgrade these products from McAfee epo Software Manager to secure your EC2 instances. McAfee Agent McAfee Endpoint Security Threat Prevention McAfee Endpoint Security for Servers McAfee Endpoint Security Adaptive Threat Protection (ATP) McAfee Firewall for Linux McAfee Host Intrusion Prevention McAfee Endpoint Security for Linux For details about these products, see the respective product guides. See KB51109 for details about supported environments for different McAfee products. See KB90274 for details about technical support options for Cloud Workload Security from AWS Marketplace. Cloud Workload Security Suite AMI is on Windows Server 2012 R2 Standard with SQL Server Standard McAfee Cloud Workload Security Suite Amazon Machine Image Installation Guide 5

6 1 Introduction Licensing options and cost McAfee has Bring-Your-Own-Licence (BYOL) and Paid versions of the Cloud Workload Security Suite AMI in AWS Marketplace. If you do not have a license, contact McAfee Sales. Licensing options and cost McAfee offers two license models for AMI. Bring your own license (BYOL) If you have already purchased Cloud Workload Security Suite, bring your own license to AWS. If you do not have a license, contact McAfee Sales. Paid The costs are determined based on the number of powered-on instances. You will be charged on an hourly basis for discovery, assessment, and protection of instances using Cloud Workload Security Suite. For the latest pricing, see McAfee Cloud Workload Security Suite AMI in AWS Marketplace page. 6 McAfee Cloud Workload Security Suite Amazon Machine Image Installation Guide

7 2 Prerequisites for launching Cloud Workload Security Suite AMI Before you launch Cloud Workload Security BYOL AMI from the AWS Marketplace, you must create a user permission policy, assign the policy to a user, and create access key and secret key to register your account. Before you launch Cloud Workload Security Paid AMI from AWS Marketplace, you must create a user permission policy and configure the AWS Identity and Access Management (IAM) permissions to securely control access to AWS resources for your users. Cloud Workload Security Suite requires an IAM role to launch the AMI and measure software usage. Contents Recommendations for user permissions Create a user permission policy Create an IAM role for your AWS account Create an IAM role with flow logs for your AWS account Assign the policy to a user Recommendations for user permissions It is recommended that you create a policy with minimum required permissions for a user to use Cloud Workload Security. Each user permission has a specific function. Read permissions are required to discover instances, security groups, EBS volumes, and VPC Flow Logs. Edit/Modify permissions for security groups are required for remediating the flow of security groups in the product. Create permission for log groups are required to set up loggroups to monitor traffic using VPC FlowLogs. Amazon GuardDuty policy is required to view GuardDuty issues. MarketPlace MeterUsage permission is required for AWS Marketplace billing when you use Paid AMI. Create a required user if the user account doesn't exist already. McAfee Cloud Workload Security Suite Amazon Machine Image Installation Guide 7

8 2 Prerequisites for launching Cloud Workload Security Suite AMI Create a user permission policy Create a user permission policy Create a policy with minimum required permissions for a user to use Cloud Workload Security. Task 1 Log on to your Amazon Web Services management console. 2 Click All services Security, Identity & Compliance to load IAM dashboard. 3 Set policies based on the required privilege. 4 Click Review policy. 5 Type a valid name and description. 6 Click Create policy. Policy for EC2 discovery/visibility This policy allows you to create an AWS user with limited privilege user permission policy to discover EC2 assets and read firewall rules. This is a mandatory policy for using Cloud Workload Security. "Version": " ", "Statement": [ "Effect": "Allow", "Action": "ec2:describe*", "Resource": "*" Policy for Security Groups remediation This policy allows you to remediate Security Groups. "Version": " ", "Statement": [ "Sid": "", "Effect": "Allow", "Action": [ "ec2:authorizesecuritygroupegress", "ec2:authorizesecuritygroupingress", "ec2:createsecuritygroup", "ec2:deletesecuritygroup", "ec2:modifyinstanceattribute", "ec2:modifynetworkinterfaceattribute", "ec2:revokesecuritygroupegress", "ec2:revokesecuritygroupingress", "ec2:createtags", "Resource": [ "*" 8 McAfee Cloud Workload Security Suite Amazon Machine Image Installation Guide

9 Prerequisites for launching Cloud Workload Security Suite AMI Create a user permission policy 2 Policy for Amazon GuardDuty This policy allows Cloud Workload Security to discover Amazon GuardDuty events. "Version": " ", "Statement": [ "Sid": "DiscoverGuardGuty", "Effect": "Allow", "Action": [ "guardduty:getthreatintelset", "guardduty:getipset", "guardduty:listipsets", "guardduty:getfindings", "guardduty:listthreatintelsets", "guardduty:getthreatintelset", "guardduty:getmasteraccount", "guardduty:getipset", "guardduty:listfindings", "guardduty:getmembers", "guardduty:getfindingsstatistics", "guardduty:getdetector", "guardduty:listmembers", "guardduty:listdetectors", "guardduty:getinvitationscount", "guardduty:listinvitations", "Resource": "*" Policy for workload shut down This policy allows you to shut down the selected workload as a remediation measure. "Version": " ", "Statement": [ "Sid": "VisualEditor0", "Effect": "Allow", "Action": "ec2:stopinstances", "Resource": "*" Policy to enable Network Traffic Discovery This policy allows you to enable network traffic flow logs at VPC levels. Cloud Workload Security discovers network traffic logs using this policy. "Version": " ", "Statement": [ "Sid": "", "Effect": "Allow", "Action": [ "logs:createloggroup", "logs:deleteloggroup", "logs:describeloggroups", "logs:describelogstreams", "logs:filterlogevents", "logs:getlogevents", McAfee Cloud Workload Security Suite Amazon Machine Image Installation Guide 9

