McAfee Cloud Workload Security Product Guide

Transcription

1 Revision B McAfee Cloud Workload Security Product Guide (McAfee epolicy Orchestrator)

2 COPYRIGHT Copyright 2018 McAfee, LLC TRADEMARK ATTRIBUTIONS McAfee and the McAfee logo, McAfee Active Protection, epolicy Orchestrator, McAfee epo, McAfee EMM, Foundstone, McAfee LiveSafe, McAfee QuickClean, Safe Eyes, McAfee SECURE, SecureOS, McAfee Shredder, SiteAdvisor, McAfee Stinger, True Key, TrustedSource, VirusScan are trademarks or registered trademarks of McAfee, LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 McAfee Cloud Workload Security Product Guide

3 Contents 1 Overview of Cloud Workload Security 5 Key features of Cloud Workload Security How Cloud Workload Security works Managing policies with McAfee epo 9 Cloud Workload Security policies on McAfee epo Set Cloud Workload Security policies Finding policies Create an assessment policy Create a firewall policy Create a container policy Assign custom policies to systems in your network Visualization of your cloud accounts 15 Viewing Cloud Workload Security console Viewing information about Threat Events Viewing traffic flow logs Viewing information about pods View information about Security Groups Viewing information about Threat Prevention Viewing information about Application Control software Viewing information about Policy Auditor Viewing information about Change Control software Viewing information about volume encryption Assign assessment policy for your workload Automatic responses Set up automatic responses Manage responses to trigger actions for threat events Remediation 27 Install McAfee Agent on your instances Installing Threat Prevention Install McAfee Endpoint Security Install Application Control on your instances Install Policy Auditor on your instances Install Change Control Install Network Intrusion Prevention System on your instances Install Adaptive Threat Protection on your instances Quarantine workload Remediate firewall rules Edit the security group rules Detach the security group from an instance Shut down workload Tag workloads Update DAT McAfee Cloud Workload Security Product Guide 3

4 Contents Run on-demand scan Assign network policies for pods Quarantine pods Queries and reports 39 Predefined queries View default queries Create custom queries Dashboards and monitors Best Practices for using Cloud Workload Security 47 How McAfee epo server and clients communicate Scaling McAfee epo installed on AWS Considerations for scalability Managing and remediating workloads using Chef Managing and remediating workloads using Puppet Managing AWS clients using McAfee epo installed on AWS Managing instances in one geographic region Managing instances in one geographic region with one VPC One geographic region deployment with multiple VPCs Multiple geographic region deployment Set up McAfee epo and client communication Managing AWS clients using McAfee epo installed on-premise Using McAfee Agent deployment URL feature Set up McAfee epo and client communication Using Cloud Workload Security Deploying McAfee security products on AWS cloud Deploy McAfee security products on AWS instances using AMIs Deploying McAfee security products on AWS using Cloud Workload Security Quarantine workloads Configure OpenStack (Generic) instances Frequently asked questions 61 Index 65 4 McAfee Cloud Workload Security Product Guide

5 1 Overview 1 of Cloud Workload Security McAfee Cloud Workload Security helps you discover, import, manage, and secure your Amazon Web Services (AWS), Microsoft Azure, and VMware vcenter virtual infrastructure using McAfee epolicy Orchestrator (McAfee epo ). It also discovers, assesses, and remediates container based application managed through Kubernetes cluster using McAfee epo. Cloud Workload Security offers improved visibility and control to address the unique requirements of public cloud server security. It detects and imports virtual infrastructure details, security groups, and virtual networks to the McAfee epo server. It provides control over cloud infrastructure and insight into the threat information across clouds. It also offers infrastructure visibility and security alerts so that you can quickly assess security issues and take immediate actions. Contents Key features of Cloud Workload Security How Cloud Workload Security works Key features of Cloud Workload Security Cloud Workload Security integrates the management feature of McAfee epo with the configured cloud, which hosts and manages VMs and Containers, and synchronizes periodically with the cloud accounts, and imports the virtual infrastructure details to McAfee epo. It has an innovative dashboard to view and monitor security compliance of your cloud assets. You can flag systems at risk and take corrective actions. You can deploy McAfee Agent and install other McAfee Agent products on the discovered instances. Visualization of your cloud workloads The user interface gives you a complete view into your cloud accounts and their assets with security status. You can view your virtual workload group list, security risk and threat details, other security product installation status, firewall (security group), and other system information of your virtual machines (VM). You can view the total number of pods and their network assessment policy details. Compliance and security posture assessment You can view potential threats and unsafe settings so that you can take appropriate actions. You can define compliance policies for security assessment. You can view all high and low compliance events in the Cloud Workload Security dashboard. You can view these details in your network configuration. Security settings that include unsafe firewall settings for AWS and Microsoft Azure accounts. Security settings that check the network policies for pods. Systems without McAfee security products installed. McAfee Cloud Workload Security Product Guide 5

