Security Content Update Release Notes. Versions: CCS 11.1.x and CCS 11.5.x

Transcription

1 Security Content Update Release Notes Versions: CCS 11.1.x and CCS 11.5.x

2 SCU Release Notes for CCS 11.1.x and CCS 11.5.x Legal Notice Copyright 2017 Symantec Corporation. All rights reserved. Symantec, the Symantec Logo, and the Checkmark Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. The product described in this document is distributed under licenses restricting its use, copying, distribution, and decompilation/reverse engineering. No part of this document may be reproduced in any form by any means without prior written authorization of Symantec Corporation and its licensors, if any. THE DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE. Symantec Corporation 350 Ellis Street Mountain View, CA

3 Technical Support Contacting Technical Support Symantec Technical Support maintains support centers globally. Technical Support s primary role is to respond to specific queries about product features and functionality. The Technical Support group also creates content for our online Knowledge Base. The Technical Support group works collaboratively with the other functional areas within Symantec to answer your questions in a timely fashion. For example, the Technical Support group works with Product Engineering and Symantec Security Response to provide alerting services and virus definition updates. Symantec s support offerings include the following: A range of support options that give you the flexibility to select the right amount of service for any size organization Telephone and/or Web-based support that provides rapid response and up-to-the-minute information Upgrade assurance that delivers software upgrades Global support purchased on a regional business hours or 24 hours a day, 7 days a week basis Premium service offerings that include Account Management Services For information about Symantec s support offerings, you can visit our website at the following URL: All support services will be delivered in accordance with your support agreement and the then-current enterprise technical support policy. Customers with a current support agreement may access Technical Support information at the following URL: Before contacting Technical Support, make sure you have satisfied the system requirements that are listed in your product documentation. Also, you should be at the computer on which the problem occurred, in case it is necessary to replicate the problem. When you contact Technical Support, please have the following information available: Product release level Hardware information

4 Available memory, disk space, and NIC information Operating system Version and patch level Network topology Licensing and registration Customer service Router, gateway, and IP address information Problem description: Error messages and log files Troubleshooting that was performed before contacting Symantec Recent software configuration changes and network changes If your Symantec product requires registration or a license key, access our technical support Web page at the following URL: support.symantec.com Customer service information is available at the following URL: Customer Service is available to assist with non-technical questions, such as the following types of issues: Questions regarding product licensing or serialization Product registration updates, such as address or name changes General product information (features, language availability, local dealers) Latest information about product updates and upgrades Information about upgrade assurance and support contracts Information about the Symantec Buying Programs Advice about Symantec's technical support options Nontechnical presales questions Issues that are related to CD-ROMs, DVDs, or manuals

5 Support agreement resources If you want to contact Symantec regarding an existing support agreement, please contact the support agreement administration team for your region as follows: Asia-Pacific and Japan Europe, Middle-East, and Africa North America and Latin America

6 Contents Technical Support... 3 Chapter 1 Prerequisites for Security Content Updates... 7 Prerequisites... 7 Chapter 2 What's New... 9 New features... 9 New technical standards Mandate-based technical standards Deprecated technical standards New regulatory and compliance standards Addition in predefined platforms Modified files Known issues Chapter 3 Resolved Issues Resolved issues Chapter 4 Legal Disclaimer Legal disclaimer for General Data Protection Regulation (EU)... 20

7 Chapter 1 Prerequisites for Security Content Updates This chapter includes the following topics: Prerequisites Prerequisites The following are the prerequisites to install a Security Content Update (SCU): Symantec Control Compliance Suite 11.1 or later versions Before you install a Security Content Update (SCU), you must have Symantec Control Compliance Suite 11.1 or later versions installed on your computer. To use CCS data collection, evaluation and reporting capabilities for command-based standards, you must upgrade to CCS (Product Update ). New signing certificate for CCS files A new signing certificate is used for all CCS files that are signed after March 3, To install SCU or later using the LiveUpdate feature, you need this certificate. The certificate is valid till March 03, Before you install the SCU, you must install the updated CCS certificate information necessary to validate the new signing certificate. There are two methods of obtaining the new certificate verifier: Quick Fix To install the SCU or later, you must apply Quick Fix The Quick Fix includes the Symantec.CSM.AssemblyVerifier.dll file, which contains the updated CCS certificate information necessary to validate the certificate. You can download the Quick Fix from the following location:

