Introduction to IBM Security Network Protection Manager

Transcription

1 Introduction to IBM Security Network Protection Manager IBM SECURITY SUPPORT OPEN MIC Slides are at: NOTICE: BY PARTICIPATING IN THIS CALL, YOU GIVE YOUR IRREVOCABLE CONSENT TO IBM TO RECORD ANY STATEMENTS THAT October 26, 2016 YOU MAY MAKE DURING THE CALL, AS WELL AS TO IBM S USE OF SUCH RECORDING IN ANY AND ALL MEDIA, INCLUDING FOR VIDEO POSTINGS ON YOUTUBE. IF YOU OBJECT, PLEASE DO NOT CONNECT TO THIS CALL.

2 Panelists Curtis Wei Presenter Development Manager Gwen Hsieh Product Manager Eric Hsu Development Lead Andy Hu QA Lead Kenji Hamahata Level 2 Support Advisory Software Engineer Prateek Jain Level 2 Support Senior Engineer Tanmay Shah Level 2 Support Senior Engineer Dan Easley Level 2 Support Knowledge Leader 2 IBM Security

3 Goal of session To provide an overview introduction of the IBM Security Network Protection Manager (NPM) and show the modern web interface, search and One-click action capabilities 3 IBM Security

4 Agenda Quick recap of XGS Release Overview of NPM 1.0 NPM 1.0 key product features Modern web interface Search and filter One-click policy action Visualize agent status Notification System settings and support NPM 1.0 installation Q & A 4 IBM Security

5 Quick Recap of XGS Release

6 Quick recap of XGS Release 40G NIM support on XGS 7100 SSL Inspection Robustness Improvement TIC certification fixes Additional XGS/GX parity Customer / support pain points Release Notes 40 GbE NIM Announcement 6 IBM Security

7 Overview of IBM Security Network Protection 1.0

8 NPM Overview IBM Network Protection Manager (NPM) is the Central Management system for the IBM Security Network Protection appliance (XGS) family of products Offering is software delivery only (no appliance) This release of NPM is an add-on of IBM Security SiteProtector to highlight new management capabilities being provided for XGS agents It s FREE 8 IBM Security

9 NPM 1.0 Architecture NPM 1.0 NPM web console Application Server (IBM liberty) Elastic Search server Site protector SP Console Application Server Update Server Database (SQL server) Agent Manager Mgt Svcs Lib XGS Agent Fusion Event Collector 9 IBM Security 9

10 NPM 1.0 Key Features

11 Web User Interface NPM provides a modernized user experience through a web based User Interface taking advantage of latest technology (e.g. HTML5). NPM officially supports Chrome version 51 or later.. 11 IBM Security

12 Search and Filter Search is the key aspect of NPM s look and feel, with the Search bar always available to discover and filter information The Search bar is supplemented with faceted filters provided in the left panel In the image below, it is evident that this system has 7 agents, 130 policies and 5882 signatures available for searching 12 IBM Security

13 Search and filter The search bar can be used to search for agents, policies, signatures or any combination of the three In this example, the xgs search string found matches in 7 agents, 68 policies and 0 signatures These results are displayed as a list of cards in the right panel of the display 13 IBM Security

14 Search and filter To select an individual card results in additional details sliding into the display Here the xgs12 agent model 5100 card has been selected 14 IBM Security

15 Search and filter Faceted filters on the left pane can filter Agents by XGS model, update status, XPU version, last reboot time, firmware version, performance and agent health Policies by repository, repository type, policy type, modified time, and support agent firmware version Signatures (Intrusion Prevention event policy) by type, protection level, priority and XPU version 15 IBM Security

16 Search and filter You can use filters and search in conjunction to find information you need more precisely 16 IBM Security

17 One-click policy action This key feature within the NPM 1.0 release is designed to allow users to readily determine the state of their protection against a threat, make the necessary changes and quickly deploy the updated IPS policies to the XGS Agents The scenario starts by searching for a particular signature (using name, CVE number, etc.) In the image below, we are searching for smurf_attack 17 IBM Security

18 One-click policy action Selecting the signature card brings in the details and exposes the ONECLICK EDIT button 18 IBM Security

19 One-click policy action The resulting IPS Object screen shows all the IPS policies where the smurf_attack signature exists. For each instance of the check, the user can see if it is enabled or disabled and block or allow. The number of impacted deployments and Agents are displayed as well. 19 IBM Security

20 One-click policy action In this case we scrolled down and found a check where it is disabled, which is against what X-Force recommends 20 IBM Security

21 One-click policy action The user can click on the icon to enable the check. Any unsaved changes exposes the save icon. When the save icon is clicked, the updated policy is deployed to the appropriate agents. 21 IBM Security

22 One-click policy action During the save action, a comment can be added to document the policy change 22 IBM Security

23 One-click policy action Here we have searched using the comment entered during the save It is evident that the policy change has been made and deployed 23 IBM Security