6 1 Overview of Cloud Workload Security Key features of Cloud Workload Security Security group management You can view security group information of your virtual instances across your cloud accounts. You can see how many instances are associated with any firewall (security group) or network security. You can also manage these firewall (security groups) by adding, editing, or deleting rules. You can detach a firewall (security group) from an instance. Network visualization and anomaly detection Cloud Workload Security assesses your cloud configuration and flags systems, which are at risk. You can immediately take appropriate actions and secure your assets. Easy activation of missing protection with a few clicks After visualizing your cloud account structure, and seeing which systems are at risk, you can secure your instances with a few clicks. 1 Manage your instances by installing McAfee Agent. 2 After installing the agent, you can install these McAfee products on your instances. McAfee Endpoint Security McAfee Endpoint Security for Linux McAfee Host Intrusion Prevention for Linux McAfee Application Control McAfee Policy Auditor McAfee Change Control McAfee Endpoint Security Adaptive Threat Protection (ATP) Support for AWS instances Discover, manage, and secure the AWS instances using McAfee epo. Support for Kubernetes cluster Discover Docker containers on Kubernetes, and secure them using network segmentation. Support for Microsoft Azure Resource Manager Discover, manage, and secure the Microsoft Azure Resource Manager virtual infrastructure with McAfee epo. Support for VMware vcenter cloud instances View your VMware vcenter cloud infrastructure details. You can secure your instances by installing McAfee security products on them. Support for OpenStack account Discover and secure OpenStack (Pike) cloud accounts with McAfee epo. Cloud usage metering You can track the usage of AWS and Microsoft Azure running cloud VMs with the metering feature. The usage of VMs is tracked in the sum of CPU hours that an account uses on a monthly basis. 6 McAfee Cloud Workload Security Product Guide

7 Overview of Cloud Workload Security How Cloud Workload Security works 1 How Cloud Workload Security works Cloud Workload Security has a variety of components that perform specific functions to discover, manage, and secure your cloud assets. Amazon Web Services (AWS) Collection of web services that make up the cloud computing solution offered by Amazon. Kubernetes Open-source platform for automating deployment, scaling, and management of container applications. Microsoft Azure Cloud computing platform and infrastructure for building, deploying, and managing applications and services through a global network of Microsoft-managed datacenters. OpenStack Open-source platform for cloud computing and infrastructure for deploying virtual servers and other resources. Virtual Machines (VMs) An isolated guest operating system installation in a normal host operating system that supports both virtual desktops and virtual servers. Security Groups A virtual firewall for your instances to control inbound and outbound traffic. Network Security Groups A list of rules in Microsoft Azure cloud network that allow or deny network traffic to your instances. Azure Virtual Network A logical isolation of your Azure cloud dedicated to your subscription. AWS Virtual Private Cloud A logically isolated section of Amazon Web Services cloud to launch your AWS resources in a virtual network. McAfee epo Management software that allows you to register a cloud account, so that you can import your VMs and view them. McAfee Agent The client-side component providing secure communication between McAfee epo and managed products. Hypervisor (ESXi) A virtual operating platform that manages the execution of the guest operating systems. They allow multiple operating systems to run concurrently on a hosted system. ESXi are embedded hypervisors for servers that run directly on server hardware, without requiring another underlying operating system. VMware vcenter Console that manages the ESXi servers, which host the guest VMs that require protection. McAfee Cloud Workload Security Product Guide 7

8 1 Overview of Cloud Workload Security How Cloud Workload Security works 8 McAfee Cloud Workload Security Product Guide

9 2 Managing 2 policies with McAfee epo You can integrate and manage assessment policies using McAfee epo. McAfee epo provides centralized policy management and enforcement of your McAfee security products and the systems where they are installed. It also provides comprehensive reporting and product deployment capabilities through a single point of control. Contents Cloud Workload Security policies on McAfee epo Set Cloud Workload Security policies Finding policies Create an assessment policy Create a firewall policy Create a container policy Assign custom policies to systems in your network Cloud Workload Security policies on McAfee epo The default policies fit the broadest set of customer environments. You can tune these policies to fit your environment. Cloud Workload Security adds these categories in the Policy Catalog. Category Assessment Rules Firewall Assessment Rules General Assessment Rules Container Description This policy defines the firewall settings for the systems. You can set inbound rules for the systems. It also defines how the systems are flagged if they violate the specified rules. This policy defines how the systems are flagged if the products aren't installed. This policy defines how the pods are flagged if they don't have any network policies associated with them. Assessment Rules General, has Core Protection, Full Compliance, McAfee Default, and My Default policies. Assessment Rules Firewall, has McAfee Default and My Default policies. You can use these policies as is or you can edit My Default policies. Assessment Rules Container, has McAfee Default and My Default policies. McAfee Cloud Workload Security Product Guide 9