8 Prerequisites for Security Content Updates Prerequisites 8 Installing the Symantec Control Compliance Suite (Product Update ) on your application server. This Product update includes the files found in the Quick Fix and recognizes and validates Symantec binaries that are signed using the new certificate, in addition to recognizing the older binaries. Note: The Symantec.CSM.AssemblyVerifier.dll file for new signing certificate is included in the CCS_11_1_<version number>_scu_win.exe for SCU or later. So, if you install SCU or later manually, the Symantec.CSM.AssemblyVerifier.dll is installed with the SCU.

9 Chapter 2 What's New This chapter includes the following topics: New features New technical standards Deprecated technical standards New regulatory and compliance standards Addition in predefined platforms Modified files Known issues New features The Security Content Update (SCU) contains the following new features: Data collection support for MS SQL 2016 platform Data collection support for Ubuntu Server v Enhancement in automated MS SQL password management CCS agent support on Ubuntu 12.04, 14.04, and servers Blacklisting Windows data collection entities for agent-based data collection Data collection support for Oracle Database 12c CDB-PDB assets Data collection support for MS SQL 2016 platform From SCU onwards, data collection support for Microsoft SQL Server 2016 for multiple and single instances of both agentless and agent-based modes of data collection is available.

10 What's New New features 10 Data collection support for Ubuntu Server v Data collection support for the computers that run on Ubuntu Server is available from SCU onwards. The Security Essentials for Ubuntu 16.x LTS Server standard is provided in the Predefined folder in the tree pane of the CCS Standards view. By running this standard, you can assess the compliance posture for the Ubuntu Server assets in your environment. This support is available for both agentless and agent-based modes of data collection. Enhancement in automated MS SQL password management The SQL Credential Management feature automates the process of managing passwords of the MS SQL Server users that are configured on SQL Server agent for data collection. An enhancement is made to this feature by adding two switches to CCSSQLSETUP.exe tool for enabling the password management setting for MS SQL Server and cluster on the agent machine. The following switches are added to the CCSSQLSetup.exe tool: -EP: This switch enables the SQL user password management setting by updating the value of the setting MANAGESQLUSERPASSWORD to 1 in the ccssqlenv.dat file. -EC: This switch enables the SQL cluster user password management setting by updating the value of the setting MANAGESQLUSERPASSCLUSTER to 1 in the ccssqlenv.dat file. CCS agent support on Ubuntu 12.04, 14.04, and servers CCS agent for data collection on Ubuntu 12.04, 14.04, and servers with Intel (32 bit and 64 bit) and x64 (64 bit) is available. For more information, refer to the following URL: Security Updates Symantec Control Compliance Suite Blacklisting Windows data collection entities for agent-based data collection From SCU onwards, you can blacklist a Windows data collection entity that you want to exclude from data collection. This feature is applicable only to the agent-based mode of data collection for Windows entities. Using this feature, the local administrator of the agent machine can control the data collection for specific entities at agent level. This restricts the data collectors from collecting sensitive data from the blacklisted entities. For example, you can restrict the data collection of a Text file content data source.

