Security Content Update Release Notes for CCS 11.1.x and CCS 11.5.x

Transcription

1 Security Content Update Release Notes for CCS 11.1.x and CCS 11.5.x

2 SCU Release Notes for CCS 11.1.x and CCS 11.5.x Legal Notice Copyright 2018 Symantec Corporation. All rights reserved. Symantec, the Symantec Logo, and the Checkmark Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. The product described in this document is distributed under licenses restricting its use, copying, distribution, and decompilation/reverse engineering. No part of this document may be reproduced in any form by any means without prior written authorization of Symantec Corporation and its licensors, if any. THE DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE. Symantec Corporation 350 Ellis Street Mountain View, CA

3 Technical Support Symantec Technical Support maintains support centers globally. Technical Support s primary role is to respond to specific queries about product features and functionality. The Technical Support group also creates content for our online Knowledge Base. The Technical Support group works collaboratively with the other functional areas within Symantec to answer your questions in a timely fashion. For example, the Technical Support group works with Product Engineering and Symantec Security Response to provide alerting services and virus definition updates. Symantec s support offerings include the following: A range of support options that give you the flexibility to select the right amount of service for any size organization Telephone and/or Web-based support that provides rapid response and up-to-the-minute information Upgrade assurance that delivers software upgrades Global support purchased on a regional business hours or 24 hours a day, 7 days a week basis Premium service offerings that include Account Management Services For information about Symantec s support offerings, you can visit our website at the following URL: All support services will be delivered in accordance with your support agreement and the then-current enterprise technical support policy. Contacting Technical Support Customers with a current support agreement may access Technical Support information at the following URL: Before contacting Technical Support, make sure you have satisfied the system requirements that are listed in your product documentation. Also, you should be at the computer on which the problem occurred, in case it is necessary to replicate the problem. When you contact Technical Support, please have the following information available: Product release level Hardware information Available memory, disk space, and NIC information

4 Operating system Version and patch level Network topology Router, gateway, and IP address information Problem description: Error messages and log files Troubleshooting that was performed before contacting Symantec Recent software configuration changes and network changes Licensing and registration If your Symantec product requires registration or a license key, access our technical support Web page at the following URL: support.symantec.com Customer service Customer service information is available at the following URL: Customer Service is available to assist with non-technical questions, such as the following types of issues: Questions regarding product licensing or serialization Product registration updates, such as address or name changes General product information (features, language availability, local dealers) Latest information about product updates and upgrades Information about upgrade assurance and support contracts Information about the Symantec Buying Programs Advice about Symantec's technical support options Nontechnical presales questions Issues that are related to CD-ROMs, DVDs, or manuals

5 Support agreement resources If you want to contact Symantec regarding an existing support agreement, please contact the support agreement administration team for your region as follows: Asia-Pacific and Japan Europe, Middle-East, and Africa North America and Latin America

6 Contents Technical Support... 3 Chapter 1 Prerequisites for Security Content Updates... 7 Prerequisites... 7 Chapter 2 What's New... 9 New features... 9 New technical standards Deprecated technical standards New regulatory framework Modified regulatory mandate Addition in predefined platforms Modified files Chapter 3 Resolved Issues Resolved issues Chapter 4 Legal Disclaimer Legal disclaimer for General Data Protection Regulation (EU)... 19

7 Chapter 1 Prerequisites for Security Content Updates This chapter includes the following topics: Prerequisites Prerequisites The following are the prerequisites to install a Security Content Update (SCU): Symantec Control Compliance Suite 11.1 or later versions Before you install a Security Content Update (SCU), you must have Symantec Control Compliance Suite 11.1 or later versions installed on your computer. Features such as Support for Script-based custom checks and Agent-based Data collection support for File Watch entity for Windows and UNIX platforms will be available after you upgrade to CCS 11.5 (Product Update ). Data collection support for Generic Devices data collector will be available after you upgrade to CCS (Product Update ). To use CCS data collection, evaluation and reporting capabilities for command-based standards, you must upgrade to CCS (Product Update ). New signing certificate for CCS files A new signing certificate is used for all CCS files that are signed after March 3, To install SCU or later using the LiveUpdate feature, you need this certificate. The certificate is valid till March 03, Before you install the SCU, you must install the updated CCS certificate information necessary to validate the new signing certificate. There are two methods of obtaining the new certificate verifier: Quick Fix To install the SCU or later, you must apply Quick Fix