10 2 Managing policies with McAfee epo Set Cloud Workload Security policies Policy Description McAfee Default Defines the out-of-the-box policy that takes effect if no other policy is applied. You can duplicate this policy, but you can't delete or change it. My Default Defines the customizable default policy for your environment. Modify this policy to create your own customized default policy. Core Protection Full Compliance Defines the core or important protection that you can have in your environment. Defines the strongest protection that you can have in your environment. Set Cloud Workload Security policies You can set up Cloud Workload Security policies in McAfee epo. These policies define the permission levels to access Cloud Workload Security policies and tasks. Task 1 Log on to McAfee epo as administrator. 2 Select Menu User Management Permission Sets. 3 Click Edit against Cloud Workload Security : Policies: in the Permission Sets page. 4 Select: No permissions to deny access to Cloud Workload Security policies and tasks. View policy and task settings to set view permissions for Cloud Workload Security policies and tasks. View and change policy and task settings to set view and edit permissions for Cloud Workload Security policies and tasks. 5 Click Save. Finding policies View and manage your firewall policies from three locations in the McAfee epo console. You can assign policies to your cloud accounts using the Assigned Policies tab (Systems System Tree Assigned Policies for a selected group in the System Tree), and the Policy Catalog tab (Systems Policy Catalog). You can also assign policies from Cloud Workload Security user interface when you register your cloud accounts. Use the Policy Catalog to: Create policies. View and edit policy information. View where a policy is assigned. View the settings and owner of a policy. View assignments where policy enforcement is disabled. Import and export policies. 10 McAfee Cloud Workload Security Product Guide

11 Managing policies with McAfee epo Create an assessment policy 2 Duplicate policies. Share policies. Use the Assigned Policies tab to: View the available policies of a particular feature of the product. View details of the policy. View inheritance information. Edit policy assignment. Edit custom policies. Create an assessment policy Create a custom assessment policy to suit your environment. Task 1 Log on to McAfee epo as an administrator. 2 Select Menu Policy Policy Catalog, then from the Product list, select Cloud Workload Security. 3 From the Category list, select Assessment Rules - General. 4 Click the name of an editable policy. You can edit the My Default policies, or any policies that you create. McAfee Default policies aren't editable. 5 Set the product flags to Must Have, Good to Have, or Optional. If Must Have products are missing, critical alerts (red) are flagged. If Good to Have products are missing, warnings (yellow) are flagged. If Optional products are missing, no alerts are flagged. You can set these flags for Strong Security Groups, Volume Encryption, Intrusion Prevention, Threat Prevention, Application Control, Policy Auditor, Change Control (FIM), and Adaptive Threat Prevention. Strong Security Groups are always set as Must Have for your AWS and Microsoft Azure accounts. You cannot change this setting for AWS and Microsoft Azure accounts. 6 Click Save. The new policy appears in the Policy Catalog. Create a firewall policy Create a custom firewall policy to suit your environment. Task 1 Log on to the McAfee epo server as an administrator. 2 Select Menu Policy Policy Catalog, then from the Product list, select Cloud Workload Security. 3 From the Category list, select Assessment Rules - Firewall. McAfee Cloud Workload Security Product Guide 11

12 2 Managing policies with McAfee epo Create a container policy 4 Select New Policy, type a name for the policy, then click OK. 5 Click the name of an editable policy. You can edit the My Default policies, or any policies that you create. McAfee Default policies aren't editable. 6 Specify which inbound firewall rules can come from which IP addresses and their severities. Option If inbound firewall rule to port Then flag as Severity Select the inbound port from the list. Select the flag value from Safe or Critical. You can set If inbound firewall rule to port option to Any to allow all ports, then flag them as Safe or Critical. If you don't specify a rule for a port, it is flagged as Warning. Critical alerts are flagged for unrestricted IP addresses (with suffix /0) only. For example, a firewall policy is set in Cloud Workload Security (RDP) Critical 80 SAFE These are the assessment results Anywhere RED 3389 <Custom IP> SAFE 80 Anywhere SAFE 80 <Custom IP> SAFE 8082 Anywhere YELLOW 8082 <Custom IP> YELLOW 7 Click Save. The new policy appears in the Policy Catalog. Create a container policy Create a custom container policy to suit your environment. Task 1 Log on to the McAfee epo server as an administrator. 2 Select Menu Policy Policy Catalog, then from the Product list, select Cloud Workload Security. 3 From the Category list, select Assessment Rules - Container. 4 Select New Policy, type a name for the policy, then click OK. 5 Click the name of an editable policy. You can edit the My Default policies, or any policies that you create. McAfee Default policies aren't editable. 12 McAfee Cloud Workload Security Product Guide