11 What's New New technical standards 11 To use this feature, you must create a configuration file named Black_Listed_Datasource.conf at the following location on an agent machine: \ESM\config\Black_Listed_Datasource.conf In this configuration file, list the entities that you want to blacklist. Each entity name must be mentioned on a separate line. All the text lines that start with the # symbol are considered as comments. You can comment out the entities that you want to exclude from the list of blacklisted entities. If you run a data collection job for these blacklisted entities, a warning message is displayed as follows on the console: 'The Data Source <DS Name> is blacklisted. Hence not collecting Data for the same.' Agent upgrade and agent content update jobs do not affect the configuration file created for blacklisting the entities. Data collection support for Oracle Database 12c CDB-PDB assets CCS supports the new Oracle Database 12c multi tenant architecture. This architecture holds a Container Database (CDB) that contains a number of virtual or Pluggable Databases (PDBs). Data for both CDBs and PDBs can now be collected in CCS. You can import your CDB Oracle assets into the CCS asset system by running the Asset Import job, and then perform data collection and evaluation on these assets. You cannot import PDB Oracle assets by running the Asset Import job. You have to add the PDB assets manually by using the CSV or the ODBC asset import functionality. Note: While importing the PDB Oracle assets, asset attributes such as Database Name Type, Database Version, Operating System, and OS Type must be updated for successful data collection. The Database Name Type asset property must be updated to Service Name, and not as a System ID (SID). New technical standards The major highlight of the SCU release is the addition of seven new technical standards with CIS Benchmark. The following new technical standards have been added:

12 What's New New technical standards 12 CIS Security Configuration Benchmark for Microsoft SQL Server 2014, v1.2.0 CIS Security Configuration Benchmark for Microsoft SQL Server 2012, v1.3.0 CIS Benchmark for Solaris 11.1, v1.0.0 CIS Benchmark for Solaris 11.2, v1.1.0 CIS Microsoft Windows Server 2012 R2, v2.2.1 Security Essentials for Microsoft SQL Server 2016 Security Essentials for Ubuntu LTS Server The following standards are added for Apache Tomcat: CIS Apache Tomcat 7 Benchmark, v1.1.0 CIS Apache Tomcat 8 Benchmark, v1.0.1 Security Essentials for Apache Tomcat 9 Prerequisite: To run data collection for these standards, xmllint (component of a libxml package) must be available on the target computer. Note: A warning message informing that the character limit for checks is 512 by default may be displayed, when checks for Apache standards are loaded. You can avoid getting this message by customizing the CustomCommandTextLengthLimit field in the AppserverService.exe.config configuration file. For more information, refer to the Permissible command length for the Commands entity for UNIX section in the Security Content Update Getting Started Guide. Mandate-based technical standards The following new standards based on the PCI-DSS 3.2 mandate are added: PCI DSS v3.2 for Red Hat Enterprise Linux 5.x Machines PCI DSS v3.2 for Red Hat Enterprise Linux 6.x Machines PCI DSS v3.2 for Red Hat Enterprise Linux 7.x Machines PCI DSS v3.2 for Microsoft Windows Server 2012 and 2012 R2 Machines PCI DSS v3.2 for Microsoft Windows Server 2008 and 2008 R2 Machines

13 What's New Deprecated technical standards 13 Deprecated technical standards What is a deprecated standard? A deprecated technical standard is a standard which customers can still use for data collection for the asset types that it covers, but for which technical support or updates are no longer available from Symantec. A technical standard is marked as 'Deprecated' in CCS Standards Manager in the following cases: A CCS standard corresponding to a CIS Benchmark is deprecated if the support for a platform is ended by the platform vendor. A lower version of a CCS standard corresponding to a CIS Benchmark is deprecated if a higher version of the CCS standard is available for the same platform. A Security Essentials standard is deprecated if it is superseded by a CIS Benchmark for the same platform. A standard is marked as 'Deprecated' in the user interface (UI) for two consecutive SCUs. After that, it is removed from the SCU installer. For uninterrupted technical support for a platform, Symantec recommends that customers switch to a CIS Benchmark CCS standard that supersedes a deprecated standard. Note: Data that is already collected by using a deprecated standard remains unaffected even after the standard is removed from the SCU installer. The following technical standards are deprecated in SCU : Table 2-1 Deprecated technical standards in SCU Platform SQL OS or Application Version Microsoft SQL Server 2008 Microsoft SQL Server 2012 Microsoft SQL Server 2014 SQL Server 2000 Instances Deprecated Standard Security Essentials for Microsoft SQL Server 2008 Security Essentials for Microsoft SQL Server 2012 Security Essentials for Microsoft SQL Server 2014 The Australian Government Information and Communications Technology Security Manual for MS-SQL Server

