IBM InfoSphere Guardium Tech Talk: Take Control of your IBM InfoSphere Guardium Appliance

Transcription

1 Daniel Perlov - WW Tech Support Lead for InfoSphere Guardium Abdiel Santos - Sr. L3 Engineer 11 April 2013 IBM InfoSphere Guardium Tech Talk: Take Control of your IBM InfoSphere Guardium Appliance Information Management

2 Logistics This tech talk is being recorded. If you object, please hang up and leave the webcast now. We ll post a copy of slides and link to recording on the Guardium community tech talk wiki page: You can listen to the tech talk using audiocast and ask questions in the chat to the Q and A group. We ll try to answer questions in the chat or address them at speaker s discretion. If we cannot answer your question, please do include your so we can get back to you. When speaker pauses for questions: We ll go through existing questions in the chat Raise your hand in the SmartCloud meeting room if you want to ask a question verbally and we ll call your name You will need *6 to unmute phone line if you are dialed in 2 April 11, 2013 IBM InfoSphere Guardium Tech Talk

3 Reminder: Guardium Tech Talks Next tech talk: Implementing InfoSphere Guardium Database Activity Monitoring for DB2 for z/os Speakers: Roy Panting and Ernie Mancill Date &Time: Thursday May 16, :30 AM Eastern Register here: Link to more information about this and upcoming tech talks can be found on the InfoSpere Guardium developerworks community: Please submit a comment on this page for ideas for tech talk topics. 3 April 11, 2013 IBM InfoSphere Guardium Tech Talk

4 Guardium Overview

5 Data Activity Monitoring You know? you can do this online now.

6 Challenges of the native security tools DB specific Intrusive Labor and time consuming No separation of duties Not real-time No preventive controls Inconsistent policies across applications, DBMS platforms, compliance initiatives Can t identify end-user for connection-pooled applications that use generic service accounts (SAP, PeopleSoft, etc.) Lack of DBMS expertise on security teams

7 IBM InfoSphere Guardium provides real-time data activity monitoring for security & compliance Data Repositories Continuous, policy-based, real-time monitoring of all data traffic activities, including actions by privileged users (databases, warehouses, file shares, Big Data) Database infrastructure scanning for missing patches, mis-configured privileges and other vulnerabilities Data protection compliance automation Host-based Probes (S-TAPs) Collector Appliance Key Characteristics Single Integrated Appliance 100% visibility including local DBA access Non-invasive/disruptive, cross-platform architecture Minimal performance impact Dynamically scalable Does not rely on resident logs that can easily be erased by attackers, rogue insiders SOD enforcement for DBA access Auto discover sensitive resources and data Detect or block unauthorized & suspicious activity Granular, real-time policies Who, what, when, how No environment changes Prepackaged vulnerability knowledge base and compliance reports for SOX, PCI, etc. Growing integration with broader security and compliance management vision

8 Guardium Overview

9 Taking Control Insure Appliance availability System Availability Activity Monitoring Data Uploads Backup & Aggregation Scheduled Tasks Audit Processes System Configuration Guardium User Activities Guardium Access Control

10 Activity Monitoring Off-shore Remote Monitor Collector Internet HR Remote Monitor Collector Local Access Monitor Remote Locations Collector Aggregator/ Central Manager Data Center Finance

11 Data Upload LDAP Off-shore Remote Monitor Collector Internet HR Remote Monitor Custom Domains Remote Locations Collector Collector Aggregator/ Central Manager Data Center Finance

12 Backups & Aggregation Off-shore Remote Monitor Aggregation Internet HR Remote Monitor Collector Ba ck up Collector Local Access Monitor Remote Locations Collector Aggregator/ Central Manager Finance

13 Taking control tasks System - Uptime & Reboots - Disk space (%full) - CPU Load - Memory Usage - Failed Logins Guardium User Activity - Login / Logout - Full Audit Trail - Data Level Security - Application Level Security - Credential Changes Internal Database - Status: up/down - Disk Space (%Full) - System Resources - Currently running queries - Response Times Web Service & Applications - Status: up/down - Scheduled Jobs Exceptions - Audit processes - Correlation alerts - Configuration changes - CAS templates - Auto Detect process - Classification process - Vulnerability Assessment Information Inflow - S-TAP - CAS - Data Upload (Domains) - LDAP Imports Inspection Core (snif) - Status: up/down/overloaded - CPU & memory usage - Identify bottlenecks - Lost requests - Policy & Configuration Changes Database Activity Patterns - Database types - Database Servers - Session/SQL Count - Activity rates - Ignored data