13 Managing policies with McAfee epo Assign custom policies to systems in your network 2 6 Select a container network policy. Must Have Flags critical alerts if the container network policy is not applied on your pods. We recommend that you select this option for your container network polices. Optional Doesn't alert any flag if the container network policy is not applied on your pods. 7 Click Save. The new policy appears in the Policy Catalog. Assign custom policies to systems in your network When you assign custom policies to a set of systems, they are effective after the next synchronization. If you want them to be effective immediately, schedule a manual sync. Task 1 Log on to McAfee epo as an administrator. 2 Select Menu Systems System Tree, then select your group of systems from the hierarchy. You can go to the Policy Catalog page from the Register Cloud Account pane of Cloud Workload Security user interface 3 From the Assigned Policies, you can see policies assigned to these systems. Click Edit Assignment. 4 Select Break inheritance and assign the policy and settings below for Inherit from. 5 Select your custom policy from the Assigned Policy list, then specify the values for other fields. 6 Click Save. McAfee Cloud Workload Security Product Guide 13

14 2 Managing policies with McAfee epo Assign custom policies to systems in your network 14 McAfee Cloud Workload Security Product Guide

15 3 Visualization 3 of your cloud accounts Cloud Workload Security enables you to see your cloud infrastructure assets and their hierarchy. Configure and register the cloud accounts with McAfee epo using Menu Systems Cloud Workload Security. You can view your cloud account information, security issues, risks, and other threat details. Contents Viewing Cloud Workload Security console Viewing information about Threat Events Viewing information about pods View information about Security Groups Viewing information about Threat Prevention Viewing information about Application Control software Viewing information about Policy Auditor Viewing information about Change Control software Viewing information about volume encryption Assign assessment policy for your workload Automatic responses Viewing Cloud Workload Security console The new Cloud Workload Security console displays a detailed view of your cloud account and all its aspects. The Cloud Workload Security console display Workloads and Pods. The summary card displays the details of Total Workloads, Compliance Events, Threat Events, Total Pods, and Compliance Events related to Kubernetes cluster. The count of all powered-on instances are displayed in the summary card. You can view: Total Workloads Compliance Events Threat Events Total Pods Compliance Events Systems Accounts McAfee Cloud Workload Security Product Guide 15

16 3 Visualization of your cloud accounts Viewing Cloud Workload Security console Workload Details Event Details All account properties are color-coded to reflect their security status. Events and workloads are classified as critical or warning if they violate the security policies. The policy definitions in the McAfee epo Policy Catalog determine the severity of the threat. Red Critical Yellow Warning Registered accounts The Accounts panel lists the cloud vendor accounts and Kubernetes cluster registered in McAfee epo. When you select your account, you can view the list of virtual networks in your account. For a VMware vcenter account, you can view the list of data centers or clusters in the account. For Kubernetes cluster, you can view the number of pods in the cluster. Select the virtual network and you can view the workloads under that virtual network. Select a data center or cluster to view the list of hypervisors in it. Select a hypervisor to view the list of workloads in the hypervisor. If you select the VM, you can view the security status, management status, and system properties for that VM. If you have any VMs which aren't grouped under any VPC, they are placed under Ungrouped VMs for AWS instances. You can check if the VM is managed. If it isn't managed, you can install McAfee Agent. You can check if the network assessment policies are assigned to the pods. You can view issues, product, labels, name, status, and namespace associate with a pod using the filters. Network security accounts The Network Security panel lists the McAfee Network Security Manager (Manager) accounts registered in McAfee epo. You must install McAfee License extension to register the Manager account. 16 McAfee Cloud Workload Security Product Guide

17 Visualization of your cloud accounts Viewing information about Threat Events 3 Viewing information about Threat Events You can view threat details of all powered-on instances under the Threat Events pane. Several products are deployed in Cloud Workload Security to detect threat events. You can view various blocked internal connections, and the accepted suspicious and malicious external connections to and from your AWS and Azure instances. The internal and external traffic is captured as East-West and North-South traffic respectively. The traffic displayed is the data accumulated for a maximum of seven days. You must install McAfee License extension to view the traffic details of your cloud accounts. You also need this extension to view Amazon GuardDuty events. Threat Source Traffic Anomalies Detection Threat Protection Adaptive Threat Protection Network Intrusion Prevention Amazon Web Services Issues Malicious Connection Risk Port Assessment Suspicious Connection Blocked Connection Malware Detected Exploit Prevention Malicious Behavior Detected Advanced Malware Detected Network Prevention Alerts GuardDuty events Traffic discovery After you register your cloud accounts, you can discover traffic details for your instances. You must set the required permission and rules for your AWS account and Microsoft Azure account to enable network traffic flow logs at VPC levels and to discover Network Security Group traffic discovery respectively. These policies and rules allow Cloud Workload Security to discover network traffic logs. Traffic assessment McAfee Global Threat Intelligence (McAfee GTI) Detects malicious and suspicious North-South connections. Cloud Workload Security performs IP/connection reputation to determine the severity of the risk. The malicious and suspicious connections are categorized to high and medium risks, and color-coded in red and yellow respectively. Risk port assessment Identifies the ports with security risks based on the firewall policies. Your connections are classified into malicious and suspicious connections based on risk port assessment. For example, The port 3389 is identified as a risk port based on firewall (security group) policies. A North-South inbound traffic trying to approach your workload through port 3389 is assessed as a malicious connection. You can set the safe and critical ports in your firewall (security group) policy for to remediate workloads. The corrective actions such as firewall (security group) remediation or Cloud Workload Security firewall policy update removes the corresponding threat events. McAfee Cloud Workload Security Product Guide 17