14 What's New New regulatory and compliance standards 14 Table 2-1 Deprecated technical standards in SCU (continued) Platform Windows OS or Application Version Microsoft Windows Server 2012 Windows 2000 Machines Windows 2003 Machines Deprecated Standard CIS Microsoft Windows Server 2012 R2 v2.2.0 The Australian Government Information and Communications Technology Security Manual for Windows New regulatory and compliance standards SCU contains the following new regulatory compliance standards: General Data Protection Regulation (EU) The General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) is a regulation by which the European Parliament, the Council of the European Union and the European Commission intend to strengthen and unify data protection for all individuals within the European Union (EU). It also addresses the export of personal data outside the EU. The primary objectives of the GDPR are to give control back to citizens and residents over their personal data and to simplify the regulatory environment for international business by unifying the regulation within the EU. Financial Services Transaction Network - Cybersecurity Best Practices It is a set of baseline security controls recommended for financial services organizations. These controls are implemented by FSO to secure the complete financial transaction chain. Controls are intended to help customers safeguard their local technology environments and reinforce the security of the wider financial community. National Institute of Standards and Technology (NIST) Revision 1 The National Institute of Standards and Technology (NIST), a measurement standards laboratory, and a non-regulatory agency of the United States Department of Commerce has released the NIST SP US Federal agencies require NIST compliance for protecting the confidentiality of Controlled Unclassified Information (CUI).The NIST requirements apply to all components of non-federal information systems and organizations that process, store, or transmit CUI, or provide security protection for such components.

15 What's New Addition in predefined platforms 15 Addition in predefined platforms SCU contains the following enhancements in the predefined platforms: Table 2-2 Platform MS SQL Enhancements in predefined platforms Enhancement The following new fields are added to the SQL platform for data collection: SQL Server Agent Service Account SQL Server Full-Text Daemon Service Account Maximum Number of Error Log Files Is DataBase Type contained? Encryption Algorithm Used Key Size for Asymmetric Key Algorithm Used Is SQL Authentication Used in Contained Databases UNIX The following are added to the UNIX platform: Solaris 11.1 Machines Solaris 11.2 Machines New target type: UNIX computers with Tomcat Running New asset group: All UNIX servers with Tomcat Running Asset-type Properties: The following new fields are added to UNIX assets: Is Tomcat Running?: This Asset property must be enabled before running Apache Tomcat standards on UNIX assets. OS Kernel Version: The value for this field is required to set when importing agentless as well as agent-based assets. Windows Data collection support for the Windows platform is extended by making the following fields available for the Shares entity: Underlying Directory Permissions<FORM> Permissions (Advanced)<FORM> The following two fields are made available for the WQL entity: Result<List>: This field returns list of results of a WMI query which has single field in query. Result as Record: This field returns results of a WMI query which is in the form of multiple records.

