IBM MDE Multi-Cloud Data Encryption Administrator Guide
Реклама
Реклама
IBM Multi-Cloud Data Encryption (MDE)
Powered by SPx™
Administrator Guide
Version 1 Release 0
IBM Security
Note:
Before using this information and the product it supports, read the “Notices” topic at the end of this information.
First edition (February 2017)
This edition applies to Version 1 Release 0 of IBM Multi-Cloud Data Encryption (product number 5737-C67) and to all subsequent releases and modifications until otherwise indicated in new editions.
© Copyright Security First Corp. 2017
© Copyright IBM Corporation 2017
US Government Users Restricted Rights – Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.
IBM Multi-Cloud Data Encryption Administrator Guide 2
Table of Contents
Background and Intention of the Administrator Guide .......................................... 7
MDE Graphical User Interface (GUI) ......................................................... 20
IBM Multi-Cloud Data Encryption Administrator Guide 3
MDE Administrative User Management ..................................................... 26
10 Policy Enforcement Key Management ...................................................... 37
IBM Multi-Cloud Data Encryption Administrator Guide 4
12 Agent Provisioning and Management ....................................................... 47
Uninstalling a File Agent from an Application Server .......................................... 66
Appendix I: Sample Database Security Configuration ......................................... 70
Appendix III: Sample Agent Installation Processes ............................................. 80
IBM Multi-Cloud Data Encryption Administrator Guide 5
Appendix IV: Sample Conversion of Client Private Key and Client Certificate into a
IBM Multi-Cloud Data Encryption Administrator Guide 6
1 Introduction
Authorized Use Permission
Usage of this software is limited to its owner via the terms of the licensing agreement.
Point of Contact
For additional information about IBM Multi-Cloud Data Encryption (MDE), please visit website at https://www.ibm.com/support/entry/portal/support
Background and Intention of the Administrator Guide
The Administrator Guide is the primary reference for installation, administration, and use of MDE for the purpose of encryption agent provisioning and management, policy definition (access and cryptographic control), policy enforcement key management, and securing data at rest on selected servers that are using deployed agents. This document is intended for a System Administrator with administrative access and knowledge of their corporate network to install and administer the MDE product.
IBM Multi-Cloud Data Encryption Administrator Guide 7
2 General Overview
System Overview
The IBM Multi-Cloud Data Encryption (MDE) is a comprehensive data security product powered by SPx™ technology that combines data-at-rest encryption (via
Agents) with the additional powerful protection features of a Policy Provisioning
Manager (PPM) that acts as a central management console. MDE enables the provisioning of agents, data access policy settings (operational and cryptographic access definition), and management (key lifecycle, agent updates and user access logging) of up to 25,000 agents from a single centralized location. MDE provides a seamless and secure system with the flexibility to assign agents that encrypt data at file system level or volume level using a unique cryptographic splitting technology that provides data-centric protection that goes beyond standard encryption making data encryption much more robust and impenetrable from a brute force attack. It takes it a step further by adding another layer of protection with the ability to restrict, monitor, and audit data access at the user level by defining fine-grained access policies.
Figure 1: Integrated Security with Strong Separation of Duties
This product provides a separation of duties with separate Administrator Roles:
Product Administrator and Security Administrator. The Product Administrator role is entrusted with the permissions required to configure and maintain the MDE product.
The Security Administrator role is entrusted with the permissions required to provision and manage the agents. Figure 1 depicts these roles, which are further discussed in
Section 7: MDE Administrative User Management.
MDE supports the installation of three agent types that provide the cryptographic data protection used to enforce the policy definitions.
IBM Multi-Cloud Data Encryption Administrator Guide 8
Agent Types
Volume Agent
The Volume Agent provide volume-level encryption with limited access policy controls (permit all). Volume-level encryption provides protection in the form of a protected, predefined storage repository via block driver implementation in the OS.
An entire volume is defined and cryptographically protected as a unit. As data and files are stored and/or edited, added or deleted, the cryptographic algorithms are used to ensure all data within the volume is secure.
Each volume (or partition in a volume) is individually protected with a separate and unique key.
File with Policy Agent
The File with Policy Agent combines file level encryption with data access policy. File-level encryption provides individual file protection at the file level of the Operating
System. There is no limitation on the size of the file or size of the storage environment with file protection. The location for the protected data is secured with the workgroup key for that data path definition, and all of the individual files stored within and beneath it are individually protected with separate and unique keys.
The unique file level keys are handled by an internal key management system. Policy-based access control is layered on top of the encryption, allowing for the definition of least-privileged access control, specification of access logging and limiting of access rights to specific system functions such as Read/Read-Write/Copy/Delete.
These policy controls work together with standard LDAP or Active Directory permissions. If a user does not have permissions to the data in LDAP or Active
Directory, the Security Administrator cannot overwrite those access controls and authorize data access.
By default, all users are excluded from accessing the data covered by a policy. The
Security Administrator needs to define who has access. This allows the Security
IBM Multi-Cloud Data Encryption Administrator Guide 9
Administrators to restrict system administrators, cloud vendor administrators and root users from accessing unencrypted data.
Volume with Policy Agent
A Volume with Policy Agent leverages the volume-level encryption of a volume agent and file-based operational access control policies that can be applied and enforced for one or more protected file paths.
IBM Multi-Cloud Data Encryption Administrator Guide 10
3 Planning Considerations
Prerequisites
Installation of IBM Multi-Cloud Data Encryption (MDE) is a straight forward process which includes the installation of a base Open Virtual Appliance (OVA) and running a
PPM installer.
In preparation, it is a good idea to review the installation instructions in their entirety prior to installing the software. Below is a list of prerequisites that will enable successful installation and operation of IBM Multi-Cloud Data Encryption.
1. Operational server with licensed operating system and supported hypervisor
(VMware ESXi™) to deploy and run PPM.
2. Packaged Base OVA
3. PPM Installer
4. One or more targeted servers with a supported agent operating system (Red
Hat
®
/ CentOS 6.2+ or 7.2+ and Microsoft Server
®
2008 R2 or later.
5. Network Access between PPM and all agents.
Critical Note
Although not strictly required, it is strongly advised that PPM, external databases, and agents leverage NTP to coordinate system time. This will ensure event / audit log timestamps are sequenced properly.
Minimum System Requirements
PPM VM Minimum System Requirements
• CPU 4
• 8 GB RAM
• 40 GB of available storage
• Network Access Required
Agent Minimum System Requirements
• One Core 64-Bit CPU @2GHz with AES-NI enabled o
(recommended 2 Core 64-Bit CPU @2GHz with AES-NI enabled) o
2 GB RAM (recommended 4 GB RAM)
• 20GB of available hard disk space o
300 MB or more is recommended for log file space
IBM Multi-Cloud Data Encryption Administrator Guide 11
• Network Access Required
• Internet access or access to local repository during initial agent installation
• SSL Certificate Required
Note
Requires an SSL (self-signed or Certificate Authority) certificate / key pair file prior to creating agents. The certificate is utilized to establish a secure
TLS connection between the agent and the MDE Server.
Network Setup
MDE requires a consistent network connection between MDE server(s) and agents.
Using static IP assignments or DHCP with static leases would satisfy this need.
Additionally, a properly working DNS infrastructure and the leveraging of hostnames across the ecosystem would work.
Network Ports
Function
Web
Database
External LDAP
LDAP directories
Email event forwarding
Syslog event forwarding
Default Port
443
5432
None
None
None
None
Configurable
Yes
Yes
Yes
Yes
Yes
Yes
OVA Configuration
The provided MDE OVA is pre-configured with MaxAuthTries set to 1. To successfully authenticate over SSH to the MDE VM, MaxAuthTries will need to be changed (not recommended) or SSH clients will need to set PubkeyAuthentication to "no" either on the command line or in the local SSH client configuration.
IBM Multi-Cloud Data Encryption Administrator Guide 12
REST Interface
MDE supports a full programmatic REST interface. The root REST URL is: https://<Virtual Machine IP>/rest/
Critical Note
The REST API will allow an administrator to perform advanced functions not accessible via the web interface. The REST API can be potentially used in a way that may get an agent into an unsupported state; therefore, a level of REST API knowledge is essential.
Reference the IBM Multi-Cloud Data Encryption (MDE) REST API Specification.
IBM Multi-Cloud Data Encryption Administrator Guide 13
4 Product Installation
Preparing for Installation
There are three steps for MDE’s installation process:
1. Prerequisites
2. MDE Base OVA available
3. Supported Hypervisor
Licensing
MDE does not require a unique product license to run or to configure agents beyond that provided in the software license agreement.
