Trust Protection Platform 15.4

Transcription

1 Trust Protection Platform 15.4 Customer Webinar December 17, 2015

2 Trust Protection Platform 15.4 Improvements and bug fixes including: TrustAuthority TrustForce SSL/TLS License Report TA/TF per product license usage Agent Visibility and Stability which agents are running into problems and didn t check in Security Enhancements require stronger passwords to download private keys Driver Updates RedHat CA Driver Updates F5, Blue Coat, Connect::Direct, CAPI Enterprise Mobility SSH Automatic issuance of certificates for users on nonwindows platforms (via End User Portal) Notification Improvements Support for Device Certificates (Windows) Automated Certificate Request & Installation Automatic Renewal Public Key Permissions Certificate Search APIs Trust Protection Platform PROPRIETARY & CONFIDENTIAL

3 SSH Updates Andrey Razumovsky

4 Public Key Permissions New SSH Policy Setting: Public Key Permissions For newly added authorized keys and known hosts Agent and agentless UNIX only Userowned: file owner = key owner, mode 600 (default in 15.3) Rootowned: file owner = root, mode 644

5 Agent Folder Creation Agent automatically creates one folder for SSH provisioning Permissions same as parent folder Agentless already creates folders since 15.2 home user home user.ssh id_rsa

6 SSH Macros New macros for use in authentication Works for all keybased events Key discovered Key added/removed/changed Key provisioned/failed to provision Violation detected etc $SMTP.Key[$Event.Value1$, <field>"]$ Algorithm AllowRestrictions Command DenyRestrictions ExpirationDate FilePath Format Hostnames LastUsed Options TrustID Type

7 SSH Notification and Templates Notification and templates added Component changed to Device where applicable (can notify device owner now)

8 New Keyset Details View More readable attributes Separate tabs for keys More readable account/location info Pagination

9 Reports Updates Andrey Razumovsky

10 Entitlement Report Updates Username (short) and columns added Master Admin / WebSDK users now listed Entitlement sections merged into one PDF version removed

11 Enterprise Mobility Updates Hari Nair / Aaron Hixson

12 New in 15.4 TrustAuthority: End User Portal now uses agent groups and work objects Configuration in Aperture TrustForce: Support for device certificates Agent runs as system account Support for Windows 10 Windows 8.x à Compatible

13 EUP Updates New Agent Type (TA)

14 EUP Updates User certificate work (TA)

15 Device certificate work (TF)

16 Aperture Framework Enhancements

17 Object Selection: Searches Full Path Searching for objects search the entire path of the DN Previous versions only search the name of the object

18 IE8 Final Death in 16.1 Originally deprecated in 14.1 TPP 16.1 will update core Aperture Libraries for performance and stability that breaks any and all functionality with IE8

19 Firefox and Internet Explorer Updates When 16.1 ships, both Internet Explorer 10 and Firefox ESR 24 will no longer receive security updates TPP 16.1 will update supported version of IE to version 11 and Firefox to ESR 38 Support Level TPP 15.4 TPP 16.1 Microsoft Internet Supported Explorer Mozilla FireFox Supported ESR 24 ESR 38 Google Chrome (no change) Compatible (latest version) (latest version)

20 Agent Server Agent and Client Subsystem

21 Agent Authentication: Client ID All Agents now authenticate to TPP leveraging a server generated unique ID called the Client ID In the screenshot to the left the Client ID is 2543

22 Client ID in Agent list Client ID shows up in the list, Agent Details, and can be filtered. Note: we now also show a total of agents on the agent list now

23 New Not Seen In filter New filter makes it easy to find agents that haven t checked in recently. Choose the amount of days that agents have not checked in

24 Device Placement Aperture shows the device(s) that the agent is linked to via Device Placement

25 Effective Work calculation Aperture calculates and displays the effective work that an agent will be sent

26 Other changes Any user can delete an agent registration if given the Delete permission to a group or Agent Registration Logging on TPP has been enhanced with many new events related to registration and requesting new sessions. Events contain IP Address, Hostname, and Client ID Agent has more usable logging during registration and new sessions. HTTP Error codes along with server return messages are shown. Other enhancements to make agent troubleshooting easier

27 Server Certificate Enhancements Ryan Treat

28 Security: Private Key Download Require stronger password whenever a private key is downloaded Applies to Aperture, WebAdmin, and WebSDK Same complexity rules that apply to the passwords of Local identities: At least 8 characters At least one uppercase letter At least one nonalpha character Enabled by default; can be disabled by policy PROPRIETARY & CONFIDENTIAL

29 Security: Private Key Download PROPRIETARY & CONFIDENTIAL

30 Security: Integrity of Approvals Do not permit certificate settings to be changed while it is in the process of being enrolled Applies to Aperture and WebAdmin Editable settings compromised the integrity of workflow approvals Certificates must be in a steady state (no processing stage) to be edited; requires a Reset if the certificate encountered an error PROPRIETARY & CONFIDENTIAL

31 Security: Integrity of Approvals controls are disabled PROPRIETARY & CONFIDENTIAL

32 Security: Private Key Reuse Reject user provided CSRs that reuse known private keys Applies to Aperture, WebAdmin, and WebSDK Distinct from private key reuse behavior with service generated CSRs Comparison uses the Public Key Hash (thumbprint) of certificates in Secret Store Enabled by default; can be disabled by policy PROPRIETARY & CONFIDENTIAL