16 What's New Modified files 16 Modified files The following files are modified in SCU : Unix.Schema.dll Dbif.Schema.dll Symantec.CSM.UnixPlatformContent.Solaris10v4.0.dll Symantec.CSM.SqlPlatformContent.CISSQL2008R2.dll Symantec.CSM.Content.Localization.Resources.dll Windows.Schema.dll Symantec.CSM.UnixPlatformContent.Apache.dll Note: The version number for all the files mentioned earlier is Known issues Table 2-3 contains the details of known issues observed in SCU : Table 2-3 Known issues Issue During the import of Solaris agent-based assets, the asset-type property OS Kernel Version does not get updated for the imported assets. During the import of Linux agent-based assets, the asset-type property Is Tomcat Running? does not get updated for the imported assets. Solution After you have imported the assets for the Solaris agent, run the asset import job for these assets again for both agentless and agent-based targets. This updates the OS Kernel Version asset-type property for these assets. After you have imported the assets for the Linux agent, run the asset import job for these assets again for both agentless and agent-based targets. This updates the Is Tomcat Running? asset-type property for these assets.

17 Chapter 3 Resolved Issues This chapter includes the following topics: Resolved issues Resolved issues Table 3-1 contains the details of the customer issues that are resolved in SCU Table 3-1 Resolved Issues in SCU Issue Resolution The temp and domain cache files on CCS 11.5 DPS were not being cleaned up. Some activities like OS file system journaling or indexing, or anti-virus live scanning coincided with the file creation timeline and open handles at the same time. Windows API could not delete the files and directories, if there were open handles on it. When running a data collection query on a number of agents, several of them did not return any data for the machine data source. This issue occurred on agent-based targets. This was because the patch files located at the following path were of 0 byte size: C:\Program Files (x86)\symantec\ccs\ Reporting and Analytics\ESM\bin\ dcmodules\control\windows\patchassessment. If the files remain in the cache after deleting them, delete them again after a time lapse of 300 milliseconds. One more time before creating a new delta, it will iterate through control/windows/tempfiles and delete it including its stale contents. The Patch Assessment pre-check is restricted only for patch related data collection. Now, there is no patch related attribute selected in the query. Data is collected for all queries without any error or crash.

18 Resolved Issues Resolved issues 18 Table 3-1 Issue Resolved Issues in SCU (continued) Resolution In the CIS Oracle Database 11g R2 Benchmark v2.2.0 standard, the check Is EXECUTE Revoked from PUBLIC on DBMS_BACKUP_RESOTRE? targeted the table named DBMS_BACKUP_RESTORE. According to the new version of the standard, the check should target the table named DBMS_RANDOM. A command-based standard for the Generic Devices platform caused a query timeout error because of a multi-line prompt string on a target device. This happened when the target device was connected using either the SSH or the Telnet protocol. The parameter name DBMS_RANDOM in the check is replaced by the parameter name - DBMS_BACKUP_RESTORE. The parameter in the XML is changed to DBMS_RANDOM. The static content is modified to include DBMS_RANDOM in place of DBMS_BACKUP_RESTORE. The code for the Generic Devices is modified to handle the multiline prompt string of the target device. After importing an apache asset, the Is Apache InstalledAsset-type Property of apache assets was set to false, if package name does not start with httpd. CCS ISS API failed to return the asset score for VMware ESXi Machines or VMware vcenter Server asset types. The code is modified to remove the httpd entry from rpm_qa.txt. Now, after importing apache asset, the Is Apache Installed property of apache asset is set to true. Added the following two new attributes to vcenter Server and the ESXi machines schema: When modifying any of the values under the Parameters tab for the following checks in the Security Essentials for Apache HTTP Server 2.4 standard, the values for the ParamValue0 and ParamRegex0 parameters were not found. Check Configure the Error Log Check Configure the Access Log The CIS Oracle Database 11g R2 Benchmark v2.0.0 displayed check number as 3.1 instead of 3.10 for the following check: No Users Are Assigned the 'DEFAULT' Profile? EvaluatedComplianceScores MaxRiskScores The parameters' names are changed in the Standard Xml and Complex Algorithm. The following parameters are added in the standard XML file: <arg name="paramvalue0" value="" /> <arg name="paramregex0" value="" /> This works even if a null value or some text value is added Changed the check number from 3.1 to 3.10 for the check No Users Are Assigned the 'DEFAULT' Profile? as per the CIS check number.