Installing MDE
To install MDE software:
Using example, file ibm_sw_mde_1.2.0-XX.bin, substitute the build number for XX
1. Deploy the base OVA into your hypervisor
2. Login as admin and set a new password and note IP address ($ ip addr)
3. Upload ibm_sw_mde_1.2.0-XX.bin to the MDE base. (example: scp)
4. Make the bin file executable ($ chmod +x ibm_sw_mde_1.2.0-XX.bin)
5. Execute the bin file ($ ./ibm_sw_mde_1.2.0-XX.bin)
6. Select English and hit Enter
7. Read the license pages, tab to <OK>, hit ‘Enter’ to advance.
8. Select <Yes> and hit Enter to accept the license agreement.
9. Once extraction is complete, hit Enter on <OK> to return to the command line.
Note the rpm install location.
10. Navigate to the rpms install directory.
11. Install the RPMs as root ($ sudo yum -y install *.rpm)
IBM Multi-Cloud Data Encryption Administrator Guide 14
Yum Response
Complete!
Nothing to do
No package
<packagename> available
Error: Nothing to do
You need to be root to run this command
Error: Package
<packagename>
Requires:
<otherpackagename>
Meaning
Package installed correctly
Package already installed, no updates were needed
Could not find a package with the provided name to install
Invalid user privileges
Package dependency is not installed
Actions
None
None
Check <packagename> to ensure it was correctly entered.
Ensure user running command has root access
Install package dependency then reinstall the package
12. Configure the MDE database (see next section)
13. Reboot the MDE when complete ($ sudo reboot)
When the MDE has rebooted, you will be able to login to the MDE GUI.
Database Setup
MDE supports an internal or external database configuration. In either case, you will need to configure MDE to communicate with the configured database prior to starting
MDE for the first time.
To associate a database with MDE, you will need to modify the MDE VM
/etc/securityfirst/atlantis/props.d/db.props file. You will need to edit as a root user.
Configure the file properties to connect to the appropriate database as described below. Database properties changes will not take effect until MDE is restarted. It is recommended you reboot the VM to restart MDE.
Critical Note
When modifying db.props adhere to the following constraints:
• no spaces between property name and =
• no spaces between = and property value
It is strongly recommended that you secure the database to prevent the information from becoming compromised. See Appendix “Sample Database Security
Configuration for information”.
IBM Multi-Cloud Data Encryption Administrator Guide 15
Internal Database
Currently, MDE supports an internal database: PostgreSQL.
4.4.1.1 Internal Postgres Database
The MDE OVA comes pre-packaged with a Postgres database. To leverage this database, follow these steps
:
1. sudo /opt/securityfirst/spsd/bin/spsd-pgsetup
2. Enter “localhost” for the requested hostname.
3. Answer “yes” when prompted to create a local user and database.
4. Enter a database name (e.g. “spsd”) when prompted.
5. Enter a database username (e.g. “spsd”) when prompted.
6. Enter a password when prompted
Note
Leveraging this script will automatically modify the db.props file with the values entered.
External Database
Currently, the only supported external database server is PostgreSQL. A convenient option is to leverage a pre-packaged turnkey Postgres appliance and import it into a hypervisor. See Appendix II, “Sample Progress Setup” for sample configuration of turnkey Postgres OVA. After setup, ensure that the db.props file matches the configuration.
# db.props POSTGRES CONNECTION EXAMPLE com.securityfirstcorp.atlantis.bundles.dataman.vendor=postgres com.securityfirstcorp.atlantis.bundles.dataman.serverName=localhost com.securityfirstcorp.atlantis.bundles.dataman.portNumber=5432 com.securityfirstcorp.atlantis.bundles.dataman.databaseName=sfcpolicy com.securityfirstcorp.atlantis.bundles.dataman.user=sfcpolicy com.securityfirstcorp.atlantis.bundles.dataman.password=******** com.securityfirstcorp.atlantis.bundles.dataman.initialConnections=8 com.securityfirstcorp.atlantis.bundles.dataman.maxConnections=32
IBM Multi-Cloud Data Encryption Administrator Guide 16
Database Configuration from MDE GUI
Once MDE has been initially setup, database configuration values can be changed from within the MDE Advanced Properties page. com.securityfirstcorp.atlantis.bundles.dataman.databaseName
Required. Set to the database name (or schema) that MDE uses to store data. For a multi-tenant installation, all nodes that belong to the same tenant must point to the same database. com.securityfirstcorp.atlantis.bundles.dataman.initialConnections
Required. Set to the initial number of pooled connections. The recommended value for Postgres is 10. com.securityfirstcorp.atlantis.bundles.dataman.maxConnections
Required. Set to the maximum number of pooled connections. The recommended value for Postgres is 32. com.securityfirstcorp.atlantis.bundles.dataman.password
Required. Set to the password for the user that MDE uses to connect. com.securityfirstcorp.atlantis.bundles.dataman.portNumber
Required. Set to the database server listening port. com.securityfirstcorp.atlantis.bundles.dataman.serverName
Required. Set to database server host name or IP address. com.securityfirstcorp.atlantis.bundles.dataman.user
Required. Set to the database user name that MDE uses to connect. com.securityfirstcorp.atlantis.bundles.dataman.vendor
Required. Set to DB vendor identification string. Currently “postgres” is the only supported value.
IBM Multi-Cloud Data Encryption Administrator Guide 17
The picture shows database properties for a sample configuration:
Starting and First-time Login
Once deployed, start the virtual machine via the hypervisor interface. You will need to retrieve the IP of the virtual machine.
Open the console and from the console, login and view the IP Address of the MDE virtual machine. https://<Virtual Machine IP>/web
This will direct the browser to the login page of MDE. You will be prompted to login.
IBM Multi-Cloud Data Encryption Administrator Guide 18
The default credentials are:
Username: admin
Password: admin
Note
• The default credentials are required to change after first login
• MDE supports most versions of Firefox, Chrome, and Internet Explorer web browsers.
IBM Multi-Cloud Data Encryption Administrator Guide 19
5 MDE Graphical User Interface (GUI)
Basic Product Navigation
MDE contains a top-of-the-page navigation menu. Some menu items contain submenu lists. Click on each menu item to navigate to the appropriate page or display the sub-menu list.
• Dashboard – A link to the product Dashboard page.
• Keys – A menu containing key related sub-menu page links: External
Keystores and Managed Keys.
• Policy – A menu containing policy related sub-menu page links: Datatypes,
Pathsets, and Selectors.
• Agents – A link to the Agents page.
• Jobs – A link to the Jobs page.
• Events – A menu containing event related sub-menu page links: Forwarding and Logs.
• Users – A menu containing user related sub-menu page links: Accounts and
LDAP Directories.
• Settings – A link to the Settings page.
Note
MDE supports role-based access control (RBAC), which means that some navigation items will not be available based on the role of the logged-in user.
Thus, some navigation items may not be available for all administrative users.
Textbox Autocomplete
Throughout the MDE user interface there are text entry fields. Some text entry fields will display match criteria based on an auto-complete of entered characters. These fields sometimes require multiple characters before an auto-complete suggestion list is presented.
Product Dashboard
The product dashboard is the main landing page for MDE. It is intended to give a summary view of the current status to the logged in administrator. The dashboard contains recent events, event trends, and other summary data.
IBM Multi-Cloud Data Encryption Administrator Guide 20
Needs Attention Notifications
Upon first login there will be a red banner at the top of the user interface indicating actions that need to be resolved.
Clicking the word “issues” in the banner will redirect the administrator to Issues page where individual items are displayed.
Expanding an individual item will give details on how to resolve the issue.
Resolving all open issues will remove the banner. The administrator can choose to dismiss the banner for the current session. The next login will redisplay the banner.
Note
Periodically conditions might arise that create new “needs attention” issues and the banner will redisplay.
IBM Multi-Cloud Data Encryption Administrator Guide 21
6 Jobs
MDE incorporates a jobs system to manage the approval and timing of running tasks.
Many features are run through the jobs system. When a job is created, a new job will be added to the list on the Jobs page. Administrators will have the option to approve, reject, or abstain on each job. Each administrator can take action only once per job.
Job Descriptions
Job
Advanced
Properties
Description
Modify an advanced property
Modify Keystore Change the location/details of the policy enforcement keystore
Key Rotation Rotate a set of keys in the agent ecosystem
Key Revocation Revoke a set of keys from the agent ecosystem
Key Shred
Add Agent
Permanently remove a set of keys from the agent ecosystem causing the data to be lost.