14 Taking Control - Policy

15 Taking Control - Policy

16 Taking Control - Self Monitoring Tools Available Tools Graphical Monitors Reports & Alerts Audit Process Self Monitoring daemon (nanny) SNMP Polling & Traps Diagnostic Tools Dashboard One-click Data Gathering Automatic Data Analysis

17 Self Monitoring Predefined Monitors backlog backlog Dropped packets logged Disk/DB utilization analyzed

18 Self Monitoring Predefined Monitors

19 Self Monitoring Reports

20 Self Monitoring Domains 38 Total Query Domains 18 Self Monitoring

21 Self Monitoring Alerts

22 Self Monitoring Audit Process

23 System utilization Buffer Usage Monitor report

24 Dashboard

25 Dashboard details

26 All system configurations controlled from Central Manager Off-shore Remote Monitor Collector Internet HR Remote Monitor Collector Local Access Monitor Remote Locations Collector Aggregator/ Central Manager Finance

27 Supportability

28 CLI Account Shell InfoSphere Guardium is a security appliance with strict access control policy No user access allowed on OS level insures audit data reliability CLI provides limited and controlled access in special cases like Initial settings Password management Troubleshooting and diagnostics more

29 Product Supportability Enhancements A set of new CLI support commands Large suite of new must gather commands which can be run from CLI. Support analyze commands S-Tap Loader Harness utility to assist in Linux S-Tap installations. SGATE firewall force watch and force un-watch mode. STAP Statistics for monitoring STAP performance from the UI of appliance. Comprehensive STAP diagnostics utilities.

30 CLI support commands support reset-password root support show db-processlist < running all locked > [ full ] support show db-top-tables < all like < string > > support show large_files < size > < age > support show netstat support show top support show db-struct-check support clean DAM_data exceptions, full_details, msgs, constructs, access, policy_violations, parser_errors, flat_log, audit_results support clean audit_task support clean log_files support check tables

31 CLI support must_gather commands Automatic diagnostic data collection by subject type Aggregation Alerts General GUI Audit Process Backup/ Restore Central Manager Missing DB User Data purge Scheduler Sniffer System/DB stats

32 Must Gather CLI Commands support must_gather app_issues

33 Must Gather CLI Commands files location

34 Must Gather CLI Commands reviewing results

35 PMR Stamping PMR Stamping functionality automatically copies and displays basic appliance information in the PMR body. PMR Stamping is done when the must_gather tgz file is uploaded to the PMR ticket.

36 CLI support analyze commands New class of the commands introduced recently to automatically check for potential issues and generate warnings to the user diagnostic to proactively prevent potential issues: support analyze sniffer support analyze tap_property

37 CLI Commands support analyze tap_property Purpose: this command analyzes value of fields and specific field combinations from SOFTWARE_TAP_PROPERTY and SOFTWARE_TAP_DB_SERVER tables in order to identify potential issues with STAP configuration.

38 CLI Commands support analyze tap_property

39 CLI Commands support analyze sniffer

40 STAP Statistics STAP statistics is a recently added feature which sends performance statistics from ktap, stap, and the host database server to the appliance where it can be reviewed in reports. To enable STAP statistics you must configure the stap_statistic parameter in the guard_tap.ini Values of stap-statistic parameter specify the polling interval for data gathering. There is a new STAP Statistics domain allow customers to create custom reports statistic data.

41 STAP Statistics

42 STAP Diagnostics Utilities Guard_diag (Unix/Linux) and diag.bat (Windows) are utilities which facilitate collection of diagnostics information for STAP issues. Both guard_diag and diag.bat can be invoked directly from the database server as scripts. Additionally guard_diag can be invoked from appliance UI.

43 STAP Diagnostics Utilities Guard_diag (cont.)

44 Resources Guardium support home page Guardium documentation

45 Reminder: Guardium Tech Talks Next tech talk: Implementing InfoSphere Guardium Database Activity Monitoring for DB2 for z/os Speakers: Roy Panting and Ernie Mancill Date &Time: Thursday May 16, :30 AM Eastern Register here: Link to more information about this and upcoming tech talks can be found on the InfoSpere Guardium developerworks community: Please submit a comment on this page for ideas for tech talk topics. 45 April 11, 2013 IBM InfoSphere Guardium Tech Talk

46 Dziękuję Polish Traditional Chinese Thai Gracias Spanish Merci French Russian Arabic Obrigado Danke Brazilian Portuguese German Tack Swedish Simplified Chinese Grazie Japanese 46 April 11, 2013 IBM InfoSphere Guardium Tech Talk Italian

47 Backup (use this section for additional slides that can t be covered in 45 minutes) Information Management