24 Visualize agent status The Landing Page / Dashboard Page provides an overview summary of the current status and health of all monitored Agents 24 IBM Security

25 Visualize agent status Clicking on any of the summary numbers results in the Agent view for those Agents In the image shown below, the 2 Agent with health status Alert are selected 25 IBM Security

26 Visualize agent status Selecting a specific Agent card to bring up detail information includes health and policy deployment details 26 IBM Security

27 Notifications Notifications are displayed on top-right-hand-side. Number of unread notifications are displayed in red number Faceted on left-hand-side provide filter capability 27 IBM Security

28 Notifications Notifications are acknowledged by selecting the individual card Notice that once acknowledged, the New indicator goes away 28 IBM Security

29 System Settings and Support After initial NPM set-up, the System & Settings page (accessed by clicking on the icon shown below) can be used to modify the configuration 29 IBM Security

30 System Settings and Support Firmware Settings The Firmware Settings page allows user to backup their current partition to alternate partition User can activate the alternate partition to boot and run NPM on the alternate partition The edit button allow user to edit partition comment 30 IBM Security

31 System Settings and Support Updates Settings Available updates Display available NPM firmware updates Use Upload button to upload pre-downloaded update to NPM Update servers section allow user to configure update server Clear certificate allow user to delete stored certificate Update history displays details of past updates 31 IBM Security

32 System Settings and Support Support Files Click on System Settings > Support Files to bring up the support file page. Debug logging can be turned on prior to collecting support file for collecting debug level logs. Click on New to create a support file. The support file can help IBM support team to troubleshoot NPM. 32 IBM Security

33 NPM 1.0 Installation

34 NPM 1.0 Installation Installation requirement An IBM Security SiteProtector System with all of its Database Service Pack (DBSP) component updated to the latest version. SiteProtector system requirements can be found here: ardware_and_software_requirements.htm NPM 1.0 Download URL: A valid SiteProtector license At least one IBM Security Network Protection appliance or virtual appliance with version no greater than VMWare ESXi 5.5 or later Chrome 51 or later web browser 34 IBM Security

35 NPM 1.0 Installation SiteProtector environment preparation Install SiteProtector Update IBM Security SiteProtector System with DBSP or newer Close and restart SiteProtector Console and verify SiteProtector Database shown its update status as current. 35 IBM Security

36 NPM 1.0 Installation Configuring Microsoft SQL Server (RealSecureDB) NPM need a user account to access the SiteProtector RealSecureDB. You can use the existing user account or create a new SQL user account. Adding existing user to ISNPM_Application role 36 IBM Security

37 NPM 1.0 Installation Network Protection Manager deployment Deploy the Network Protection Manager OVA file to a VMware ESX Server. Start the NPM VM and proceed through the first-time-setup using the Command Line Interface 37 IBM Security

38 Q&A

39 Where do you get more information? HEADER CONTENT 1 HEADER CONTENT 2 Questions on this or other topics can be directed to the dw Answers forum: More articles you can review: NPM 1.0 Release Notes: NPM 1.0 Installation and Configuration Guide: ftp://public.dhe.ibm.com/software/security/products/infrastructure_protection/networkprotectionmanager/docs/1.0.0/ Technote (Steps to generate or regenerate license keys from the IBM License Key Center) : NPM 1.0 Introduction Video : IBM Knowledge Center: Useful links: Get started with IBM Security Support IBM Support Portal Sign up for My Notifications Follow us: 39 IBM Security

40 More documents 40 IBM Security SP3.1.1 KC:

41 Questions for the panel Now is your opportunity to ask questions of our panelists. To ask a question now: Press *1 to ask a question over the phone or Type your question into the IBM Connections Cloud Meeting chat To ask a question after this presentation: You are encouraged to participate in the dw Answers forums in IBM developerworks on this topic (tag for SiteProtector) (tag for Network Protection) 41 IBM Security

42 THANK YOU FOLLOW US ON: securityintelligence.com xforce.ibmcloud.com Copyright IBM Corporation All rights reserved. The information contained in these materials is provided for informational purposes only, and is provided AS IS without warranty of any kind, express or implied. Any statement of direction represents IBM's current intent, is subject to change or withdrawal, and represent only goals and objectives. IBM, the IBM logo, and other IBM products and services are trademarks of the International Business Machines Corporation, in the United States, other countries or both. Other company, product, or service names may be trademarks or service marks of others. Statement of Good Security Practices: IT system security involves protecting systems and information through prevention, detection and response to improper access from within and outside your enterprise. Improper access can result in information being altered, destroyed, misappropriated or misused or can result in damage to or misuse of your systems, including for use in attacks on others. No IT system or product should be considered completely secure and no single product, service or security measure can be completely effective in preventing improper use or access. IBM systems, products and services are designed to be part of a lawful, comprehensive security approach, which will necessarily involve additional operational procedures, and may require other systems, products or services to be most effective. IBM does not warrant that any systems, products or services are immune from, or will make your enterprise immune from, the malicious or illegal conduct of any party.