Provision and add a new agent into the ecosystem
Delete Agent
Modify Agent
Policy Update
Remove agent from MDE management
Modify information relating to an agent
Modify the policy
Category
Product
Management
Product Settings
Role
Product
Administrator
Product
Administrator
Key Management Security
Administrator
Key Management Security
Administrator
Key Management Security
Administrator
Agent Management Security
Administrator
Agent Management Security
Administrator
Agent Management Security
Administrator
Agent Management Security
IBM Multi-Cloud Data Encryption Administrator Guide 22
Create New
Administrative
User
Delete
Administrative
User
Add
Administrative
User Role
Remove
Administrative
User Role
Change
Administrative
User Password associated with an agent
Create a new MDE
Administrator
Remove a MDE
Administrator
Add a role to a MDE
Administrator
Remove a role from a
MDE Administrator
Change the password of a
MDE Administrator
Change
Administrative
User Status
Register
Directory
Enable or disable a MDE administrative user account
Configure LDAP Server directories for MDE
Administrative users
Delete Directory Remove LDAP server directory from MDE
Update Directory Modify LDAP server directory
MDE Administrative
User Management
MDE Administrative
User Management
Product
Administrator
MDE Administrative
User Management
MDE Administrative
User Management
MDE Administrative
User Management
MDE Administrative
User Management
MDE Administrative
User Management
MDE Administrative
User Management
MDE Administrative
User Management
Administrator
Product
Administrator
Product
Administrator
Product
Administrator
Product
Administrator
Product
Administrator
Product
Administrator
Product
Administrator
Product
Administrator
Multi-Administrator Approval
The required number of approvers and rejecters is configurable within MDE. By default, MDE is configured for single administrator approval. It is strongly recommended that two or more administrators be required for job approval. Multi-
Administrator approval prevents a single administrator from enacting a change within
MDE itself or to any managed agent instances.
IBM Multi-Cloud Data Encryption Administrator Guide 23
Critical Note
The number of Administrator Users must meet or exceed the number of job
Required Approvals or Required Rejections.
Job Approval
To approve a job, an administrator with the proper permissions must navigate to the
Jobs page, find the appropriate job, and click the “Approve” button. Once the required number of administrator approvals are reached, the job will execute.
Job Rejection
To reject a job, an administrator with the proper permissions must navigate to the
Jobs page, find the appropriate job, and click the “Reject” button. Once the required number of administrator rejections are reached, the job will be permanently cancelled.
Job Abstain
Abstaining from a job indicates an administrator has seen the job but does not want to approve or reject it. An abstain might best be described as an “audit” position and prevents the administrator from selecting a different position on the same job in the future.
Job Info
Each different job within MDE has different information that describes it. The “show info” button can be clicked and job specific information will appear. Additionally, any actions (approve, reject, abstain) taken on the job by different administrators will appear along with the user name of the administrator that took the action.
IBM Multi-Cloud Data Encryption Administrator Guide 24
IBM Multi-Cloud Data Encryption Administrator Guide 25
7 MDE Administrative User Management
Administrative User Roles
MDE leverages a flat static Role Based Access Control (RBAC) design. Functionality within MDE requires specific permissions. The complete set of MDE permissions are grouped into two distinct roles: Product Administrator and Security Administrator.
Additional administrators of each role may be added at any time.
Product Administrator Role
The Product Administrator role is entrusted with the permissions required to configure and maintain the MDE product.
Security Administrator Role
The Security Administrator role is entrusted with the permissions required to provision and manage the agents. These include but are not limited to: Policy definition and specifications, key management, datatype definition, agent management, external keystore configuration, and external LDAP configuration of external groups for policy.
Administrative User Management
A Product Administrator possesses the permissions that are required to add, modify, and remove other administrative users within MDE.
Adding a New Administrative User
When adding a new administrative user, a Product Administrator will be prompted to enter the new administrative user name.
Fill in a unique user name and a job will be created to add this administrative user to
MDE. The required number of Product Administrators must approve the job for the user to be created.
IBM Multi-Cloud Data Encryption Administrator Guide 26
A newly added administrative user is created with an expired password and no defined role. A Product Administrator must edit the password, the role, and status that will generate a job. The job must be approved before the new administrative user can become active in MDE.
Editing an Administrative User Password
To edit an administrative user’s password, navigate to the appropriate user and select the “Edit Password” button. A password entry dialogue will appear.
Enter a password that conforms to the identified rules. Once entered, save the changes and a job will be created.
IBM Multi-Cloud Data Encryption Administrator Guide 27
The required number of Product Administrators must approve the job for the password change to take effect.
Note
After job approval, adding a New Administrator User and Password, the newly added administrator should change password upon initial login.
Editing the Administrative User Role
To edit an administrative user’s role, navigate to the effected user and select the “Edit
Roles” button. Role entry checkboxes will appear inline.
Select the desired role(s) and click the “Save Changes” button, and a job will be created.
The required number of Product Administrators must approve the job for the role change to take effect.
Editing the Administrative User Status
To edit an administrative user’s status, navigate to the effected user and select the
“Edit Status” button. A status entry dropdown will appear inline.
Possible status values are: enabled, disabled, and locked.
• Enabled Status – The administrative user is active and able to perform actions.
• Disabled Status – The administrative user is inactive and cannot perform actions
• Locked Status – The administrative user is locked and cannot perform actions.
Select the desired status and click “Save Changes”, a job will be created to modify the user status.
IBM Multi-Cloud Data Encryption Administrator Guide 28
The required number of Product Administrators must approve the job for the status change to take effect.
Removing an Administrative User
To remove an administrative user, navigate to the affected user and click the “Delete” button. A job will be started to remove the user from MDE.
The required number of Product Administrators must approve the job for the user to be removed.
Critical Note
• Removing an administrative user is a permanent action. Must maintain enough administrative users to meet the required job approvals condition
(See “Multi-Administrator Approval” section.
• To temporarily disable a user, edit the user status
LDAP Directory List
A Product Administrator can configure LDAP directories for MDE user management.
LDAP directories can be added, modified, or deleted. Each action will create a job for approval before taking affect.
When adding/modifying a LDAP directory the available settings are:
• Directory ID – The identity of the LDAP directory.
• Bind DN – The full distinguished name that is used to bind to the LDAP server. Bind DN sample syntax is as follows: uid={$username},ou=users,dc=company,dc=com
Note
Bind DN is not used for Active Directory and the field is greyed-out.
IBM Multi-Cloud Data Encryption Administrator Guide 29
• Host – IP/Hostname of the LDAP server
• Port – Port of the LDAP Server
• Secure –Identifier of secure or non-secure LDAP connection
User Source
MDE can simultaneously support internally and externally defined users. Externally defined users will show a value in the “Directory” column of the User List. Internally defined users will have that field blank.
IBM Multi-Cloud Data Encryption Administrator Guide 30
8 Product Configuration
Server Certificate Settings
MDE server certificate keystore and truststore are configured via a command line script run within the MDE VM.
The configuration script spsd-certsetup is located in the MDE VM in the
/opt/securityfirst/spsd/bin directory.
To configure the web keystore and truststore:
[root@localhost bin]# /opt/securityfirst/spsd/bin/spsd-certsetup
Update server certificate keystore? (y/n) y
Enter new keystore path: ../certs/http.jks
Enter new keystore password: ********
OK
Update server certificate truststore? (y/n) y
Enter new truststore path: ../certs/http.jks
Enter new truststore password: ********
OK
Note
It is recommended that the keystore be modified during the initial product setup. The keystore and associated certificates need to be created outside of the MDE product.
Advanced Properties
MDE allows a Product Administrator to configure advanced properties that define product behavior. The advanced properties are accessible via a tab on the settings page. These properties are scoped to either the local MDE instance or potentially, if leveraging High Availability (HA) or multi-tenant functionality, the MDE ecosystem.
IBM Multi-Cloud Data Encryption Administrator Guide 31
To edit a property, a Product Administrator clicks the “edit” button. Once the appropriate changes have been made, click the “save” button and a job will be created.
IBM Multi-Cloud Data Encryption Administrator Guide 32
9 Events
MDE includes an event aggregation and forwarding system. This system aggregates events from managed agents along with internally generated events and stores them in an internal eventlog. Additionally, MDE can be configured to forward events to one or more recipients.
Eventlog
The MDE eventlog can be seen by selecting the Events menu item on the top level menu bar.
