CIS-CAT Pro Dashboard Documentation

Transcription

1 CIS-CAT Pro Dashboard Documentation Release Center for Internet Security February 03, 2017

2

3 Contents 1 CIS-CAT Pro Dashboard User s Guide Introduction Deployment User Administration CIS-CAT Pro Dashboard Deployment Guide Introduction CIS-CAT Pro Assessor Deployment Guide Introduction Indices and tables 7 i

4 ii

5 CHAPTER 1 CIS-CAT Pro Dashboard User s Guide 1.1 Introduction CIS-CAT Pro Dashboard is a new companion application for CIS-CAT. The application features a database back end for storing individual assessment results from target systems, which allows for reports and dashboard features beyond the capabilities of the previous CIS-CAT versions. Dashboards now have drill down functionality. Users can navigate from a high level graphical overview of environmental compliance with CIS Benchmarks to the individual assessment results that produce that compliance score. When viewing these individual assessment results, users can now create exceptions for certain rules along with a reason for the exception. This will remove the rule from compliance scoring as long as the exception is active, but provide supporting evidence for auditor as to why the rule was excepted. The application also offers a Remediation Report, for an operator only concerned with failure results of a given assessment and a Complete Results Report, to provide auditors with the complete assessment results of a given endpoint, or group of end points. Users can also view CIS-CAT assessment results through the lens of the CIS Critical Controls with the new Controls View of assessment Results. CIS-CAT Pro Dashboard provides users with the capability to Tag target systems (endpoints) in order to group them together for aggregation onto these new dashboards and reports. This guide is intended to assist CIS Members with deployment, configuration, and use of the Pro Dashboard application and all of these new features. 1.2 Deployment CIS-CAT Pro Dashboard is a companion application to CIS-CAT. CIS-CAT collects and evaluates system characteristics as described by the CIS Benchmark content. CIS-CAT traditionally provided assessment results in various report formats, including HTML, XML, CSV, and plain text. CIS-CAT can now upload its assessment results to the webbased Pro Dashboard application using a REST API. CIS-CAT Pro Dashboard will import these XML document-based results into its application database. This section describes how to configure the web application in your environment, as well as how to configure CIS-CAT to send assessment results to the Pro Dashboard application CIS-CAT Pro Dashboard Deployment See here: CIS-CAT Pro Dashboard Deployment CIS-CAT Pro Assessor Deployment See here: CIS-CAT Pro Assessor Deployment Guide 1

6 CIS-CAT Pro Dashboard Documentation, Release User Administration CIS-CAT Pro Dashboard leverages spring security to manage authentication and access rights for application users. Within the application an administrator can create new users, create new user roles, assign multiple user roles to each user, and assign access rights to various functionality to those roles. This section describes how to administer CIS-CAT Pro Dashboard users and security. 2 Chapter 1. CIS-CAT Pro Dashboard User s Guide

7 CHAPTER 2 CIS-CAT Pro Dashboard Deployment Guide 2.1 Introduction CIS-CAT Pro Dashboard is a web application built using the Grails Framework. The grails framework uses a hibernate data model to remain DBMS agnostic. Grails code compiles into java byte code and therefore runs on the JVM. As such, CIS-CAT Pro dashboard can be deployed in any RDBMS which supports JDBC, and on any web container that can handle java WAR s. The documentation below describes how to deploy CIS-CAT Pro Dashboard on the following stack, which is officially supported by CIS: MySQL 5.6 running on Ubuntu 16.04, a separate Ubuntu server for Tomcat 8 and Apache 2. Prerequisite to using this documentation is having two separate Ubuntu instances running in your environment. Reiteration: Although this document is written assuming a MySQL database, Ubuntu servers, Tomcat and Apache HTTP Server, they are not required. The Hibernate data model ensures a database-agnostic environment, so any relational database management system can be used (MySQL, Oracle, MS SQLServer, etc.). Further, any operating system can host the application server, which can also utilize any software capable of hosting a java web application archive (.war file) Database Install MySQL Server 5.6 onto the database Ubuntu server using these instructions.once the MySQL database has been installed, note the following information: hostname/ip of database server port for connecting, by default this is 3306 username/password for connecting to the database Application Server On a separate server from the database server, install Ubuntu (or any operating system supported in the member s environment). It is important that the database server be separated from the application server for security reasons. The application server needs to be accessible over the network so that users can access the application, but if the application database were on the same server, it could also be exposed. By having a separate server, the database can be configured to only communicate over the network via the MySQL port, and therefore be more secure. Secondly, this configuration is more scalable. Members can add application servers to the environment as load increases and have the applications communicate with the same database server. Once Ubuntu is installed, and a user can log in, run: sudo apt-get update, this will download the latest package lists from the known repositories so we can install some more software. 3

8 CIS-CAT Pro Dashboard Documentation, Release MySQL Client A MySQL client should be installed in order to test connectivity with the database and create the schema for CIS- CAT Pro Dashboard. run: sudo apt-get install mysql-client, this will give you access to the mysql command From the MySQL database instructions above, note the hostname/ip of the database server as, and the configured and run: mysql -h -u -p, you will then be prompted for the. if you see a mysql> prompt, then you have successfully connected to the database. run: create schema ; This will create a DB schema for CIS-CAT Dashboard Pro data Java 8 Because CIS-CAT Pro Dashboard is a java-based application, members will need to ensure that java is installed. # Install a JDK/JRE sudo apt-get install default-jdk # Ensure Java is installed at the proper version level (or higher) java -version Ensure that the Java version is displayed as 1.8.0_111 (or higher) Application Server Install Apache Tomcat 8 by following this article, through the end of Step 6. Open /opt/tomcat/bin/catalina.sh and add the following lines to the top of the file, which will add some environment variables that CIS-CAT Pro Dashboard requires to run. export CCPD_CONFIG_FILE="/opt/tomcat/ccpd-config.yml" export CCPD_LOG_DIR="/opt/tomcat/logs" Note: The values of these environment variables can be configured to any location the administrator wishes, and must be to file system locations to which the Tomcat application server can access on startup. Security Considerations As a final step we want to remove the default applications available from the Tomcat install, including the examples and management applications. These default sites can and will give away information about the environment and present an information security risk. # Navigate to the Tomcat applications directory cd /opt/tomcat/webapps # Remove the default applications sudo rm -R * This will remove all the default applications from the tomcat installation to help reduce the attack surface of the application server. 4 Chapter 2. CIS-CAT Pro Dashboard Deployment Guide

9 CHAPTER 3 CIS-CAT Pro Assessor Deployment Guide For use with CIS-CAT Pro Dashboard 3.1 Introduction Text 5

10 CIS-CAT Pro Dashboard Documentation, Release Chapter 3. CIS-CAT Pro Assessor Deployment Guide

11 CHAPTER 4 Indices and tables genindex modindex search 7