Release Notes ================ IBM Security Guardium. Guardium v10.0 p200 GPU. Guardium v release notes

Transcription

1 Release Notes ================ Product: Release: Version Completion Date: IBM Security Guardium v Guardium v10.0 p200 GPU 2016-December-15 IBM Guardium offers the most complete database protection solution for reducing risk, simplifying compliance and lowering audit cost. The IBM Security Guardium solution is offered in two versions: IBM Security Guardium Database Activity Monitoring (DAM) IBM Security Guardium File Activity Monitoring (FAM) - Use Guardium file activity monitoring to extend monitoring capabilities to file servers. The IBM Guardium products provide a simple, robust solution for preventing data leaks from databases and files, helping to ensure the integrity of information in the data center and automating compliance controls. 1

2 Contents Guardium v10.0 p200 GPU (v10.1.2) Release Notes... 3 Health Check patch... 3 Controlled Upgrade Program... 3 New for features/functions and enhancements... 5 Additional OS and Databases supported... 8 Known Issues and Limitations... 9 Bugs fixed in v (v10.0 patch 200 GPU) Additional S-TAP-related bugs fixed in v Combined Fix Packs for v10.0 since V10.1 (June 2016) Security Patches since V10.1 (June 2016) Sniffer Updates since V10.1 (June 2016) Links Link to formal Guardium V10.1 product announcement Online help available via Web V Detailed Release Notes (November 2016) V10.1 Detailed Release Notes (June 2016) Links to System requirements/ Technical requirements for v10.1/ V10.1 and Developerworks

3 Guardium v10.0 p200 GPU (v10.1.2) Release Notes General note on upgrading to v v10.0 p200 GPU can be installed on any v10.x system regardless whether it was upgraded from v9.x or built from earlier v10.x image. The only dependency is that v10.0 Health Check patch 9997 must be successfully installed before installing the Guardium v10.0 p200 GPU. See the section below on Health Check patch. v10.0 p200 GPU includes all previous v10.0 fixpacks and security updates. See the section later in this document about v10.x fixpacks, security updates and sniffer-related patches. Health Check patch v10.0 Health Check patch 9997 must be successfully installed before installing the Guardium v10.0 p200 GPU. This GPU patch will not install without FIRST installing the Health Check patch. The name of this file is SqlGuard-10.0p9997_(date).tgz.enc. Always use the latest and newest version of Health Check patch on Fixcentral. Note: v10.0 Health Check patch 9997 installed for an earlier GPU (for example, v10.0 p100) needs to be installed again for v10.0 p200 GPU (make sure to download and install the latest version of v10.0 Health Check patch 9997 prior to running GPU patch). Always use the latest and newest version of Health Check patch on Fixcentral. For further information on Health Check patch 9997, refer to ase_notes.pdf Controlled Upgrade Program To ensure overall client success, the Guardium team has put together a team of experts to implement a controlled upgrade program. For a limited time, the Guardium team will work closely with customers that wish to upgrade their Guardium v9 64-bit to v10.1. There is no direct upgrade to v from v9. The path is v9 to v10.1, then install v10.0 p200 GPU to get to v The effort will include assistance for a small scale environment or a small subset of a larger environment. 3

4 This initiative will provide IBM a better understanding of the upgrade from the customers point of view thereby enhancing the upgrade experience for all. Note: For the period of time that the controlled upgrade program is running, the upgrade package will not be available on Passport Advantage or on Fix central. For more information on this program, please contact Carrie Rogers, carriero@us.ibm.com Note: An Upgrade v9.x to v10.1 document is available from the following hyperlink: 4