10 2 Prerequisites for launching Cloud Workload Security Suite AMI Create an IAM role for your AWS account "logs:createlogstream", "logs:putlogevents", "iam:passrole", "ec2:createflowlogs", "ec2:deleteflowlogs", "Resource": [ "*" Create an IAM role for your AWS account You must create an IAM role to launch Cloud Workload Security AMI and measure software usage. The IAM role must have appropriate permissions and trust relationships at the time of launching the instance. Required IAM permission Required trust relationship The IAM role must have the aws-marketplace:meterusage IAM permission. By default, the IAM role has a trust relationship with the ec2.amazonaws.com service. To provide the IAM role with this permission, it is recommended that you attach the AWS managed policy AWSMarketplaceMeteringFullAccess to the role. For information about how to change which trusted principles can access an IAM role, see Modifying a Role (AWS Management Console). Task 1 Log on to AWS management console. 2 Select IAM to load the IAM dashboard. 3 Click Roles. 4 Click Create new role. 5 On the Select role type page, next to Amazon EC2, click Select. 6 On the Attach Policy page, in the Filter field, type the name of the user permission policy that you created. 7 Click Next Step. 8 On the Set role name and review page, enter the role name. 9 Click Create Role. For Paid AMI, the policies must be assigned to a role with metering permission. This role associated with the generated instance enables the automatic registration of AWS cloud account on which Paid AMI is deployed. Cloud Workload Security automatically discovers, and starts metering the AWS assets based on the role. For other AWS accounts, you can create policies according to your requirement. The assigned policies will be attached to your access key and secret key using which you can register your account manually. 10 McAfee Cloud Workload Security Suite Amazon Machine Image Installation Guide

11 Prerequisites for launching Cloud Workload Security Suite AMI Create an IAM role with flow logs for your AWS account 2 Create an IAM role with flow logs for your AWS account An IAM role with flow log policies enables you to access the IP traffic flow in your virtual networks. You can view the IP traffic flows of your Virtual networks in the Cloud Workload Security console. Task 1 Log on to AWS management console. 2 Click All services Security, Identity & Compliance IAM to load the IAM dashboard. 3 Select Roles Create role. 4 Select EC2 for EC2 instances. 5 Click Next: Permissions. 6 Click Next: Review. 7 In the Role name field, enter McafeeFlowLogger, and type a meaningful description. 8 Select Create role. 9 Type a name for your role. 10 Under Permissions, choose Add inline policy. 11 Select the JSON tab and copy this policy and paste it. "Version": " ", "Statement": [ "Action": [ "logs:createloggroup", "logs:createlogstream", "logs:putlogevents", "logs:describeloggroups", "logs:describelogstreams", "Effect": "Allow", "Resource": "*" 12 Select Review policy. Type a name for your policy and select Create policy. 13 Select Edit trust relationship. Delete any existing policy document. McAfee Cloud Workload Security Suite Amazon Machine Image Installation Guide 11

12 2 Prerequisites for launching Cloud Workload Security Suite AMI Assign the policy to a user 14 Copy and paste this policy, and click Update trust policy. "Version": " ", "Statement": [ "Sid": "", "Effect": "Allow", "Principal": "Service": "vpc-flow-logs.amazonaws.com", "Action": "sts:assumerole" 15 From the Summary page, take note of the ARN for your role to create your flow log. Assign the policy to a user Assign the required policy to the user on the AWS management console to provide necessary permissions to the user. Before you begin Ensure that you have created a new user. Ensure that you have created the required permissions policy. Task 1 Log on to AWS management console. 2 Click All services Security, Identity & Compliance IAM to load IAM dashboard. 3 Select the user from the Users section. 4 On the Summary page, select the policy that you created, then click Attach policy. 5 Go back to the Summary page, then click the Security Credentials tab. 6 Click Create access key. Secret access key is generated when you create the access key. Use the access key and the secret access key when registering your cloud account using McAfee epo. 12 McAfee Cloud Workload Security Suite Amazon Machine Image Installation Guide

