It is possible to use OpenDLP in an agentless mode, but the agent shifts the processing to the host instead of the server.

Size: px

Start display at page:

Download "It is possible to use OpenDLP in an agentless mode, but the agent shifts the processing to the host instead of the server."

Cuthbert Thompson
6 years ago
Views:

1 Data Loss Prevention using OpenDLP OpenDLP describes itself as a Data Loss Prevention suite with centralized web frontend to manage Windows agent filesystem scanners, agentless database scanners, and agentless Windows/UNIX filesystem scanners that identify sensitive data at rest. OpenDLP can scan systems for sensitive data such as credit card and social security numbers. Using regular expressions, any other text item can be searched for as well, such addresses or a person s name. There are two components to OpenDLP: A web application to manage the Windows agents and scan results A Windows agent used to perform the scans It is possible to use OpenDLP in an agentless mode, but the agent shifts the processing to the host instead of the server. Installation OpenDLP can be installed either by compiling the source code or run from a virtual machine provided by the developer. This guide will use the VirtualBox virtual machine as that is the quickest way to start utilizing the tool. VirtualBox installation Navigate to the VirtualBox web site to download the virtualization platform: If the host computer is 64-bit compatible, select the AMD64 download option. For further information on installing VirtualBox, refer to the latest version of the User Manual: UserManual.html

2 OpenDLP VirtualBox VM download The VM download is split into multiple files using the 7z compression format. Ensure that 7-Zip ( or a compatible decompression tool is installed. Download the OpenDLP VM files at: Once all of them are downloaded and all in the same directory, open the file ending with.7z.001 with 7-Zip. It will extract all of the necessary files into an OpenDLP VM folder (the version number may change). Within VirtualBox, select File > Import Appliance.

4 Select Choose... and browse to the OpenDLP OVA file.

6 Review the Appliance Import Settings. The defaults should be accepted.

7 Click Import. Importing of the appliance will take a few minutes. After the import, select Start within the VirtualBox Manager. Configuring OpenDLP for connectivity Log in to the console with the default username and passworip add: Username: opendlp Password: opendlp

8 The appliance s MAC address will need to be registered within NM. To determine the MAC address run the command ip addr. Look for the eth0 adaptor. The MAC address is twelve characters on the link/ether line beginning with 08:00:27 [the vendor OUI for VirtualBox].

10 Register this MAC in NM and ensure that an IP address was obtained by running the ip addr command again. A reboot may be necessary. NOTE: it may be necessary to remove the networking devices from the Linux kernel on the VM.

11 cd /etc/udev/rules.d sudo rm 70-persistent-cd.rules sudo rm 70-persistent-net.rules sudo reboot now Install sc.exe Obtain the file sc.exe from a 32-bit Windows 2000/XP machine and place it in /var/www/opendlp/bin/. A Windows client such as WinSCP may be used or a command line SCP from a Linux/OS X host using the syntax: scp sc.exe opendlp@ip:/var/www/opendlp/bin/ Import Firefox Certificate Launch Firefox and import the client.p12 certificate into the browser: 1. Go to File > Preferences (on Windows machines, Tools > Options) 2. Click the Advanced tab 3. Click the Encryption sub-tab 4. Click the View Certificates button 5. Within the Certificate Manager, click on the Your Certificates sub-tab 6. Click the Import... button and browse to the client.p12 file that was provided with the VM in the 7zip archive. Note that there is no password to import.

12 Using OpenDLP Launch Firefox and browse to: The default credentials are: Username: dlpuser

13 Password: OpenDLP The main interface looks like the following:

15 WARNING: OpenDLP is a public, open source product. The default authentication credentials are available for anyone to see. Once profiles are created and scans take place, business sensitive and compliant data may be accessed through the OpenDLP web interface via links to the original files. Take appropriate means to restrict access and change passwords. See the README-VM.txt file that came with the virtual machine for more information. Workflow OpenDLP is a flexible tool that can be used in different, creative ways, but the basic workflow is as follows: Review the provided Regular Expressions for data to look for Create a profile with authentication credentials and policy settings Start a scan by providing a list of IPs Review the scan results and mark false positives Report any suspect business sensitive or compliant data found Work with the information owners and Office of Information Security to develop a remediation plan Profiles Profiles are used to define the scan types to be done as well as to provide and store the credentials necessary to perform the scan: Windows Filesystem (agent) Windows Filesystem (agentless over SMB) Windows Network Share (agentless over SMB) UNIX Filesystem (agentless over SSH) Microsoft SQL Server (agentless) MySQL (agentless) To scan a Windows file system with an agent a local or domain administrator account is necessary. See the screenshots below for an example.

17 A domain administrator samuel.gaudet in the infosec domain will be performing this scan. On a Windows workstation, domain information can be found in The Control Panel System information.

19 In the above screenshot, the sws domain would be used.

21 The scan is looking for AMEX, Discover, Mastercard, Social Security Numbers with dashes, Social Security Numbers with spaces and Visa credit card numbers.

23 The default user account used to send results from the agent to the server is: Username: ddt Password: OpenDLPagent There will be five concurrent deployments, meaning that only five hosts will be scanned at one time. Scans To begin a scan, select Scans then Start New Scan from the side menu. Enter a list of IPs to scan in the Systems to scan dialog.

25 Press Start to initiate the scan of the hosts in scope.

27 It may take a few minutes for the agents to be pushed to and installed on the systems to scan. Do not close the window until they are deployed. When the screen shows (0 systems remain in queue) it means all agents have been deployed. Review Scans On the OpenDLP side menu, select Scans > View Scans/Results.

29 Select one of the scans and press the View Scan Details button. A list of the individual hosts in the scan will appear. Select one and then View Results.

31 Depending on the size of the system scanned, it may take a few minutes to load the results. Details of the scan are shown in the View Results page.

33 All of the files scanned that contain a regular expressions match for the profile used to do the scan are on the View Results page.

35 False Positives can be marked with the checkbox next to the item and the Mark Selected as False Positives button at the bottom of the page. Further information OpenDLP developer Andrew Gavin has a presentation demoing Windows agent scanning available at: watch?v=kz3m--lhybg OpenDLP FAQ:

Safari O Reilly CLASS PREPARATION

Safari O Reilly CLASS PREPARATION CLASS PREPARATION Building Distributed Pipelines for Data Science Using Kafka, Spark, and Cassandra Table of contents Environment 1 Prerequisites 1 Import the Virtual Machine 3 If you are stuck in Virtual