18 3 Visualization of your cloud accounts Viewing information about Threat Events Network prevention alerts You can view the network prevention alerts for your instances from your registered McAfee Network Security Manager (Manager) account. When you enable traffic discovery for your Azure account, Cloud Workload Security creates storage accounts for each geographical location. You can only create 200 storage accounts for one subscription. Azure traffic sync fails if the storage account number exceeds 200 per subscription. You are charged when a storage account is created. For more information about the pricing, see Azure pricing for storage accounts. For every traffic synchronization, Cloud Workload Security discovers only 8000 records per region with a maximum of 50 traffic records for one Network Interface. Amazon GuardDuty Amazon GuardDuty is a threat detection service that continuously monitors for malicious or unauthorized behavior. You can view GuardDuty events which include network connections, port probes, and DNS requests for EC2 instances on Cloud Workload Security console. IAM related events are not captured. The GuardDuty events which are categorized as low and medium events in the AWS console, are both categorized as medium severity events in Cloud Workload Security console. Network Connection GuardDuty events are mapped in the traffic graph if the corresponding traffic is discovered. To handle the GuardDuty events from Cloud Workload Security console: Make sure your instances have Threat Prevention installed, enabled and that they have latest DAT updates. Shut down the compromised instances using event details card. Change your security groups so that they have least permissive rules. For information about how to act on GuardDuty events, see AWS documentation. You must enable GuardDuty on your Amazon Web Services management console to view GuardDuty events in the Cloud Workload Security console. GuardDuty is not supported for AWS China region. Viewing traffic flow logs Click the Graph button to view the graphical representation of traffic for your instances. You can view the East-West and North-South traffic on your workload using the filters present in the Traffic pane. The Cloud Workload Security traffic card has filters to view the flow logs based on time intervals. The traffic card has filters to display inbound traffic, outbound traffic, and blocked connections. Inbound connections are traffic flowing towards the workload whereas, outbound connections are traffic flowing from the workload. Blocked connections are blocked inbound and outbound connections. 18 McAfee Cloud Workload Security Product Guide

19 Visualization of your cloud accounts Viewing information about pods 3 Time Displays the date and time of occurrence of the selected event. Time Range(+/-) Filters the issues based on time intervals. 1 minute Filter issues occurred a minute before and after the time of occurrence of the selected event. 5 minutes Filter issues occurred 5 minutes before and after the time of occurrence of the selected event. 15 minutes Filter issues occurred 15 minutes before and after the time of occurrence of the selected event. 30 minutes Filter issues occurred 20 minutes before and after the time of occurrence of the selected event. Show Filter inbound, outbound, and blocked connections based on traffic flow. By default, the inbound and outbound connections are selected. In addition to the filters, you can view the direction of traffic flow by selecting any issue under the Traffic pane. The direction of flow is highlighted for the selected issue. You can view information about the security groups associated with your instance by selecting the Show Security Groups option from the menu in the Workload block. You can shut down your workload as a remediation measure by selecting the Shut Down Workload option from the menu in the Workload block. The Table button will take you back to the instance details. Viewing information about pods You can view if the network assessment policies are assigned to your pods. Container Firewall is deployed in Cloud Workload Security to discover issues. You can view information about the issues associated with your pods using these filters. Issue The number of issues. Product The name of the product that discovers the issues. Container Firewall detects the pods which doesn't have network assessment policies associated with them. Labels The name of the label associated with the pod. McAfee Cloud Workload Security Product Guide 19