This page shows all events in a single sequential list ordered by event receipt. Each
IBM Multi-Cloud Data Encryption Administrator Guide 33
event has a sequence number, ID, message, type, severity, receipt timestamp, and source.
• Sequence number – a number attributed to the order in which the event is received. It is unique (even if the same event is repeated) and will increment over time.
• ID – a unique identifier of the event. Multiple instances of the same event will have a common ID.
• Message – descriptive text identifying the condition being evented. Some events might support variable insertion so while the event ID might be common the text could be slightly different.
• Type – describes if the event origination is from a system action or a user action. SYSTEM events are ones that are originated by an automated MDE action. AUDIT events are ones that are originated by a user action.
• Severity – relative indication of the awareness level of the event. The severity categories are: o
INFO – no action is required, for informational purposes only o
WARN – no immediate action is required, condition monitoring is advised o
CRITICAL – immediate action is required
• Timestamp – a coordinated universal time (UTC) formatted indication of event origination time.
• Source – the hostname or IP of the system (agent or MDE) originating the event.
The MDE eventlog size is configurable via the Advanced Settings. Once the set size limit is reached the oldest events will be rotated out as new events are received.
Event Export
MDE allows the administrator to export events in a CSV file format from Export CSV button on Events page.
Clicking the “Export CSV” button will download the events file to the client machine.
Each row in the events file is an event from the log.
IBM Multi-Cloud Data Encryption Administrator Guide 34
The columns in the events file are as follows: event sequence number, redacted flag, event message string (with arguments unincluded), event type, event severity, event arguments, event timestamp, and event source.
Event Forwarding
Every event received will be forwarded to each configured event recipient. Events are forwarded in parallel with insertion into the internal event log.
A Product or Security Administrator can modify the event recipients of the product.
Once configured, any event created or received by MDE will be forwarded to the recipient(s). Supported recipient types are: Email, and Syslog.
MDE also supports multiple formats for the forwarded events. Supported formats are: Log Event Extended Format (LEEF), Common Event Format (CEF), and Cloud
Auditing Data Federation (CADF) event models.
IBM Multi-Cloud Data Encryption Administrator Guide 35
Agent Events
MDE aggregates system and audit events from each managed (and connected) agent. These events are displayed in the MDE eventlog and are forwarded to any configured event recipients.
Note
Although not strictly required, it is strongly advised that MDE, external databases, and all agents leverage NTP to coordinate system time. This will ensure event / audit log timestamps are sequenced properly.
Reliable Events
The events sent from an individual agent to MDE are handled reliably. This ensures that if an event is missed, MDE will reach back to the agent, request the missed event, and insert it into the eventlog in the proper sequence.
IBM Multi-Cloud Data Encryption Administrator Guide 36
10 Policy Enforcement Key Management
A Security Administrator can define policy enforcement keys for secure storage within
MDE. These keys can be associated with datatypes, and volumes to secure data and provide cryptographic access control.
Adding a Key
When adding a new key, a unique name must be entered. Key names are not case sensitive. The key value is not exposed and cannot be edited by a user. The notes field is optional.
Note
Key names can be changed, but the actual key value cannot be modified by a user.
Keys can be added on the ‘Keys’ page, or while defining a Datatype or Datatype row.
Keys can only be edited on the ‘Keys’ page.
Editing a Key
After key creation, the Security Administrator can modify the name of a key. This does not change the actual underlying key values. Additionally, the notes field can be modified.
IBM Multi-Cloud Data Encryption Administrator Guide 37
Key Rotation
MDE enables the Security Administrator to rotate keys within the agent ecosystem.
From the Keys page, click the “Submit Key Rotation Job” button.
You will be prompted to upload a public key. This key will be used to encrypt the key escrow for the rotated key. Choose an appropriate key, add the key, and click
“Next”.
Note
The SSL key must be RSA and X.509 encoded.
When selecting keys manually a list of all created keys will be displayed. The Security
Administrator can select any number of keys to rotate.
IBM Multi-Cloud Data Encryption Administrator Guide 38
When selecting keys by Agent, all keys associated with that agent will be rotated.
After selecting the desired keys, a job will be created.
Critical Note
If a key is associated with more than one agent, all agents using that key will be affected.
Upon job approval, all impacted agents will be notified of the key rotation. The job will continue to run until all impacted agents have completed the key rotation process. Depending upon the number of impacted agents, this job could take a long time to complete.
Note
When using an external keystore, it must be online (available) for key rotation to succeed. If an error occurs, ensure that the external keystore is online and recycle the PPM server (spsd).
Key Revocation
Key revocation removes a key from MDE and places that key in escrow. Key revocation can only be done on a key that is currently unassociated to any active agent policy. Prior to revoking a key, the Security Administrator must remove policies that reference the key.
IBM Multi-Cloud Data Encryption Administrator Guide 39
Removing the path that leverages the key from an agent policy association will not decrypt the data on disk, therefore if data accessibility is desired the data must be migrated out of the protected directory prior to removing policy associated to that path.
After revocation is complete, any data remaining in the protected path will be inaccessible. The revoked key will be stored in escrow and removed from normal
PPM operation.
WARNING
You must update agent policy to disassociate the key, snapshot, and activate the change prior to revoking the key.
If you do not update agent policies to remove the associations to a key that is going to be revoked, you will potentially lose access to ALL of your data and not just the data targeted by the revoked key.
Critical Note
If a revoked key is modified between revocation and redistribution, it is possible that the data will not be retrievable.
Key Shredding
Key shredding operates the same way as key revocation; however, once the key shredding operation is completed the key will not be put into escrow leaving the data permanently inaccessible.
Note
This function is only available via REST API.
MDE Auto-generated Keys
If a Security Administrator does not want to manage policy enforcement keys, MDE can auto-generate a key for each newly created policy. Auto-generated keys are always unique when created and are not visible on the key management page.
Critical Note
MDE managed keys cannot be rotated or revoked. Use named keys if this behavior is desired.
IBM Multi-Cloud Data Encryption Administrator Guide 40
External Keystore
MDE supports the storing of keys in one of two places: internal secure database or external keystore. MDE is setup to use the internal secure database only. If the
Security Administrator wishes to leverage an external keystore, one must be configured. External keystores are used for key storage only. Key management must be done via MDE.
Note
The instructions to setup the external keystore are supplied by the external keystore vendor.
A Security Administrator will need to upload a Java Keystore and a Java Truststore.
Follow these steps to create a Java Keystore and a Java Truststore:
1. Gather the client certificate file and a client private key file in PKCS12 (Public
Key Cryptography Standard #12) format. For later steps we will call this
“client.p12”. (See Appendix IV for a sample on combining a client certificate and client private key into a PKCS12 formatted file.)
2. Gather a public CA certificate file. For later steps, we will call this file
“sklm_ca.pem”.
3. Import the PKCS12 file into a new Java Keystore:
keytool -importkeystore –srckeystore client.p12 -keystore client.jks storetype JKS
Critical Note
A password will be asked for during this step. Retain this password for later.
4. Get the alias from the file:
keytool -v -list -keystore client.jks
5. Import the CA Certificate file into a new Java Truststore:
keytool -import -trustcacerts -file sklm_ca.pem -ppm client_ -keystore server-alias -trust.jks
Critical Note
A password will be asked for during this step. Retain this password for later.
6. Get the alias from the file:
keytool -v -list -keystore trust.jks
IBM Multi-Cloud Data Encryption Administrator Guide 41
The settings that will need to be filled in for the external keystore to be active:
• Name – User defined reference for the external keystore
• State -This will tell MDE the defined external keystore should override the current active keystore. If the state is active, MDE will start using the keystore. If the state is inactive, MDE will no longer use the keystore.
• Host - The IP address of the external keystore.
• Port - The port number of the external keystore.
• Client Keystore o
Keystore Alias – The gathered keystore alias. o
Keystore File – Java Keystore o
Client Keystore Password – The password setup on the keystore creation.
• Truststore o
Truststore Alias – The gathered truststore alias. o
Truststore File - Java Truststore o
Truststore Password - The password setup on the truststore creation.
Note
Currently MDE only supports on external keystore product: IBM SKLM configured for KMIP.
IBM Multi-Cloud Data Encryption Administrator Guide 42
11 File-Level Policy Definition
MDE enables the Security Administrator to define file level control (operational and cryptographic) on various types of data. The terms below are used when defining file level data control.
• Selector - an unordered list of users and groups, that define who/what is to be allowed access.
• Pathsets - an unordered list of file paths to be protected by policy or excluded from policy protection.