33 Security: Private Key Reuse Note: the Aperture error presentation will be improved in 16.1 PROPRIETARY & CONFIDENTIAL

34 Driver Enhancements Ryan Treat

35 TrustAuthority Drivers Updated Enrollment Driver Red Hat Upgraded driver support from Red Hat Certificate System (RHCS) version 7.1 to 8.1 Still uses screenscraping for all interactions with the certificate authority PROPRIETARY & CONFIDENTIAL

36 TrustForce Drivers Updated Provisioning Drivers CAPI F5 Added Binding Server Name field that enables provisioning to web sites using SNI on IIS 8.0+ Significant improvements to address reliability, scale and concurrency issues revealed by Onboard Discovery in customer environments PROPRIETARY & CONFIDENTIAL

37 TrustForce Drivers (cont d) Updated Provisioning Drivers Blue Coat SSL Visibility Appliance Updated driver to use current API and add support for version with backward compatibility Connect:Direct Updated driver to use current API and introduce preliminary support for C:D on Windows 4.7 and on Linux 4.2 with backward compatibility PROPRIETARY & CONFIDENTIAL

38 EndofLife Drivers Pending Deprecation (won t be included in 16.1) GeoTrust Enterprise CA will stop issuing certificates at the end of 2015 GeoTrust TrueFlex is Symantec s replacement Cisco CSS Legacy driver with no known usage by customers PROPRIETARY & CONFIDENTIAL

39 Certificate Search APIs Paul Turner

40 New Certificates APIs Retrieve details of a specific certificate GET certificates/guid Search for certificates GET certificates/?parameters Retrieve a count of certificates HEAD certificates/?parameters

41 GET /certificates/guid GET TPP GUID to Certificate Object HTTP/ OK { "Approver":[ "local:{16e4ce96-8fee-4e18-a75e-ff58a93476b4}" ], "CertificateDetails":{ "AIAKeyIdentifier":"72B57467FFFC87808F88EFAE98C3970F0B121B2D", "C":"US", "CN":" "Issuer":"CN=Big Cattle Certs, OU=TLS, O=Big Ranch CA, L=Tulsa, S=Oklahoma, C=US", "KeyAlgorithm":"RSA", "KeySize":2048, "L":"Tulsa", Certificate details continue

42 Details Returned from Certificates/guid Attributes of Current Certificate AIAKeyIdentifier C, L, S, O, OU(s), CN Issuer, KeyAlgorithm KeySize PublicKeyHash RevocationDate RevocationStatus SKIKeyIdentifier Serial SignatureAlgorithm SignatureAlgorithmOID StoreAdded Subject ValidFrom ValidTo Certificate Object Attributes Approver Consumer Contact CreatedOn, DN, Guid ManagementType Name ParentDn ProcessingDetails InError Stage Status TicketDN RenewalDetails Subject SchemaClass ValidationDetails LastValidation ValidationResult

43 GET /certificates/?parameters GET ValidToGreater= T00:00: Z&ParentDnRecursive=%5CVED%5CPolicy%5CCerts& KeySizeLess=1025&limit=1&offset=1 HTTP/ OK X-Record-Count: 393 { "Certificates":[ { "CreatedOn":" T00:51: Z", "DN":"\\VED\\Policy\\Certs\\eng.venafi.com", "Guid":"{db32dd87-1a8e-49bf-9058-bc71f5de2ad4}", "Name":"eng.venafi.com", "ParentDn":"\\VED\\Policy\\Certs", "SchemaClass":"X509 Device Certificate", "_links":[{ "Details":"\/vedsdk\/certificates\/%7b265be681-c22b-4dc f0b5f269e%7d"}] }, List of matching certificates continues

44 Available Search Criteria Certificate Attributes C CN Issuer KeyAlgorithm KeySize KeySizeGreater KeySizeLess L O S Serial SignatureAlgorithm ValidFrom ValidTo ValidToGreater ValidToLess Certificate Object Metadata CreatedOn CreatedOnGreater CreatedOnLess Disabled InError LastValidationResult ManagementType Name NetworkValidationDisabled ParentDn ParentDnRecursive PendingWorkflow Stage StageGreater StageLess ValidationDisabled

45 HAL Links Returned from certificates/?parameters Details links: "_links":[ { "Details":"\/vedsdk\/certificates\/%7bafde4eac-6c15-42ee-92e4-68ffd20d63a2%7d" } ] Paging links: "_links":[ { ] } "Next":"\/vedsdk\/certificates?SignatureAlgorithm=md5RSA%2csha1RSA&KeySizeLess=1025& ValidToGreater= T00%3a00%3a Z& parentdnrecursive=%5cved%5cpolicy%5ccerts&offset=2&limit=1", "Previous":"\/vedsdk\/certificates?SignatureAlgorithm=md5RSA%2csha1RSA& KeySizeLess=1025&ValidToGreater= T00%3a00%3a Z& parentdnrecursive=%5cved%5cpolicy%5ccerts&offset=0&limit=1"

46 HEAD /certificates/?parameters HEAD HTTP/ OK X-Record-Count: 245 Total number of matching certificates

47 from the Venafi Team!