20 3 Visualization of your cloud accounts View information about Security Groups Pod Name The name of the pod. Pod Status Displays whether the pod is turned on or not. Namespace Displays the namespace details of the pod. View information about Security Groups You can view all security groups associated with your instances. Based on the enterprise rules set, the security group status is either red or yellow. Select an instance from the Compliance Events or Threat Events pane to view more information about the security groups under Workload Details or Event Details respectively. Task 1 Log on to McAfee epo as an administrator. 2 Select Menu Systems Cloud Workload Security. 3 Select your workload from Systems. Select an instance from the instance list under Compliance Events. Select an instance from the instance list under Threat Events. 4 To view more information of your security groups. For instances under Compliance Events, select Show Security Groups from the Take Action combo box. For instances under Threat Events: Click Graph. Click the menu icon in the Workload block. Select Show Security Groups. 20 McAfee Cloud Workload Security Product Guide

21 Visualization of your cloud accounts View information about Security Groups 3 Table 3-1 Security Groups Property Security Groups ID Association Definition Displays the name of the security or network security group. Displays the ID of the security or network security group. Displays the number of instances associated with this security group or the network security group. Some VMs in Microsoft Azure accounts might not be associated with any security groups. 5 Click Edit Rules or double-click the security group to view the rules in each security group. For threat events, you can edit the security group rules by clicking the workload name under Edit Inbound Rules for under the Event Details. Table 3-2 Rules Property Security Group Associated Workloads Type Protocol Direction Port Range Priority Definition Name of the security group rule. For Azure instances, every security group rule has a name. Not applicable to AWS instances. Displays other instances that are associated with this security group (firewall). Displays the Protocol type, which you can change. Displays the protocol allowed. Displays whether the traffic is inbound or outbound. Displays the port range allowed. Displays the priority of this rule in the security group. Priority applies only to Microsoft Azure Network Security Groups. McAfee Cloud Workload Security Product Guide 21

22 3 Visualization of your cloud accounts Viewing information about Threat Prevention Table 3-2 Rules (continued) Property Access Source Definition Displays if this is allow rule or deny rule for Microsoft Azure instances. You can't edit deny rules. Deny rules aren't assessed. Displays the source IP address. You can choose Anywhere to allow connections from all traffic or Custom IP to provide an IP address that you want to allow. For AWS instances, you can also provide the security group for which you want to allow traffic. Viewing information about Threat Prevention To protect your instances from attacks, make sure that you install and configure the appropriate McAfee anti-malware software such as McAfee VirusScan Enterprise and McAfee Endpoint Security. Your instance is color-coded and classified according to the anti-malware policy that you set in the McAfee epo Policy Catalog. When checking for the presence of anti-malware software, the results depend on the cloud environment and operating system. Install McAfee Endpoint Security on your Windows instances and McAfee Endpoint Security for Linux on your Linux instances. Depending on the Threat Prevention products installed, you can view these product properties. Product McAfee Endpoint Security for Windows McAfee Endpoint Security for Linux Properties On-Access General On-Access ScriptScan Access Protection Exploit Prevention DAT On-Access General On-Access ScriptScan DAT You can: See if any properties are enabled or disabled. For details, see the product guides for the anti-malware products. Install McAfee Endpoint Security on your instances. Tag this system with the McAfee epo tags related to product deployment tasks. See the product guide for your version of McAfee epo. All Threat Prevention properties should be enabled, and DAT should not be older than 7 days. If the DAT for any workload is older than 7 days, then the Threat Prevention status is noncompliant. Viewing information about Application Control software Install McAfee Application Control to protect your system from unauthorized applications. You can see if your instance has McAfee Application Control software installed. Your instance is color-coded and classified according to the policy that you set in the McAfee epo Policy Catalog. 22 McAfee Cloud Workload Security Product Guide

23 Visualization of your cloud accounts Viewing information about Policy Auditor 3 You can see if McAfee Application Control is installed and enabled on the instance. For details, see the product guide for McAfee Application Control. Viewing information about Policy Auditor McAfee Policy Auditor software automates security audit processes and helps you report consistently and accurately against internal and external policies. With Policy Auditor, Cloud Workload Security assesses workloads based on the policies settings and provide compliance alerts. Policy Auditor has three benchmarks: Baseline configuration Patches Regular benchmark Cloud Workload Security performs a series of checks to determine the Policy Auditor compliance of the workloads. An audit is run on workloads to check the benchmarks. For a workload to be Policy Auditor compliant, it must have Policy Auditor Agent installed on it, and it must not have any benchmark failures. We recommend that you use the Policy Auditor workflow to create an audit, assign it to the VMs, and perform the audit. Auditor workflow to create an audit, assign it to the VMs, and perform the audit. A workload is tagged as compliant if it passes all benchmarks in the audit. Any workload which fails to meet the benchmark is tagged as noncompliant. Policy Auditor performs audit on standard benchmark levels only. To know more about the issue and failed rules, you must look into the Policy Auditor Agent audit results. Viewing information about Change Control software Install McAfee Change Control file integrity monitoring solution to prevent any changes made in your environment that may lead to a security breach. You can see if your instance has McAfee Change Control software installed. Your instance is color-coded and classified according to the policy that you set in the McAfee epo Policy Catalog. You can see if Change Control is installed and enabled on the instance. For details, see the product guide for McAfee Change Control. Viewing information about volume encryption You can view if your AWS volumes encrypted or not. You can view the number of root and data volumes for your instances. Though both root and data volumes are shown, only data volumes are assessed for your AWS instances. Your instances are color-coded and classified according to the policy that you set in the McAfee epo Policy Catalog for volume encryption. You can view these details for your volumes. McAfee Cloud Workload Security Product Guide 23