• Datatype - an ordered list of access definition rows assigned to a specified type of data. Each row is comprised of a selector, I/O operation, and action definition.
Once a Datatype is created, it can be associated with one or more provisioned agents. The following sections will describe the configuration of a Datatype.
Selector
A Selector is a collection of one or more selector rows. When adding a new selector, the Security Administrator must supply a name prior to saving. Selector notes and rows can be added at any time by editing the selector.
Each selector row contains the following fields: user, group, group source.
• User - the short-name of a target system defined user. This is matched in the target system operating system. This field is optional.
• Group – the short-name of a target system or LDAP defined group. This is matched in the target system operating system. This field is optional.
IBM Multi-Cloud Data Encryption Administrator Guide 43
The values in each selector row are combined using a logical AND operation. If multiple fields are set in a single row, all fields must match for the row to match. A selector matches if any of the defined rows match. The ordering of rows within a selector do not impact the policy matching algorithm.
Note
Selector group resolution can be optionally setup to work via an external LDAP server. This setup is done via the MDE REST API. External groups do not support Active Directory
Pathsets
A Pathset is a collection of one or more unordered file path rows. When adding a
Pathset, the Security Administrator must supply a name for the Pathset. To add a row to the Pathset, click the “Add Path” button. Each row contains a file path, and notes.
The Security Administrator must supply a file path. Protection is recursive from the provided path down through any sub-directories. The notes field is optional.
IBM Multi-Cloud Data Encryption Administrator Guide 44
Datatypes
A Datatype is an ordered collection of Datatype Row definitions enabling the file level operational and/or cryptographic access control of data. Each Datatype contains a name, policy enforcement key, user notes, and an ordered list of rows.
• Name - user defined reference to the Datatype
• User Notes - Security Administrator defined notes field.
Datatype Row
Each Datatype row contains the following fields: selector, operation, policy enforcement key, and action.
• Order - the priority in which each policy row will be checked. First matching row is used. This field is required but will not show if only one row is present.
• Selector - a selection of previously defined selectors. The policy row will match if any of the rows in the selector match. This field is required. (MDE provides a “select all” Selector that will match on any user.)
• Operation - a selection of file operations that can be performed. The options are “read” and “read/write”. This field is required.
• Action - a selection of access actions that associate to the operation. The options are “permit”, “deny”, “permit, log”, and “deny, log”. This field is required.
Datatype Row Variables
The Selector, Operation, and Action fields can be optionally set to be variable. This allows for a Security Administrator to create templates for a Datatype that will be completed during Agent creation. The available field settings are: May Edit, Must
Edit, and Not Editable.
11.3.2.1 May Edit
This field can optionally be overwritten during Agent creation.
11.3.2.2 Must Edit
This field must be set during agent creation.
11.3.2.3 Not Editable
This field must be set during Datatype creation and cannot be changed during Agent creation.
IBM Multi-Cloud Data Encryption Administrator Guide 45
A Datatype cannot be saved until all rows have values and/or a variable setting.
IBM Multi-Cloud Data Encryption Administrator Guide 46
12 Agent Provisioning and Management
MDE supports three types of agent installations: Volume, File with Policy, and
Volume with Policy. Each agent type enables a different level of data protection.
• Volume agent protects data at a block device level
• File with Policy agent protects data at a file level and provides file-based operational access control policies
• Volume with Policy agent protects data at a block device level and also provides file-based operational access control policies
Adding an Agent
To add an agent, a Security Administrator must navigate to the Agents page of MDE and click the “Add Agent” button. This will launch a dialogue that will walk the
Security Administrator through the steps necessary to provision a new agent.
There are five sections to provisioning an agent: identity, network, users, policy, and volumes. Based on agent type, the policy and volumes sections may or may not be present. All required sections must be completed before the agent can be added.
Identity
The Identity section requires the Security Administrator define a Name, Type, IP
IBM Multi-Cloud Data Encryption Administrator Guide 47
Address, Operating System, notes, and designate or generate a unique identifier
(UUID) for the agent.
• Name – a user defined reference to the agent.
• UUID – a unique identifier MDE uses to identify the agent.
• IP Address – IP of the server the agent is being installed into.
• Type – selection of Volume, File with Policy, or Volume with Policy agent.
• Operating System – operating system of the target agent instance.
• Notes – Security Administrator notes for this agent.
Once all the required fields are entered, click “Save” to go back to the main provisioning dialogue.
Note
• MDE can generate a UUID if the Security Administrator does not wish to provide one.
• Required fields are indicated in the UI
Network
The Network step requires the Security Administrator to define the hostname/IP of the target agent instance, the peer hostname/IP of MDE, and the certificates needed to establish a secure connection between MDE and the target agent.
IBM Multi-Cloud Data Encryption Administrator Guide 48
• MDE Peer IP – IP of MDE as seen from the target agent server instance.
• Certificates – list of uploaded certificates used to establish a secure connection between MDE and the installed agent. This certificate is used to establish a mutually authenticated TLS1.2 connection between the agent and
MDE.
To upload a certificate, the Security Administrator must select the “Choose File” button, navigate to the desired certificate and select it, then click the “Add New
Certificate” button.
Once all the required fields are entered, click “Save” to go back to the main provisioning dialogue.
Users
The Users step requires the Security Administrator to define the MDE user accounts that has privileges to download the agent install bundle.
IBM Multi-Cloud Data Encryption Administrator Guide 49
Policy
The Policy step requires the Security Administrator to define the operational and cryptographic controls to file paths on the targeted agent.
12.1.4.1 Add Path
File with Policy and Volume with Policy agents can add a path definition to the agent policy. Each added path protects an individual or grouping of file paths on the targeted agent. The number of paths added is defined by the Security Administrator.
Note
Paths protected via policy must exist and be empty of files and sub-directories at time of policy application or the policy application will fail.
Critical Note
CentOS 6 File Agent does not currently support encryption of data in directories that exist on LVM root partition.
Ensure that directories that are specified for protection on CentOS 6 File
Agent exist either on a partition other than root or a non-LVM root partition.
IBM Multi-Cloud Data Encryption Administrator Guide 50
To add a path, click the “Add Path” button.
Each added path requires the entry of file path or pathset, and a datatype.
• File Policy Path (or Pathset) – identifies the path or group of paths to be protected by the identified Datatype access control definition. Protection is recursive from the provided file path into any sub-directories.
IBM Multi-Cloud Data Encryption Administrator Guide 51
Key - key used to encrypt paths associated with the Datatype. Any previously defined key or the MDE managed ${autogen} key can be used.
This field may or may not be visible depending upon whether File with Policy or Volume with Policy is used (see Note).
• Datatype – selection of a pre-created Datatype. Once selected, the
Datatype information is added inline. If a Datatype with variables is used, the variables must be entered prior to saving.
Note
• If using a Pathset, it must be created prior to adding the new agent.
• The Datatype used must be created prior to adding the new agent.
• If the new agent is Volume with Policy type, Datatypes will not contain policy enforcement keys as protection is accomplished via volume policy definition.
Volumes
12.1.5.1 Add Volume
Volume and Volume with Policy agent types can add one or more volume definitions to the agent policy. Each volume added is a new protected block device on the targeted agent. The number of volumes to be added defined by the Security
Administrator.
To add a volume, click the “Add Volume” button. Each added volume requires the entry of an underlying device label and an policy enforcement key.
IBM Multi-Cloud Data Encryption Administrator Guide 52
• Device Label – identifies the device being protected. After policy is deployed to an agent, the device label will need to be associated to the volume via running the spx-device command.
• Key – key used to encrypt the volume. Any previously defined key or the
MDE managed ${autogen} key can be used.
Critical Note
Unless using the “auto generated” key option, the policy enforcement key added must be defined prior to adding the agent. See section “MDE Policy
Enforcement Key Management”
Review and Build
Once all the desired volumes and paths have been entered, click “Save” to return to the main provisioning screen. When all provisioning steps are completed the provisioning step boxes will be clear of indications and a “Review” button will be available.
IBM Multi-Cloud Data Encryption Administrator Guide 53
Make additional changes or click “Review” to move to the next step.
The review page of the provisioning setup will display a complete view of all configuration information.
Review the contents for completeness and correctness and click “Build” to complete the provisioning process. Once the “Build” button is clicked, a job will be created to
IBM Multi-Cloud Data Encryption Administrator Guide 54
add the agent.
Upon job approval, the agent will be created and the installation package will be available to download and install.