5 New for features/functions and enhancements 1. Outlier detection enhancements An outlier is defined by behavior from a particular source (a database, a particular user on a database, a server, or an OS user) in a particular time period that is outside of the normal timeframe or scope of the particular source's activity. Outliers detection extends traditional database monitoring with increased intelligence that provides early detection of possible attacks during operation by analyzing changes in source behavior. This release introduces: FAM support Runs on an aggregator on data from several collectors (previously to only ran on collector locally) Outlier mining status page, providing the current status of the outlier mining process on all managed units, and drill-down into outlier processes that did not complete successfully Two tabs in the Results Table of the Investigation Dashboard: Summary tab has one row per source per hour in which an anomaly was found, with anomaly score and reasons; Details tab has one row per outlier with the anomaly score, outlier reason(s) and details (source program, object, verb, etc.) 2. Hadoop activity monitoring and Cloudera 5.7+ integration/ Ranger enhancements This release expands Guardium support for monitoring Hadoop data with Cloudera integration using Cloudera Navigator and Hortonworks integration using Apache Ranger. These integrations allow SSL encryption for clients that need to access Hadoop data and are supported by a new Hadoop Monitoring UI. 3. Classifier enhancements and new Cleversafe backup/archive option Guardium now supports running multiple classifier processes concurrently. The ability to run more than one classifier process at a time allows more efficient use of available system CPU resources. By default, Guardium classification processes now exclude several system databases and schema used by database software providers. By excluding these databases and tables, classification processes run more efficiently and may return fewer errors. 5

6 Cleversafe backup/archive supports the Amazon S3 interface using the same SDK. Guardium interface to Cleversafe is analogous to Amazon S3 (which is also supported by Guardium). Guardium cloud support now includes Cleversafe, SoftLayer and Amazon S3. 4. Enterprise health views The new Deployment Health Dashboard expands existing deployment health views by providing an at-a-glance summary of health issues from across an entire Guardium deployment. The dashboard is especially useful for identifying patterns and trends in the health data before investigating individual systems where problems are identified. 5. FAM enhancements -UID chaining and multi-action rule and outliers UID chain for Windows FAM - Currently the Windows FAM agent returns the username for the process assigned to a file event. Now the Windows FAM agent will change that single username into a chain of usernames that belong to the history of the process (UID chain). For instance is Process 1 (user janedoe) spawns Process 2 (user johndoe), then for file events related to process #2, FAM will report the UID chain consisting of {janedoe, johndoe}. Multi-Action Rule for FAM - Evaluate multiple commands using one rule and a group of commands to multiple actions. The commands in a FAM context are: Read, Write, Delete, Execute and File Operation. Outlier detection now supports FAM. 6. Entitlements optimization Entitlement Optimization mediates between the role of the DBA in providing users the entitlements required to perform their jobs efficiently, and the role of Security in keeping entitlements as accurate and as minimal as possible to prevent system vulnerabilities. Navigate to Entitlements optimization by Discover > Database Entitlements > Entitlements Optimization 7. HP Vertica support HP Vertica is a big data system that competes with Hadoop. HP-Vertica provides a standard Postgres SQL interface with its proprietary extensions. HP Vertica is used for data warehouses to provide very fast query performance. HP Vertica is used for user interaction analysis, ad tracking, click stream applications, threat assessment and financial forecasting. 6

7 8. UNIX S-TAP RPM changes Installation to /opt/guardium (location cannot be changed). RPM default configuration ktap_installed=1 Flex loading can be used by exporting NI_ALLOW_MODULE_COMBOS="Y" prior to RPM installation sqlguard_ip set to tap_ip set to hostname RPM logs saved to /opt/guardium/rpm_logs Live update is supported. KTAP request updates supported via existing processes (increments package version). Shell and GIM installers will refuse to install if RPM installation is detected. STAP will be running after installation, but needs to be configured. New script, guard-config-update, provided to make post-installation configuration easier. 9. GDPR Accelerator Data privacy and security are the most pressing concerns that any organization must face. Previously within the European Union each country required different levels of compliance, the newly announced General Data Protection Regulation (GDPR) expands and standardizes data protection rules across the whole European Union. The Guardium GDPR accelerator provides predefined reports based on GDPR groups and policies. To begin working with the GDPR accelerator, assign the GDPR role to a Guardium user, then navigate to Accelerators > GDPR with that user account. 10. Data in-sight Data in-sight introduces a revolutionary paradigm that utilizes human visual capabilities to gain an overall view on data flow and to identify unexpected behaviors. Guardium already provides robust machine learning and data-analysis features to assist audits and detect attacks, based on accumulated experience and knowledge. Data in-sight adds the flexibility of human visual perception to spot associations and movements in the raw data, irrespective of known attack types, that would otherwise be unnoticed. 7