24 3 Visualization of your cloud accounts Assign assessment policy for your workload Property Status Type ID Definition The encryption status of the volumes. The type of the volume (root or data volume). The volume ID. Assign assessment policy for your workload Select or create an assessment policy from the Workload Details pane to assign policy to the selected workload. Task 1 Log on to McAfee epo as an administrator. 2 Select Menu Systems Cloud Workload Security. 3 Select Workload Group or Account from the Systems pane, then select any category from the Event list. 4 Select the workload for which you have to assign the assessment policy. 5 Select a policy from the Assessment Policy drop-down list. You can create your own policy or select an existing policy from the Workload Details pane. Click Policy Catalog to go to the Policy Catalog page to create or select a policy. next to 6 Click Save. Automatic responses Configure your McAfee epo server to trigger an action in response to critical or warning issues. Set automatic responses from Menu Automation Automatic Responses if you want a notification sent to you. The standard templates for Cloud Workload Security are: Noncompliant critical workloads for AWS and Azure Noncompliant warning workloads for AWS and Azure Noncompliant critical workloads for vsphere Noncompliant warning workloads for vsphere You can set up responses for other events also as needed. Set up automatic responses Configure McAfee epo server to receive automatic responses through . Before you begin Specify the SMTP server name and the SMTP server port in Server from Menu Configuration Server Settings. For details about automatic responses and specifying the server, see the product guide for your version of McAfee epo. 24 McAfee Cloud Workload Security Product Guide

25 Visualization of your cloud accounts Automatic responses 3 Task 1 Click Menu Automation Automatic Responses. 2 Select Preset as Cloud Workload Security. 3 Click New Response or click Edit next to an existing template. 4 On the Description page, type a unique name and any notes for the rule, if you are creating a template. 5 In the Event field, select: Event Group Cloud Workload Security Event Type Critical Issues or Warning Issues 6 Click Next. 7 On the Filter page, select: Account Name Filter the cloud account name. Datacenter Filter the datacenter name. This is applicable for vsphere. epo Tags Filter McAfee epo tags assigned to instances. Instance ID Filter AWS or Azure workload ID. Issue Subtype Select any option from the drop-down list. Issue Type Select any option from the drop-down list. Platform Filter the operating system running on the instance. Region Filter the region. Type the name of the region or the location of the instance. For example, if you want instances in the ap-southeast-1 location, type ap-southeast-1/asia Pacific (Singapore). UUID Filter UUID of the vsphere workload. Vendor Type Filter the cloud service provider. Type AWS, Azure, or vsphere. 8 Click Next. 9 Define when the event triggers the rule on the Aggregation page. For details, see Set thresholds for the rule in the McAfee epolicy Orchestrator Product Guide. 10 Click Next. 11 On the Actions page, compose the and select the recipients. For details, see Configure the action for Automatic Response rules in the McAfee epolicy Orchestrator Product Guide. 12 On the Summary page, verify the information, then click Save. The new response template for Cloud Workload Security appears in the Automatic Responses list. Manage responses to trigger actions for threat events You can set up an automatic response in McAfee epo that is triggered for every ENS/ENSL event. This response updates the threat count in the Cloud Workload Security console. The threat count displays the number of threat instances discovered in the last 7 days. The threat instances are categorized based on the virtual private cloud McAfee Cloud Workload Security Product Guide 25

26 3 Visualization of your cloud accounts Automatic responses on the Workload Group List. The threat instance details of the selected workload group appears in the Workload Groups Overview pane. Before you begin You installed the Cloud Workload Security extension on McAfee epo. You downloaded the Rule _ThreatEventTriggerforENS_ENSL file. Task By default, the threat event response for ENS/ENSL is configured. The administrator can configure the automatic responses, if it is configured incorrectly. 1 Select Menu Automation Automatic Responses. 2 Click Import Response. 3 Click Choose File on the Automatic Responses page. 4 Select Rule_ThreatEventTriggerforENS_ENSL and click OK. 5 Click Enable Response in the Import Response Details dialog box, then click OK. The new response template for epo Notification Events appears in the Automatic Responses list. The previous threat event response also appears in the Automatic Responses list. You must disable or delete the duplicate response. 6 To disable or delete a response: Select the response Click Actions drop-down list Select Disable Responses to disable the response Select Delete Responses to delete the response 26 McAfee Cloud Workload Security Product Guide