Agent Activation
Upon agent build job approval, the newly created agent is active within MDE. Once the agent is installed, it will use the configured MDE Peer IP and provided certificates to create a mutually-authenticated TLS1.2 connection to MDE.
The agent will request policy on initial installation and subsequent startup. MDE will respond with the configured policy configuration. Once the policy is received it is enforced at the agent.
Viewing Agents
The Agents page will display a summary list of created agents.
To see the details for any specific agent, click the agent name in the Name column of the summary table. This will open an agent detail view page which displays provisioning information, installation bundle downloads, and other useful information.
IBM Multi-Cloud Data Encryption Administrator Guide 55
Installing an Agent
The provisioning step configured all the information necessary for agent install and deploy policy to a target server instance. To install the agent, download the installation package, copy it to the target system, unpack the contents, and run the setup script.
See Appendix “Sample Agent Installation Process” for an example.
IBM Multi-Cloud Data Encryption Administrator Guide 56
Linux Volume Device Association
1. Create a Volume or Volume with Policy Agent in PPM (remember device label used)
2. Install the “Parted” package on your agent VM (from Repository)
3. Install the agent
4. Reboot agent VM when installation finished
5. spxdevice =e <label given in PPM> <disk to use> e.g. spxdevice -e COS6VOL /dev/sdb
6. /etc/init.d/spx-policyagent restart
7. isblk
Use to verify disk exists -this can take ~30 seconds sometimes
8. spxdevice -l
Notice it returns a result if run afterwards
Windows Volume Device Association
1. Create a Volume or Volume with Policy Agent in PPM (remember device label used)
2. Install the agent
3. Reboot agent VM when installation finished
4. spxdevice -e <label given at PPM> <disk number to use> e.g. spxdevice -e PRODISK 1
5. Reboot Agent
6. spxdevice -l
Notice it returns a result if run afterwards
Linux Volume with Policy Configuration
After install, Volume with Policy Agent for Linux will require additional configuration steps as outlined below.
1. Disable spx-fileagent service (this is to prevent file agent from starting before volumes and directories are mounted and available. chkconfig spx-fileagent off
2. Assign disk labels to appropriate volumes spxdevice -e <label> <device>
3. Reboot to load all kernel modules and configurations
4. Create the file system on newly encrypted volume mkfs <filesystem type> /dev/mapper/e_<label>
5. Mount encrypted volume to the required mount point
6. Create any required sub-directories
7. Set proper permissions on directories
8. Start the file agent service to apply the initial policy
/etc/init.d/spx-fileagent start
9. Validate the file policy is correct
IBM Multi-Cloud Data Encryption Administrator Guide 57
spxinfo -l
10. Reboot to ensure File and Volume kernel modules are updated an in sync
Note
These same steps are required on any policy snapshot activation that adds a new volume device description for encryption.
Critical Note
Any reboot of an active Volume with Policy agent VM requires the following steps to be run:
1. Mount encrypted disk mount /dev/mapper/e_<label> <location>
2. Start File Agent
/etc/init.d/spx-fileagent start
Windows Volume with Policy Configuration
After install, Volume with Policy for Windows will required additional configuration steps as outlined below.
1. spxdevice -e <label given at PPM> <disk number to use> e.g. spxdevice -e PRODISK 1
2. Restart computer
3. Format filesystem onto chosen drive
4. Add protected directory(ies) onto volume
5. Restart computer
6. spxinfo -l (should show list of all protected directories)
Note
These same steps are required on any policy snapshot activation that adds a new volume device description for encryption.
Active Policy
Each agent can have only one active policy. Agents do not store their policy in a persistent way. On every agent reboot the agent requests the currently active policy to be sent. If MDE is inaccessible by the agent, then the default deny access will be applied to all protected directories on the agent.
When a new policy is sent to the agent, the agent will send an event to MDE on
IBM Multi-Cloud Data Encryption Administrator Guide 58
successful (or unsuccessful) application of the policy. If policy activation persists, please refer to the policy_kernel.log file in the /var/log/spxagent/spx-policyagent directory.
Editing an Agent
After an agent is successfully provisioned and approved any changes to that agent must be made by editing the agent. To edit an agent, view the agent details by clicking on the agent name in the agent list. On the details page, sections of the agent can be edited independently.
Edit Agent Info
Clicking the “Edit Agent Info” button will allow the modification of some agent information: Name, IP Address, and MDE Peer IP, and Notes.
Changes to MDE Peer IP will be immediate within MDE, but if the agent was already installed a new install package must be created and installed before changes will be in effect.
Note
UUID, Operating System, and Agent Type are not editable after initial
IBM Multi-Cloud Data Encryption Administrator Guide 59
provisioning.
Add/Delete Certificates
Agent certificates can be added and deleted by clicking the appropriate buttons in the certificates section of the agent details page.
If the agent was already installed a new install package must be created and installed before certificate changes will be in effect.
Policy Changes
Policy changes can be made by either modifying a policy applied to a protected path adding a new protected path, or adding an encrypted volume.
Changes to policy does not modify the encryption status of current data. They will only impact the handling of data created after the policy is redeployed.
Note
Do not delete a volume policy from an active agent. You can create a new volume on an active agent and leave the old volume as unused. Alternately, you can create a new agent.
12.6.3.1 Edit Policy
Editing an agent’s policy allows the modification of File Policy Path, or Pathset and
Datatype association, or encrypted volumes. If the Datatype is changed to one that can be edited, inline editing of those fields will be available.
IBM Multi-Cloud Data Encryption Administrator Guide 60
To edit the policy, click the “Edit Master Policy” button. This will launch an edit screen.
12.6.3.2 Add Path
To add a new path to place under file policy, click the “Add Path” button.
IBM Multi-Cloud Data Encryption Administrator Guide 61
This will open a new section for input of policy (similar to original provisioning).
12.6.3.3 Add Volume
To add a new volume to encrypt, click the “Add Volume” button.
IBM Multi-Cloud Data Encryption Administrator Guide 62
This will open a new section for input (similar to original provisioning).
Agent Snapshots
Agent snapshots are the permanent storage of agent associated policy configurations. Snapshots are indexed and have a state of Active or Inactive. There is only one active snapshot per agent. This is the policy configuration currently applied to the agent. To modify the agent policy configuration, the administrator must create a new snapshot that reflects the desired changes and activate the new snapshot.
Saving Agent Edits and Snapshots
When completing the editing of Agent policy, you can either Cancel the changes,
IBM Multi-Cloud Data Encryption Administrator Guide 63
Save the changes, Save and Snapshot the changes, or Save and Snapshot and
Activate the changes.
12.6.5.1 Cancel Changes
Cancelling the changes will revert to the policy configuration that was in place prior to modifying.
12.6.5.2 Save Changes
Saving the changes will store them for future use, but does not create a snapshot and therefore the changes cannot be applied to the agent.
12.6.5.3 Save and Snapshot
Saving and snapshotting the changes will store them for future use and creates a snapshot that can be viewed and activated at a later time.
12.6.5.4 Save, Snapshot and Activate
Saving and snapshotting and activating the changes will store them for future use and creates a snapshot that can be viewed and immediately creates a job to apply these changes to the agent.
Managing Snapshots
All snapshots associated with an agent can be viewed via the “Manage Snapshots” button on the agent details view.
Clicking the button will bring up a snapshot management dialogue. From this a
Security Administrator can view snapshot details, activate a snapshot, deactivate policy associated with a snapshot, and delete a snapshot.
IBM Multi-Cloud Data Encryption Administrator Guide 64
12.6.6.1 View Details
This button brings up a summary view of the policy associated with the snapshot.
12.6.6.2 Activate Snapshot
Activating a snapshot creates a job to send the policy to the agent. Once approved, the snapshot will transition into the active state and its policy will overwrite any policy present on the agent.
12.6.6.3 Deactivate Policy
Deactivating policy on an agent will create a job that, once approved, will remove file protection from an active agent. On a File with Policy agent this will remove all policy.
On a Volume with Policy agent, volume encryption will remain in effect. This option is not available on a Volume agent.
IBM Multi-Cloud Data Encryption Administrator Guide 65
12.6.6.4 Delete Snapshot
An inactive snapshot can be deleted. Deleting a snapshot will permanently remove it from MDE.
Uninstalling a File Agent from an Application Server
If it is desired to remove an agent from an application server, this can be achieved via the following steps:
1. Copy data out of protected directories on the application server. This will ensure data is not inaccessible after policy is deactivated.