8 Prerequisites for Security Content Updates Prerequisites 8 The Quick Fix includes the Symantec.CSM.AssemblyVerifier.dll file, which contains the updated CCS certificate information necessary to validate the certificate. You can download the Quick Fix from the following location: Installing the Symantec Control Compliance Suite (Product Update ) on your application server. This Product update includes the files found in the Quick Fix and recognizes and validates Symantec binaries that are signed using the new certificate, in addition to recognizing the older binaries. Note: The Symantec.CSM.AssemblyVerifier.dll file for new signing certificate is included in the CCS_11_1_<version number>_scu_win.exe for SCU or later. So, if you install SCU or later manually, the Symantec.CSM.AssemblyVerifier.dll is installed with the SCU.

9 Chapter 2 What's New This chapter includes the following topics: New features New technical standards Deprecated technical standards New regulatory framework Modified regulatory mandate Addition in predefined platforms Modified files New features The Security Content Update (SCU) contains the following new features: Oracle credential management in agent-based data collection for UNIX assets Data collection support for the MySQL platform Data collection support for Windows domain environment with Windows Server 2016 forest functional level Oracle credential management in agent-based data collection for UNIX assets From SCU onwards, you can choose to enable the credential management of the Oracle database instances for agent-based raw data collection. By enabling this feature, you can quickly ensure that the Oracle user passwords are regenerated automatically as per your password policy. Moreover, you also improve the security practices of your organization by

10 What's New New technical standards 10 managing passwords without any human intervention. Passwords of Oracle login accounts are managed based on input parameters configured by you. For detailed information about Oracle credential management, refer to the Oracle credential management in agent-based data collection (SCU ) section in the Security Content Update Getting Started Guide (Versions: CCS 11.1.x and CCS 11.5.x). Data collection support for the MySQL platform From SCU onwards, data collection support for MySQL database that is installed on a Windows or a Linux-Intel asset is available in Control Compliance Suite. This support is available both for agent-based and agentless methods of data collection. By using this feature, you can assess the security configuration compliance posture of the MySQL database servers in your environment. Currently, the following versions of MySQL database are supported in Control Compliance Suite: Oracle MySQL Enterprise Server 5.6 Oracle MySQL Enterprise Server 5.7 For detailed information about this support, refer to the Data collection support for MySQL database installed on Windows and UNIX (Linux-Intel) platforms (SCU ) section in the Security Content Update Getting Started Guide (Versions: CCS 11.1.x and CCS 11.5.x). Data collection support for Windows domain environment with Windows Server 2016 forest functional level From SCU onwards, data collection support for Windows domain environment, which has the forest functional level set to Windows Server 2016, is available in Control Compliance Suite. This support is available both for agentless and agent-based methods of data collection. New technical standards The following technical standards are added: CIS Oracle MySQL Enterprise Edition 5.6 Benchmark v1.1.0 CIS Oracle MySQL Enterprise Edition 5.7 Benchmark v1.0.0 CIS Security Configuration Benchmark for Microsoft IIS 8.0 v1.5.0 CIS Amazon Linux Benchmark v2.0.0 CIS Oracle Linux 7 v CIS CentOS Linux 7 v2.1.1 CIS Microsoft Windows Server 2016 V 1.0

11 What's New Deprecated technical standards 11 Note: Microsoft Edge Browser and Cortana are not supported in Windows Server 2016, and hence, checks related to these Microsoft features are not included in the CIS Microsoft Windows Server 2016 V 1.0 standard. Security Essentials for Oracle MySQL Enterprise Edition 5.6 Security Essentials for Oracle MySQL Enterprise Edition 5.7 The following standards, which were released in the recent Express Security Content Updates, are now integrated with SCU : Note: All the following standards except the Security Essentials for AIX 7.2 standard are supported for command-based data collection. Security Essentials for JBoss EAP 6.3 Security Essentials for Apple OSX Security Essentials for Kubernetes 1.8 Security Essentials for Debian Linux 8.x and 9.x Security Essentials for Checkpoint firewall R80.10 Security Essentials for Fortigate firewall 5.6 Security Essentials for Apache Hadoop 2.9 Security Essentials for AIX 7.2 Deprecated technical standards What is a deprecated standard? A deprecated technical standard is a standard which customers can still use for data collection for the asset types that it covers, but for which technical support or updates are no longer available from Symantec. A technical standard is marked as 'Deprecated' in CCS Standards Manager in the following cases: A CCS standard corresponding to a CIS Benchmark is deprecated if the support for a platform is ended by the platform vendor. A lower version of a CCS standard corresponding to a CIS Benchmark is deprecated if a higher version of the CCS standard is available for the same platform. A Security Essentials standard is deprecated if it is superseded by a CIS Benchmark for the same platform.