13 3 Launching 3 Cloud Workload Security Suite AMI You can use McAfee Cloud Workload Security Suite AMI from the AWS Marketplace to launch McAfee epo with all McAfee Cloud Workload Security products to secure your cloud instances. Contents Launch Cloud Workload Security AMI Configure and deploy McAfee security products Verifying McAfee security products Terminate the Cloud Workload Security instances on public cloud Launch Cloud Workload Security AMI Launch McAfee epo preconfigured with McAfee security products. Before you begin You must have power user permissions for Elastic Cloud Compute (EC2) and Elastic Block Store (EBS) web service. Task 1 From the AWS Marketplace, select McAfee Cloud Workload Security AMI, then select Launch. 2 On the Choose an Instance Type screen, select the hardware configuration. For McAfee epo, the recommended minimum system requirement is type m4 large with 2 vcpus, and a minimum 7.5 GB of memory. 3 Click Next: Configure Instance Details and specify any configuration details. From the IAM role drop-down list, select the IAM role that you created. 4 Click Next: Add Storage and specify any storage details. We recommend General Purpose SSD for Volume Type. 5 Click Next: Tag Instance and specify a tag for your instance. 6 Click Next: Configure Security Group. We recommend that you leave the default settings. Ports 8443 and 80 must be available for McAfee epo. To create a more secure Security Group, see the product guide for your version of McAfee epo for port configuration specifications. 7 Click Launch. McAfee Cloud Workload Security Suite Amazon Machine Image Installation Guide 13

14 3 Launching Cloud Workload Security Suite AMI Launch Cloud Workload Security AMI 8 In the Select an existing key pair or create a new key pair dialog box, select Choose an existing key pair, to select a key pair that you already created, or create a new key pair. 9 Select the acknowledgment checkbox, then click Launch Instances. It can take about 45 minutes to launch McAfee epo. A confirmation page lets you know that your instance is starting. Click View Instances to close the confirmation page and return to the console. 10 From Instances, right-click the instance and select Instance Settings Get System Log. The System Log window displays these details: The success or failure messages of launching your instance The McAfee epo installation status The URL for accessing McAfee epo The credentials for your McAfee epo account The password for McAfee epo is dynamically generated during each AMI deployment. You can also get the McAfee epo credentials from epodbsettings.txt file available at the root folder of the instance. Log on to McAfee epo using the url with the credentials retrieved from System Log or the text file. We recommend that you delete the epodbsettings.txt file after you have successfully logged on to McAfee epo and changed the password. 14 McAfee Cloud Workload Security Suite Amazon Machine Image Installation Guide

15 Launching Cloud Workload Security Suite AMI Configure and deploy McAfee security products 3 11 To log on to McAfee epo, open a web browser and type epo IP address>:8443. The default user name is Admin and the password is as specified in the system log or the epodbsettings.txt file. The password specified in the system log is the password for McAfee epo admin console and also for the SQL database. The default SQL authentication user is sa. You must change the McAfee epo admin console and the SQL database passwords. See the McAfee epo product guide to change the admin console password. See Microsoft SQL documentation to change the default database password. 12 Update the configuration file using the link epo IP address>:8443/core/config with the new SQL database password. This makes sure that the McAfee epo server connects to the database. If there are failures, you can contact us through this group McAfee-Cloud-Workload-Solutions/bd-p/CloudWorkloadSolutions. Configure and deploy McAfee security products Configure security products on your McAfee epo server. Register your cloud accounts, encrypt volumes, and view reports for your systems. Task 1 Log on to the McAfee epo server as an administrator. 2 Register your AWS/Azure cloud account and discover your cloud assets. Select Menu Configuration Registered Cloud Accounts and register your cloud account. 3 Select Menu Systems Cloud Workload Security to view your cloud asset information. This graphical visualization of your cloud accounts gives you visibility into your cloud infrastructure assets and their hierarchy. The left Issues pane highlights any immediate issues or violations on your firewall settings or your IP traffic settings. 4 Secure the instances in your network by correcting your firewall settings. 5 Download and install McAfee Agent on the systems that you want to secure. If you have Active Directory available in your cloud, you can install McAfee Agent on your instances while you register your AWS cloud account. Systems are changed to Managed on the System Tree. 6 Select Dashboard Public Cloud to see the security summary of your EC2 instances and EBS volumes. Your instances are now protected with anti-virus, anti-malware, intrusion prevention, and file integrity monitoring. The dashboard is automatically updated to reflect the detailed security posture of new instances as they are launched on AWS. If the dashboard shows green on all charts, your instances and volumes are fully protected from threats. McAfee Cloud Workload Security Suite Amazon Machine Image Installation Guide 15

16 3 Launching Cloud Workload Security Suite AMI Verifying McAfee security products Verifying McAfee security products Verify that McAfee security products are installed correctly on your McAfee epo instance so that your systems are secure. To test the anti-virus, run the Eicar test on the endpoint and verify that the file is blocked. For details about Eicar, see For details about testing other McAfee products, see the respective product guides. Terminate the Cloud Workload Security instances on public cloud You can terminate an instance when you no longer need it. Uninstall the installed Cloud Workload Security products using McAfee epo. Task 1 From McAfee epo, delete the registered accounts. 2 From McAfee epo, remove the packages from the Master Repository and the extensions from the Extension List page. 3 Terminate the instance. For instructions on how to terminate your AWS and Microsoft Azure instances, see the AWS and Microsoft Azure documentation respectively. 16 McAfee Cloud Workload Security Suite Amazon Machine Image Installation Guide

17 0-00