2. In PPM, deactivate the policy associated with the active snapshot. This will create a job that requires approval.
3. Approve the job to deactivate policy.
4. Ensure agent on the application server has received updated policy by running
“spxinfo -l”. No directories should be listed as protected. Restart agent if necessary.
5. Uninstall the agent from the application server by running “spxuninstall.sh”.
Note
• Authorized user(s) should not use the mv (move) command to move data to/from the encrypted location as this may create issues with MDE policy. Back up data first using the cp (copy) command to/from protected (encrypted) directories.
• SPxUninstall will not run to completion if a directory is protected via policy
Uninstalling Volume Agents
Uninstalling a Volume Agent
1. cd /opt/ibm/mde/spxagent/spx-volumeagent/
2. ./uninstall_blockfiler.sh
3. Type y to achknowledge the destructive action
4. cd /opt/ibm/mde/spxagent/spx-policyagent/
5. ./policy_uninstall.sh
6. Reboot
IBM Multi-Cloud Data Encryption Administrator Guide 66
Uninstalling a Volume with Policy Agent
1. Run Volume Agent steps above
2. spxuninstall.sh
3. reboot
Removing an Agent from MDE
An agent managed by MDE can be removed from the ecosystem. Removing an agent from MDE will prevent the agent from being able to connect to MDE resulting in the currently protected data becoming inaccessible on the next agent restart.
Removing an agent does not decrypt the data.
IBM Multi-Cloud Data Encryption Administrator Guide 67
13 Operations
Product Data Backup and Restore
MDE supports the ability to do a point-in-time backup of MDE data. This point-intime backup can be restored to return MDE to the state at time of backup collection.
Note
Before performing a backup or restore, please stop the MDE service via the
“systemctl stop spsd” command in the MDE VM.
Product Data Backup
Product backups are done via a command line script run within the MDE VM.
The backup script spsd-backup is located in the MDE VM in the
/opt/securityfirst/spsd/bin directory.
Usage: spsd-backup [--nodb] [--help]
----------------------------------
--nodb Don't backup the database
--help Show this help
To run a backup:
[root@localhost bin]# spsd-backup
Product Data Restore
Product restore is done via a command line script run within the MDE VM.
The restore script spsd-restore is located in the MDE VM in the
/opt/securityfirst/spsd/bin directory.
Usage: spsd-restore [--nodb] [--noprops] [--help] FILE
----------------------------------
--nodb Don't write the database
--noprops Don't write local properties
--help Show this help
To run a restore:
[root@localhost bin]# spsd-restore <filename>
IBM Multi-Cloud Data Encryption Administrator Guide 68
Note
After restoring a backup file, the next start of MDE will consume the changes.
Service Data Collection
Service Data Collection is done via a command line script run within the MDE VM.
The restore script spsd-service is located in the MDE VM in the
/opt/securityfirst/spsd/bin directory.
Usage: spsd-service [OPTIONS]
----------------------------------
OPTIONS:
--nodb Don't dump the database
--norest Don't pull any data from the REST API
--nosys Don't pull system data (/var/log, /proc, and so on)
--withcore Pull in a core dump of spsd
--help Show this help
To run a service data collection:
[root@localhost bin]# spsd-service
IBM Multi-Cloud Data Encryption Administrator Guide 69
Appendix I: Sample Database Security
Configuration
It is strongly recommended to secure the database to prevent potential bare metal or eavesdropping attacks, which could compromise the workgroup keys. Encrypting the filesystem where the database data lives protects against bare-metal attacks.
Allowing only SSL connections with strong ciphers protects against MITM attacks and eavesdropping on communications.
These instructions assume that you have a PostgreSQL database instance with support for SSL enabled (not enabled by default). For details on how to compile
PostgreSQL with SSL support, refer to” Secure TCP/IP Connections with SSL” in
PostgreSQL documentation and option “--with-openssl”.
It is recommended to perform the steps in the following order:
1. Encrypt the filesystem
2. Configure database data directory
3. Configure database SSL configuration
Encrypt the Filesystem
Encrypting the Volume
1. Ensure that dm-crypt+LUKS is installed, invoke command
cryptsetup
to verify. If not installed, install package
cryptsetup
.
# apt-get install cryptsetup
(Your distro package manager could be different,
yum , zypper
, etc.)
2. If you want to create an encrypted folder within an existing filesystem (not the whole filesystem), continue at step 3. Otherwise, skip to step 6.
3. Find an available loop device number:
# losetup –a
/dev/loop1: [65024]:263942 (/var/lib/some-file-in-use)
(For example, in above case, loop1 is used, so loops 0,2,3,4,5,6,7 can be used)
4. Create an image file in some convenient location, connect it as a loop device.
Use a file size that allows room for MDE data.
Change permissions to grant exclusive access to the PostgreSQL user account. root@postgresql# dd if=/dev/zero of=dbencrypted.img bs=100M count=0 seek=1
0+0 records in
0+0 records out
0 bytes (0 B) copied, 0.000960305 s, 0.0 kB/s
IBM Multi-Cloud Data Encryption Administrator Guide 70
root@postgresql# ls –la total 100500 drwxr-xr-x 3 postgres postgres 4096 Dec 2 21:56 . drwxr-xr-x 32 root root 4096 Jul 18 06:43 ..
-rwx------ 1 root root 104857600 Dec 2 21:56 dbencrypted.img
5. Connect the loop device (loop0) to the new image file. root@postgresql# losetup /dev/loop0 dbencrypted.img root@postgresql# losetup –a
/dev/loop0: [65024]:262421 (/var/lib/postgresql/dbencrypted.img)
This makes a block device available to the system.
6. Format and encrypt the block device.
Enter a passphrase, DO NOT FORGET it as it is unrecoverable.
Open the encrypted device as a volume.
Note
If you are encrypting an existing volume (coming from step 2) below instructions still apply. However, instead of using loop0 as the block device, use the actual block device name for your volume such as /dev/sda1. Ensure the volume is empty as encrypting a disk is a destructive process. root@postgresql# cryptsetup -q -y luksFormat /dev/loop0
Enter passphrase:
Verify passphrase: root@postgresql# cryptsetup luksOpen /dev/loop0 dbvolume
Enter passphrase for /var/lib/postgresql/dbencrypted.img: root@postgresql# ls /dev/mapper –la total 0 drwxr-xr-x 2 root root 120 Dec 2 22:16 . drwxr-xr-x 18 root root 3120 Dec 2 22:16 .. crw------- 1 root root 10, 236 Dec 1 14:11 control
lrwxrwxrwx 1 root root 7 Dec 2 22:16 dbvolume -> ../dm-2
7. Format the volume using EXT4 filesystem: root@postgresql# mkfs.ext4 -L "dbencrypted" /dev/mapper/dbvolume mke2fs 1.42.12 (29-Aug-2014)
Creating filesystem with 100352 1k blocks and 25168 inodes
Filesystem UUID: 0c99e970-595c-486d-b729-eb383f3cfab9
Superblock backups stored on blocks:
8193, 24577, 40961, 57345, 73729
Allocating group tables: done
Writing inode tables: done
Creating journal (4096 blocks): done
Writing superblocks and filesystem accounting information: done
IBM Multi-Cloud Data Encryption Administrator Guide 71
8. Mount filesystem into a directory of choice. A convenient place is next to the image file.
Create a folder in that location, mount filesystem, and grant permissions to
PostgreSQL user.