12 What's New New regulatory framework 12 A standard is marked as 'Deprecated' in the user interface (UI) for two consecutive SCUs. After that, it is removed from the SCU installer. For uninterrupted technical support for a platform, Symantec recommends that customers switch to a CIS Benchmark CCS standard that supersedes a deprecated standard. Note: Data that is already collected by using a deprecated standard remains unaffected even after the standard is removed from the SCU installer. The following technical standards are deprecated in SCU : Table 2-1 Deprecated technical standards in SCU Platform UNIX Windows OS or Application Version CentOS 7.x Windows Server 2016 Microsoft IIS 8.0 Microsoft IIS 8.5 Deprecated Standard Security Essentials for CentOS 7.x machines Security Essentials for Windows 2016 Security Essentials for Microsoft IIS 8.0 and 8.5 Note: The CIS Microsoft Windows Server 2012 V standard, which was deprecated in SCU , is included again in Control Compliance Suite on SCU New regulatory framework SCU contains the following new regulatory framework: CIS Critical Security Controls for Effective Cyber Defense Ver 6.1 (CIS Top 20 Mandate) Modified regulatory mandate The following regulatory mandate is modified in SCU : General Data Protection Regulation (EU) What has changed? Hierarchical structure replaced with flat structure The General Data Protection Regulation (GDPR) (EU) was introduced in the Security Content Update (SCU) on Control Compliance Suite 11.1.x. The General Data Protection Regulation (EU) was introduced in a hierarchical structure comprising the following:

13 What's New Addition in predefined platforms 13 Chapter Section in the chapter GDPR article in the section In SCU , this hierarchical structure is replaced with the flat structure for ease of use. Now, the General Data Protection Regulation (EU) contains relevant articles only.you do not have to expand the chapters or sections to read the articles. Predefined report templates Two predefined report templates are added for General Data Protection Regulation (EU). General Data Protection Regulation defines the rules for processing and movement of personal data. You can generate reports and dashboards based on the assessment of the assets in your organization, to display the GDPR status of your organization. You can view the GDPR dashboards and panels after the GDPR mandate is activated. You must install SCU to install the GDPR mandate, dashboard and panels. After you install CCS , you can activate the GDPR mandate from the Controls Editor workspace. Addition in predefined platforms SCU contains the following enhancements in Windows platform: Data collection fields for IIS 7 or later The following table contains the list of fields that are added to the respective entities to enhance data collection support for Microsoft IIS target computers. All the fields are applicable to IIS 7 or later. Entity IIS Computer Field Web.config: Application Handler Access Policy Web.config: Is Non-listed ISAPI Allowed? Field description This field return the access policy of the handler for the computer. This field checks whether the non-listed ISAPI is allowed. Web.config: Is Non-listed CGI Allowed? This field checks whether the non-listed CGI is allowed. Web.config: Request Filter Attributes Web.config: Are Credentials Present in the Config? This field returns a list of attributes that are allowed or blocked. This field checks whether the credential details are present in the config file.