8 For example, an object recognition project to identify potholes in city streets would not identify an elephant wandering the neighborhood. The human eye, however, would spot it immediately. Similarly, when reviewing audited data in bar charts, users looks for known issue types, but can easily overlook new (unknown) aberrations. Data in-sight converts audited data to a 3-D chronological visualization of data sources and destinations, showing data transactions unfold exactly as they occurred. The visualization space contains two planes, each represents entities of the audit domain of a given type. Every entry in the audit data is represented as a moving flash line from an object of the upper plane (one of client IP, OS user, DB user, source program) to an object of the lower plane (one of database, object, server). The flash line between the source and the destination leaves a trail (a dotted line) indicating the presence of interaction between the specific source and destination, which gradually fades into the background. The trails form an overview of the interaction between sources and destinations in the selected time period. The sources are located near their destinations, and near other similar sources. The size of the destination entity is proportional to the volume of transactions relative to the other destination entities. There are many ways of modifying the display including: color-code the top entity (color changes as data source details change), filter from the data in-sight chart, and the investigation dashboard facets. You can also view data in-sight with VR headsets. To access data in-sight: in the Investigation Dashboard, click Add Chart > data in-sight chart. 11. Quick Search renamed Investigation Dashboard Guardium s quick search capabilities have increased over the last few releases, and the name of the search results page has been changed accordingly, to Investigation Dashboard. The dashboard contains the previous quick search for enterprise functionality with additional enhancements for visualizing and analyzing data. The original quick search is now named the Results table, and appears at the bottom of the investigation dashboard. Additional OS and Databases supported Support for the S-TAP agent RedHat 7.1 on Power 8 (Big endian) architecture. MS-SQL Server 2016 RedHat 7 s390; AIX 7.2; DB2 11; MemSQL 8

9 Known Issues and Limitations Issue No. Description Guardium Component Bug # 1. STAP discovery will not discover the Oracle instance with no listener. 2. When using Linux RH7 LE machines (ppc64, little endian), a GIM installation does not work on a SSL connection with certificates (over port 8446). On this specific platform, a GIM installation is successful on a SSL connection without certificates (over port 8444). To be clear, this issue does not affect S-TAP or any other agent interacting with Tomcat. UNIX STAP SSL connection with and without certificates 3. On some UNIX/Linux systems, and specifically on AIX, even after stopping the database, the ATAP libraries may be marked by the system as in-use and activation will be prohibited after Live update because the system will prevent the user from copying the new library files. In this instance, look in the directory for the file (both specified in the error message) and delete it manually if completely certain that the database is down and that no one else has started it, or any other ATAP is using that library. An alternative involves rebooting the server to clear the in-use designation which is set by the OS kernel and is not under Guardium user control. ATAP libraries in-use with AIX Shell and GIM installers will refuse to install if RPM installation is detected. 5. If (1) you add data to a backup screen such as SCP and save it. Then (2) click on a different backup page (for example, FTP), but do not fill in the FTP page and then (3) click back to the SCP page. The data that was saved on the SCP page will not display. The user will have to refresh the screen in order to see the contents of the SCP page again. 6. Multiple threads are not allowed by Central Manager load balancer. 7. Consolidated shell installer cannot be used for AIX 7. The workaround is to use the single shell installer. Linux S-TAP/ RPM Backup and restore CM load balancer Shell installer 9

10 Issue No. Description Guardium Component Bug # 8. When a distributed report, in immediate or schedule mode, is added to My Custom Reports, those reports are only present for that session. If the user logs off and back on, the reports are gone. As a workaround, add these reports to My Dashboard and then logout/ log back in - these reports are saved. Specific distributed reports - Admin Dashboard VA stats - Distributed Admin; Dashboard TODO list stats - Distributed Distributed reports/ My Custom Reports Note: Important issues in this table will be addressed in future V10.x maintenance releases. 10