27 4 Remediation 4 After viewing the details of your cloud accounts, and seeing which systems are at risk, activate missing protection by installing McAfee products and correcting firewall settings. You can manage your instances by installing McAfee Agent. You can install other McAfee products after installing McAfee Agent. Contents Install McAfee Agent on your instances Installing Threat Prevention Install Application Control on your instances Install Policy Auditor on your instances Install Change Control Install Network Intrusion Prevention System on your instances Install Adaptive Threat Protection on your instances Quarantine workload Remediate firewall rules Shut down workload Tag workloads Update DAT Run on-demand scan Assign network policies for pods Quarantine pods Install McAfee Agent on your instances To manage your unmanaged instances with McAfee epo, install McAfee Agent. Task 1 Log on to McAfee epo as an administrator. 2 Select Menu Systems Cloud Workload Security. 3 Select your workload from Systems pane, then select an instance from the instance list under Compliance Events. 4 Select Install McAfee Agent from the Take Action combo box. See KB85233 for details to install McAfee Agent on your instances using deployment URL. 5 Do one of the following: Enter the logon credentials, then click Install. Run the deployment Script. McAfee Cloud Workload Security Product Guide 27

28 4 Remediation Installing Threat Prevention You can see the installation status on the Systems page. If your McAfee epo server doesn't receive installation status, it times out after 60 minutes. Installing Threat Prevention Protect your instance by installing appropriate McAfee anti-malware software based on your operating system and cloud environment. You can install Endpoint Security on your Windows instances and Endpoint Security for Linux on your Linux instances. Install McAfee Endpoint Security Protect your instance by installing Endpoint Security or Endpoint Security for Linux. Before you begin Install McAfee Agent on your unmanaged instances to manage them with McAfee epo. You cannot install Endpoint Security from Cloud Workload Security if McAfee Host Intrusion Prevention, McAfee VirusScan Enterprise, or McAfee MOVE AntiVirus is installed on your instances. If Host Intrusion Prevention and Endpoint Security are installed, Cloud Workload Security checks for the presence of Endpoint Security and its properties. Task 1 Log on to McAfee epo as an administrator. 2 Select Menu Systems Cloud Workload Security. 3 Select your workload from the Systems pane, then select an instance from the systems list under Compliance Events. 4 Select Install Threat Prevention from the Take Action combo box, then click Install. Endpoint Security is installed on Windows Workloads, and Endpoint Security for Linux is installed on Linux workloads. You can see the installation status on the Systems page. If your McAfee epo server doesn't receive installation status, it is timed out after 60 minutes. Install Application Control on your instances Protect your instance by installing McAfee Application Control. Before you begin Install McAfee Agent on your unmanaged instances to manage them with McAfee epo. Make sure you have the appropriate license before installing this product. See the product guide for Application Control before installing this product. Task 1 Log on to McAfee epo as an administrator. 2 Select Menu Systems Cloud Workload Security. 28 McAfee Cloud Workload Security Product Guide

29 Remediation Install Policy Auditor on your instances 4 3 Select your workload from the Systems pane, then select an instance from the systems list under Compliance Events. 4 Select Install Application Control from the Take Action combo box, then click Install. You can see the installation status on the Systems page. If your McAfee epo server doesn't receive installation status, it times out after 60 minutes. Application Control is activated in Observe Mode for your windows workloads. The Windows workloads aren't restarted and all features except Memory Protection are available. Memory protection is available after restarting your instance. Install Policy Auditor on your instances Policy Auditor automates security audit processes and helps you report consistently and accurately against internal and external policies. Before you begin Ensure that these conditions are met: Cloud Workload Security General assessment policy for Policy Auditor is set as Optional. You installed McAfee Agent on your unmanaged instances to manage them with McAfee epo. You have the appropriate license before installing this product. You have a compatible Policy Auditor version. Cloud Workload Security supports Policy Auditor 6.3 version. See the product guide for Policy Auditor before installing this product. Task 1 Log on to McAfee epo as an administrator. 2 Select Menu Systems Cloud Workload Security. 3 Select your workload from the Systems pane, then select an instance from the systems list under Compliance Events. 4 Click Install Policy Auditor from the Take Action combo box, then click Install. You can see the installation status on the Systems page. If your McAfee epo server doesn't receive installation status, it times out after 60 minutes. Install Change Control Protect your instance by installing McAfee Change Control. Before you begin Install McAfee Agent on your unmanaged instances to manage them with McAfee epo. Make sure that you have appropriate license before installing this product. See the product guide for McAfee Change Control before installing this product. McAfee Cloud Workload Security Product Guide 29