14 What's New Addition in predefined platforms 14 Entity IIS WebSite Field Web.config: Http Error Mode Web.config: Is Stack Trace Enabled? Web.config: Request Filter Attributes Web.config: Site Handler AccessPolicy Web.config: Are Credentials Present in the Config? Field description This field reports the Error Mode Value. This field specifies whether tracing is enabled for an application. This field returns a list of attributes that are allowed or blocked. This field returns the access policy of the handler of the website. This field checks whether the credential details are present in the config file. IIS Application Web.config: Http Error Mode This field reports the Error Mode Value of the application. IIS Virtual Directories Web.config: Stack Trace Enabled? Web.config: Request Filter Attributes Web.config: Application Handler AccessPolicy Web.config: Are Credentials Present in the Config? Web.config: Http Error Mode Web.config: Request Filter Attributes This field specifies whether tracing is enabled for an application. This field returns a list of attributes that are allowed or blocked. This field returns access policy of the handler for the application. This field checks whether the credential details are present in the config file. This field reports the Error Mode Value. This field returns a list of attributes that are allowed or blocked. Data collection fields for Windows Server 2016 The following fields are added to the Machines entity to enhance data collection support for Windows Server 2016 assets in Control Compliance Suite. Field Audit Subcategory: Audit Group Membership Audit Subcategory: Audit PNP Activity Field description This field returns the security policy setting on Audit Group Membership. This field returns the security policy setting on Audit PNP activity.

15 What's New Modified files 15 Data collection fields for OS security update or update details The following fields in the Installed Software Features entity are modified to provide specific information about whether an OS patch installed on a software is a security update or an update. Field Product Name Feature Description Field description This field returns OS Patch as the product name. This field provides information about whether an OS patch installed on a software product is a security update or an update. Modified files The following files are modified in SCU : Windows.Schema.dll Symantec.CSM.WindowsPlatformContent.ListFieldChecks.dll Unix.Schema.dll WntScopes.dll UnixScopes.dll Symantec.CSM.Content.Localization.Resources.dll Symantec.CSM.CredentialMgmt.PlatformCredentials.dll Symantec.CSM.WindowsPlatformContent.CISIISv1.0.dll Note: The version number for all the files mentioned earlier is

16 Chapter 3 Resolved Issues This chapter includes the following topics: Resolved issues Resolved issues Table 3-1 contains the details of the customer issues that are resolved in SCU Table 3-1 Resolved Issues in SCU Issue Support for the diffie-hellman-group-exchange-sha256 key exchange algorithm and the hmac-sha2-256 MAC algorithm was required. Resolution The support is now available. When an ad hoc query was run on the Effective member Analysis <FORM> field under the Group entity of the Windows platform, an Access Violation error was observed. In a few cases a bad allocation error was also observed. The error also caused the job to hang and return no results before being forcefully aborted. The code is modified to fix the domain cache locks. A list handling is added to the code to avoid a deadlock caused by a mutex. After upgrading to SCU or later, the Is the 'Network access: Shares that can be accessed anonymously' parameter set to 'None'? check in the CIS Microsoft Windows Server 2012 R2 v2.2.0 standard reflected the Unknown status. Now, the check expression is modified, and the check reflects the Pass or the Fail status correctly. The check expression for the corresponding check in the CIS Microsoft Windows Server 2012 R2 v2.2.1 standard is also modified.

17 Resolved Issues Resolved issues 17 Table 3-1 Issue Resolved Issues in SCU (continued) Resolution If you changed the value of the HTTPLogConfigFile parameter in the Log Storage and Rotation check in the Security Essentials for Apache HTTP Server 2.4 standard and then ran the CER job, the check failed. On a computer on which Apache HTTP Server was installed, if the DocumentRoot directory contained large number of files, data collection query for the Are Permissions restricted for web document root directory and files? check in the CIS Security Configuration Benchmark v3.0.0 For Apache HTTP Server 2.2 standard timed out and the check reflected the Unknown status in the evaluation details. Now, the code is modified, and the check returns the expected results after your modify the value of the HTTPLogConfigFile parameter. Now, stricter file and directory permissions are set in the check algorithm, and hence, data collection for the Are Permissions restricted for web document root directory and files? check is successful. Oracle asset could not be imported from a Solaris asset. Now, the code is modified, and you can import the Oracle assets successfully. On CCS installation in Korean language and locale, in the Current Value column of the evidence details for a check, only English characters in the script output were displayed. Data collection for the Is the 'Hardened UNC Paths' parameter set to 'Enabled, with "Require Mutual Authentication" and "Require Integrity" set for all NETLOGON and SYSVOL shares'? check in the CIS Microsoft Windows Server 2012 R2 v2.2.1 standard failed. Now, the code is modified, and the entire script output is displayed. Now, the code is modified for the Is the 'Hardened UNC Paths' parameter set to 'Enabled, with "Require Mutual Authentication" and "Require Integrity" set for all NETLOGON and SYSVOL shares'? check in the CIS Microsoft Windows Server 2012 R2 v2.2.1 standard, and the Is the 'Hardened UNC Paths' parameter set to 'Enabled, with "Require Mutual Authentication" and "Require Integrity" set for all NETLOGON and SYSVOL shares'? check in the CIS Microsoft Windows Server 2012 R2 v2.2.0 standard, and now, data collection for these checks is successful.