11 Bugs fixed in v (v10.0 patch 200 GPU) The list below details many of the bugs fixed in v However, if you are looking for a certain bug, that is not listed, check with your Guardium support team member. RTC # APAR Description System stops, Windows bit system with Windows STAP installed GA15931 New 10.1 X-series appliance unable to access the network grdapi create_fam_rule should not use a constant values list for serverhost GA15908 'Logout Date and Time' is always blank after a successful login GA15933 Error adding receiver for audits with correct role access Issue running built-in report "Installed Patches" as a task via audit process GA15934 Query Rewrite - MU issues when masking pattern is in single quote, double quote or no quote for DB KTAP Serial System Call resulting in high CPU Toggle automatic and manual management of hn.arc (hostnames archive) content via ADMINCONSOLE_PARAMETER switch SNMP settings missing after applying v10 p GA15974 update_stap_config is not updating some parameters for UNIX S-TAP FAM: Alert and Audit setting are lost in Japanese and Chinese settings Can't stop guard_discovery from GIM (setting STAP_USE_DISCOVERY=0) GA15846 Audit process results GUI column orders are wrong after upgrading to v10 GPU GA15823 System backup calculation is incorrect and should be revised Remote audit report on v10 does not show result data when there is only record returned IT17334 Aggregator backup keys file is not working on v10p32 and v10p GA15918 Fix an instance of audit task is taking too long to complete Running report based on computed attributes results in "Bad date format" error Need to increase amount of records to 15 days(21600) for SNIFFER_BUFFER_USAGE in all related must gather commands GA15846 Column order is incorrect in audit process results Can't populate group from pre-defined custom tables Add an option to ignore the check for aggregation health for deployments that do not have aggregators 11

12 RTC # APAR Description GIM client should write to syslog when losing/restoring connection to GIM server Auto assign Windows GIM client ip to avoid duplicate GIM client IPs when cloning database servers Auto assign GIM client IP to avoid duplicate GIM client IP when cloning database servers Add grdapi command to list user roles GIM processes should not be restarted while UNIX system is in shutdown mode Oracle Exadata servers are not directly supported by STAP shell installers Windows STAP Rebalancing: Missing DB_User in GDM_ACCESS after traffic relocated to another Managed Unit Remove Patch Backup configuration screen and CLI as function is deprecated Support FAM UID chain in UNIX S-TAP Add "KTAP_ALLOW_MODULE_COMBOS" as optional parameter for GIM consolidated installations Add CAS install option for GIM consolidated installation Add the remaining policy rule actions to the sensitive data scenario Add catalog and unstructured search to discover sensitive data scenario Allow larger root partition during install Assess the risk of converting from EXT3 to EXT Restart Sniffer after store system time Report using datasource is not working with user hierarchy Windows S-TAP enhancement: Send crash dump to appliance Allow Application User Translation connect to a server requiring an Encrypted connection bugzilla GA15910 Fix GuardApp event fields Event Type 0 and Event Value Str blank in Entity Policy Rule Violation but are with Entity SQL 12

13 Note: Installing or upgrading to Windows S-TAP: Fresh install of v10.1.2, no reboot required Upgrading from v9 to v10.1.2, no reboot required Upgrading from v10.0 and build lower than 83909, reboot is required Upgrading from v10.1.xx (revisions lower than Windows STAP v ), reboot is required 13

14 Additional S-TAP-related bugs fixed in v RTC # APAR Description Add support for scrub for Informix EXIT Enable Windows STAP to negotiate TLS 1.2 as its first priority Add grdapi function based on GUI action "Add Guardium Hosts" for S-TAP from S-TAP control screen Add STAP discovery option when using GIM consolidated installer Allow user to point STAP to more than one Guardium system from grdapi restart_stap API is not accepting hostname Implement firewall for DB2 exit Need to implement encryption through GUI for Postgres SSL Create a predefined report for STAP statistics Add a grdapi command to "Run Database Instance Discovery" Change STAP to permit TLS 1.2 (or TLS 1.0+) instead of just TLS Improve predefined scrub rules Add networks, exclude IP to EXIT protocol STAP update for shell installation should update newer set of Linux modules if installer subversion number is higher STAP monitor not working in GIM environment if GIM not installed in "/usr/local/guardium" directory Regression : datestamps in the monitor don't always show up Add a parameter to globally disable FAM Support Greenplum SSL GA15922 (Bug 55093) - KTAP stopped inside SEOS affecting Solaris 14

15 Combined Fix Packs for v10.0 since V10.1 (June 2016) Guardium v10.0 patch 120 Combined Fix Pack for v10.0 GPU 100 (August ) SqlGuard-10.0p120_CFP_Aug_24_2016.tgz.enc.sig _notes_august_2016.pdf = = = = = = = = = = = = Guardium v10.0 patch 125 Update Bundle for v10.0 CFP 120 (Sep ) SqlGuard-10.0p125_Bundle_Sep_15_2016.tgz.enc.sig release_notes_sept_2016.pdf = = = = = = = = = = = = Security Patches since V10.1 (June 2016) Patch 10.0p6021 Bugs fixed - PSIRT CVE RTC Description Shell injection in CLI command CVE Shell injection in CLI command CVE Shell injection in CLI command CVE Shell injection in CLI command CVE Shell injection in CLI command CVE