19 Resolved Issues Resolved issues 19 Table 3-1 Issue Resolved Issues in SCU (continued) Resolution The field System Settings: Optional subsystem in the Machines data source returned an empty value which could not be evaluated using the current operators. An issue was faced while using the right operator and value to validate the empty value. The check Log Storage and Rotation in the Security Essentials for Apache HTTP Server 2.4 standard invoked the "du -xk" commands on NFS- mounted shares, which can take many hours to complete or eventually time out. When the check was removed, the data collection succeeded. CCS evaluation reported on the disabled SQL logins making the following two checks to fail Is Password Expiration Enforced for SQL Logins? 5.03 Is Password Complexity Enforced for SQL Logins? The Windows platform schema binary is updated to recognize the special value {No Value}. An exclusive query flag is set to True for the check. A filter has been added to the standard XML file which filters out the disabled SQL logins. Now, CCS evaluation works only for the enabled users. When a WMI query was run, it displayed the following error message: 'Please select ResultAsRecord field in query. -The parameter is incorrect.' The following two fields are made available for the WQL entity to get results from a WMI query: Result<List>: This field returns list of results of the WMI query which has single field in query Result as Record: This field returns results of the WMI query which are in the form of multiple records. The user must select the Result as Record field to run the query.

20 Chapter 4 Legal Disclaimer This chapter includes the following topics: Legal disclaimer for General Data Protection Regulation (EU) Legal disclaimer for General Data Protection Regulation (EU) The Customer acknowledges and agrees that this Report is provided for general information and internal record keeping purposes only. Neither the underlying questionnaire nor the Report, dashboards and other outputs generated on its basis or derived thereof constitute legal advice or opinion of any kind, or any advertising or solicitation, and should not be treated as such. No lawyer-client, advisory, fiduciary or other relationship is created between Symantec and the Customer by virtue of any these materials. This Report synthesizes the responses provided by the Customer to the underlying questionnaire, which is comprised of a series of questions based on an arbitrary and discretionary subset of the general provisions and requirements of Regulation (EU) 2016/679 (General Data Protection Regulation GDPR) as published in the Official Journal of the European Union (L 119/1) on May 4th, This Report and the underlying questionnaire are in no event meant to provide a complete, accurate or adequate review of the GDPR. The Customer is solely responsible to determine the relevance and adequacy of each GDPR provision and of the related question(s) if any to the Customer s activities, operations and requirements. The sole purpose of this Report is to record the Customer s statement as to whether the Customer is able to document its self-determined answer to each question of the underlying questionnaire. Consequently the Customer acknowledges and agrees that: the questionnaire underlying the Report does not intend to comprehensively cover all requirements of the GDPR;

21 Legal Disclaimer Legal disclaimer for General Data Protection Regulation (EU) 21 the inclusion of any question in the questionnaire underlying the Report does in no way imply that the question is relevant or applicable to the Customer, as only the Customer can make such determination; the absence of any reference to a particular provision or requirement of the GDPR from the questionnaire underlying the Report does in no way imply that the particular provision or requirement is not relevant or applicable to the Customer, as only the Customer can make such determination; and - the Report, dashboards and other outputs generated on the basis of the underlying questionnaire or otherwise derived thereof only provide a record of the Customer s self-determined answers to each question and do in no way constitute any reliable indication or statement of legal conformity, compliance or adequacy under the provisions and requirements of the GDPR or of any other legislative or regulatory instrument. Symantec makes no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability or suitability with respect to the purpose, content and/or use of the Report, of the underlying questionnaire or of any other derived material. Any reliance the Customer may place on the Report and the underlying questionnaire is therefore strictly at the Customer s own discretion and risk. In no event shall Symantec be liable for any damages, losses or causes of action of any nature arising from the provision or use of the Report and of the underlying questionnaire, including dashboards and all other outputs and materials generated, and their interpretation, by the Customer.