18 Resolved Issues Resolved issues 18 Table 3-1 Issue Resolved Issues in SCU (continued) Resolution Modifications made in a configuration file that was located at <CCS Installation Directory>\Symantec\CCS\Reporting and Analytics\DPS\control were lost when you repaired CCS components. When you installed Security Content Update (SCU) on CCS 11.1.x or CCS 11.5.x, some.dll files in the installation package were not installed. The error details were visible only in the installation logs, but no error message was displayed on the installer during the installation process. Now, the code is modified and the modifications made to a configuration file before repairing CCS components are retained after the repair process is complete. You must install a product update 11.5, or , and then install SCU for this fix to work. From SCU onwards, if a.dll file is not replaced successfully during SCU installation, the following error message is displayed: Error while copying the file <filename>. Refer to the installation logs for details. The file can be located at the temporary location: <file location>. Copy the file, and then delete it from the temporary location. Moreover, a list of undeployed.dll files is also provided in the Undeployed Files folder which is created at the following location: <CCS Installation Directory>\Symantec\CCS\Reporting and Analytics\UnDeployedFiles You must manually replace the.dll files at the respective locations. For more information about this issue and its resolution, refer to the KB article that is published at the following location:

19 Chapter 4 Legal Disclaimer This chapter includes the following topics: Legal disclaimer for General Data Protection Regulation (EU) Legal disclaimer for General Data Protection Regulation (EU) The Customer acknowledges and agrees that this Report is provided for general information and internal record keeping purposes only. Neither the underlying questionnaire nor the Report, dashboards and other outputs generated on its basis or derived thereof constitute legal advice or opinion of any kind, or any advertising or solicitation, and should not be treated as such. No lawyer-client, advisory, fiduciary or other relationship is created between Symantec and the Customer by virtue of any these materials. This Report synthesizes the responses provided by the Customer to the underlying questionnaire, which is comprised of a series of questions based on an arbitrary and discretionary subset of the general provisions and requirements of Regulation (EU) 2016/679 (General Data Protection Regulation GDPR) as published in the Official Journal of the European Union (L 119/1) on May 4th, This Report and the underlying questionnaire are in no event meant to provide a complete, accurate or adequate review of the GDPR. The Customer is solely responsible to determine the relevance and adequacy of each GDPR provision and of the related question(s) if any to the Customer s activities, operations and requirements. The sole purpose of this Report is to record the Customer s statement as to whether the Customer is able to document its self-determined answer to each question of the underlying questionnaire. Consequently the Customer acknowledges and agrees that: the questionnaire underlying the Report does not intend to comprehensively cover all requirements of the GDPR;

20 Legal Disclaimer Legal disclaimer for General Data Protection Regulation (EU) 20 the inclusion of any question in the questionnaire underlying the Report does in no way imply that the question is relevant or applicable to the Customer, as only the Customer can make such determination; the absence of any reference to a particular provision or requirement of the GDPR from the questionnaire underlying the Report does in no way imply that the particular provision or requirement is not relevant or applicable to the Customer, as only the Customer can make such determination; and - the Report, dashboards and other outputs generated on the basis of the underlying questionnaire or otherwise derived thereof only provide a record of the Customer s self-determined answers to each question and do in no way constitute any reliable indication or statement of legal conformity, compliance or adequacy under the provisions and requirements of the GDPR or of any other legislative or regulatory instrument. Symantec makes no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability or suitability with respect to the purpose, content and/or use of the Report, of the underlying questionnaire or of any other derived material. Any reliance the Customer may place on the Report and the underlying questionnaire is therefore strictly at the Customer s own discretion and risk. In no event shall Symantec be liable for any damages, losses or causes of action of any nature arising from the provision or use of the Report and of the underlying questionnaire, including dashboards and all other outputs and materials generated, and their interpretation, by the Customer.