16 Sniffer Updates since V10.1 (June 2016) v10.0p4020 Sniffer Update Notes: Installation of patch 4020 needs to be performed/scheduled during the "quiet" time on the Guardium appliance to avoid conflicts with other long-running processes (such as heavy reports, audit processes, backups, imports and so on). Installation of this patch 4020 will automatically restart the sniffer process. If the downloaded package is in.zip format, customers are required to unzip it outside Guardium appliance before uploading/ installing it. Dependent on v10.0p01 (v10.0 patch 01) or higher When this patch is installed on a collector appliance, make sure that the patch is also installed on the corresponding aggregator appliance. Do this to avoid aggregator merge issues. This sniffer patch should be installed across all the appliances: Central Manager, aggregators and collectors. This sniffer patch introduces two new session ignore statuses. o 6 - Yes Stap Revocable- Session was/is ignored based on policy 'Ignore Stap session Revocable' o 7 - No Revoked- Session was ignored but not any more Session Ignore was revoked) Note: Customers installing this sniffer patch before version v and having a policy with Ignore (Revocable) rule, might see in the reports some of the session's statuses with no values. Installing next GPU (v10.1.2) will resolve this discrepancy. Customers can also request AdHoc patch to solve this issue locally in v10.1 versions. Existing reports displaying session status field require to re-save these queries after installing GPU /ADHOC patch to embed new value fix into the query. 16

17 v10.0 Sniffer Update patch 4020 The bugs that were fixed in this patch: Sniffer update Guardium Bugzilla # Guardium RTC # APAR Description Patch on FixCentral: MA/06ea0/2/Guardium_v10_0_p4015_sn iffer_update_release_notes.pdf GA10827 Application Username missing for some traffic GA15861 Fix parser error of a Netezza Select GA15869 Fix segfaults in sniffer for p GA15886 Fix sniffer stopping in V10.1, due to tuple rule GA15886 See p 4016, RTC # All SAP HANA traffic is not logged GA15892 MSSQL sp_executesql not parsed in some cases GA15903 Only the first one of three SQLS executed in a JDBC batch are captured Teradata - some SQL errors are being logged as both Login_Failed and sql_error GA15895 Use "database"; has double quotes in GDM_SESSION.DB_NAME GA15938 Data redacted that did not meet criteria GA15937 Guardium SYSLOG messages not sent to QRadar consistently 17

18 Sniffer update Guardium Bugzilla # Guardium RTC # APAR Description GA GA15939 Some specific Aster DB SQL is missing in logs "Query Rewrite" functionality failure for JDBC Toad 32 bit client 18

19 Links Link to formal Guardium V10.1 product announcement 01.ibm.com/common/ssi/ShowDoc.wss?docURL=/common/ssi/rep_ca/9/760/ENUSJP /index.html&lang=en&request_locale=en Online help available via Web The online help is included in the Guardium v10.1 Knowledge Center on the Web at: Search all the product information together at that site. The Knowledge center is updated more frequently than the embedded online help and is the most up-to-date source of information. V Detailed Release Notes (November 2016) V10.1 Detailed Release Notes (June 2016) Links to System requirements/ Technical requirements for v10.1/ For a list of V10.1 databases and operating systems, go to: V10.1 System Requirements (Platforms Supported) (November 2016) 64-bit V10.1 Software Appliance Technical Requirements (November 2016) 64-bit 19

20 V10.1 and V S-TAP filenames and MD5Sums (November 2016) V10.1 and Developerworks For more information, see the Guardium V10.1 articles on IBM Developerworks: nityuuid=432a9382-b250-4e55-98d7-8e9ee6cbf90e What's new in IBM Security Guardium V10.1 (Developerworks) Analyze, adapt, and protect Configure Guardium Activity Monitoring for Cloudera Hadoop using Navigator Integration December-15 IBM Guardium Version 10.1.x Licensed Materials - Property of IBM. Copyright IBM Corp U.S. Government Users Restricted Rights - Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp. IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at Copyright and trademark information ( 20