root@postgresql# mkdir dbencrypted root@postgresql# mount /dev/mapper/dbvolume ./dbencrypted root@postgresql# chown -Rv postgres:postgres dbencrypted changed ownership of 'dbencrypted/lost+found' from root:root to postgres:postgres changed ownership of 'dbencrypted' from root:root to postgres:postgres root@postgresql# chmod 700 -Rv dbencrypted mode of 'dbencrypted' changed from 0755 (rwxr-xr-x) to 0700 (rwx------) mode of 'dbencrypted/lost+found' retained as 0700 (rwx------)
At this point, an encrypted filesystem is available: root@postgresql 9.4/main# df –H
Filesystem Size Used Avail Use% Mounted on
/dev/dm-0 18G 1.2G 16G 7% / udev 11M 0 11M 0% /dev tmpfs 104M 8.9M 95M 9% /run tmpfs 260M 0 260M 0% /dev/shm tmpfs 5.3M 0 5.3M 0% /run/lock tmpfs 260M 0 260M 0% /sys/fs/cgroup
/dev/sda1 435M 32M 381M 8% /boot
/dev/mapper/dbvolume 96M 1.6M 87M 2% /var/lib/postgresql/dbencrypted
The permissions should look like: root@postgresql# ls -la dbencrypted total 18 drwx------ 4 postgres postgres 1024 Dec 2 23:50 . drwxr-xr-x 4 postgres postgres 4096 Dec 2 22:22 .. drwx------ 2 postgres postgres 12288 Dec 2 22:20 lost+found
Closing the Encrypted Volume root@postgresql# umount /var/lib/postgresql/dbencrypted root@postgresql# ls -la dbencrypted total 8 drwxr-xr-x 2 root root 4096 Dec 3 00:13 . drwxr-xr-x 4 postgres postgres 4096 Dec 3 00:21 .. root@postgresql# cryptsetup luksClose /dev/mapper/dbvolume root@postgresql# losetup -D /dev/loop0
Reopening the Encrypted Volume root@postgresql# losetup /dev/loop0 dbencrypted.img
IBM Multi-Cloud Data Encryption Administrator Guide 72
root@postgresql# cryptsetup luksOpen /dev/loop0 dbvolume
Enter passphrase for /var/lib/postgresql/dbencrypted.img: root@postgresql# mount /dev/mapper/dbvolume ./dbencrypted root@postgresql# ls -la dbencrypted total 6 drwx------ 3 postgres postgres 1024 Dec 3 01:18 . drwxr-xr-x 4 postgres postgres 4096 Dec 3 00:21 .. drwx------ 18 postgres postgres 1024 Dec 3 01:35 pg_data
Configure Database Data Directory
The key idea is to point the PostgreSQL data directory into the encrypted filesystem.
If you have existing data copy the data into the encrypted partition (see Existing Data
Directory sub-section). If you are starting from zero, you will need to perform basic database initialization steps (see New Data Directory sub-section).
Existing Data Directory
1. Copy the existing data directory using the archive option into a new folder inside the encrypted directory. For example, if dbunencrypted
is an existing data directory sitting next to the encrypted directory dbencrypted
, you would do: root@postgresql# cp -aRv dbunencrypted dbencrypted/pg_data
2. Next, modify postgresql.conf
file (typically at
/etc/postgresql/<version>main/postgresql.conf
) and set the data _ directory
variable to the new directory:
data_directory = '/var/lib/postgresql/dbencrypted/pg_data'
3. Restart the PostgreSQL server:
service postgresql restart
New Data Directory
1. Switch to the PostgreSQL user account and cd into encrypted folder: root@postgresql# su – postgres postgres@postgresql$ cd dbencrypted
2. Initialize database cluster: postgres@postgresql$ /usr/lib/postgresql/9.4/bin/initdb -D pg_data
The files belonging to this database system will be owned by user "postgres".
This user must also own the server process.
The database cluster will be initialized with locale "C".
The default database encoding has accordingly been set to "SQL_ASCII".
The default text search configuration will be set to "english".
Data page checksums are disabled.
IBM Multi-Cloud Data Encryption Administrator Guide 73
initdb: directory "." exists but is not empty
It contains a lost+found directory, perhaps due to it being a mount point.
Using a mount point directly as the data directory is not recommended.
Create a subdirectory under the mount point. postgres@postgresql:~/dbencrypted$ /usr/lib/postgresql/9.4/bin/initdb -D pg_data
The files belonging to this database system will be owned by user "postgres".
This user must also own the server process.
The database cluster will be initialized with locale "C".
The default database encoding has accordingly been set to "SQL_ASCII".
The default text search configuration will be set to "english".
Data page checksums are disabled. creating directory pg_data ... ok creating subdirectories ... ok selecting default max_connections ... 100 selecting default shared_buffers ... 128MB selecting dynamic shared memory implementation ... posix creating configuration files ... ok creating template1 database in pg_data/base/1 ... ok initializing pg_authid ... ok initializing dependencies ... ok creating system views ... ok loading system objects' descriptions ... ok creating collations ... ok creating conversions ... ok creating dictionaries ... ok setting privileges on built-in objects ... ok creating information schema ... ok loading PL/pgSQL server-side language ... ok vacuuming database template1 ... ok copying template1 to template0 ... ok copying template1 to postgres ... ok syncing data to disk ... ok
WARNING: enabling "trust" authentication for local connections
You can change this by editing pg_hba.conf or using the option -A, or
--auth-local and --auth-host, the next time you run initdb.
Success. You can now start the database server using:
/usr/lib/postgresql/9.4/bin/postgres -D pg_data or
/usr/lib/postgresql/9.4/bin/pg_ctl -D pg_data -l logfile start
IBM Multi-Cloud Data Encryption Administrator Guide 74
3. Create MDE user and databases.
postgres@postgresql:$ /usr/lib/postgresql/9.4/bin/createuser -P policyuser
Enter password for new role:
Enter it again: postgres@postgresql:~$ /usr/lib/postgresql/9.4/bin/createdb policydb
4. Next, modify postgresql.conf
file (typically at
/etc/postgresql/<version>main/postgresql.conf
) and set the data _ directory
variable to the new directory:
data_directory = '/var/lib/postgresql/dbencrypted/pg_data'
5. Restart the PostgreSQL server:
service postgresql restart
Configure Database SSL Configuration
In the current release, MDE can use the same Web settings certificate to perform mutual certificate authentication when connecting to the database. You can generate a key pair, import it into the web certificate settings, enable SSL authentication for the database, and it will attempt a full handshake with the database server. Manual steps are needed to copy certificate files to the PostgreSQL server and enable SSL.
Detailed steps:
1. Create a keypair in JKS format. Use same passwords for keystore and private key.
$ keytool -genkeypair -keyalg RSA -keystore ppm.jks -alias ppm
Enter keystore password: passw0rd
Re-enter new password: passw0rd
What is your first and last name?
[Unknown]: localhost
What is the name of your organizational unit?
[Unknown]: sales
What is the name of your organization?
[Unknown]: company
What is the name of your City or Locality?
[Unknown]: san francisco
What is the name of your State or Province?
[Unknown]: california
What is the two-letter country code for this unit?
[Unknown]: us
Is CN=localhost, OU=sales, O=company, L=san francisco, ST=california, C=us correct?
[no]: yes
Enter key password for <ppm>
(RETURN if same as keystore password): passw0rd
IBM Multi-Cloud Data Encryption Administrator Guide 75
Re-enter new password: passw0rd
Re-enter new password: passw0rd
2. Extract certificate (DER format)
$ keytool -export -alias ppm -file ppm.der -keystore ppm.jks
Enter keystore password: passw0rd
Certificate stored in file <ppm.der
3. Convert certificate to PEM (ASCII/readable) format
$ openssl x509 -inform der -in ppm.der -out ppm.crt
4. Create PKCS12 keystore from JKS file. Use same passwords for keystore and private key.
$ keytool -importkeystore -srckeystore ppm.jks -destkeystore ppm.p12 -
deststoretype PKCS12
Enter destination keystore password: passw0rd
Re-enter new password: passw0rd
Enter source keystore password: passw0rd
Entry for alias ppm successfully imported.
Import command completed: 1 entries successfully imported, 0 entries failed or cancelled
5. Export private key from PKCS12 file to PEM (ASCII/readable) format.
$ openssl pkcs12 -in ppm.p12 -nocerts -nodes -out ppm.key
Enter Import Password:
MAC verified OK
6. Copy generated ppm.key
and ppm.crt
files to the encrypted postgresql server data directory
(/var/lib/postgresql/dbencrypted/data
in previous section).
7. Modify files' permissions to 600.
Change files' owner:group to posgres:postgres.
Assuming you’re logged in to the postgresql server, and at the data directory: root@postgresql dbencrypted/pg_data# chmod 600 ppm.{crt,key} root@postgresql dbencrypted/pg_data# chown postgres:postgres ppm.{crt,key} root@postgresql dbencrypted/pg_data# ls –la total 53 rwx------ 18 postgres postgres 1024 Dec 3 05:07 . drwx------ 3 postgres postgres 1024 Dec 3 01:18 ..
-rw------- 1 postgres postgres 4 Dec 3 00:21 PG_VERSION drwx------ 6 postgres postgres 1024 Dec 3 00:37 base drwx------ 2 postgres postgres 1024 Dec 3 01:32 global drwx------ 2 postgres postgres 1024 Dec 3 00:21 pg_clog drwx------ 2 postgres postgres 1024 Dec 3 00:21 pg_dynshmem
-rw------- 1 postgres postgres 4468 Dec 3 00:21 pg_hba.conf
-rw------- 1 postgres postgres 1636 Dec 3 00:21 pg_ident.conf
IBM Multi-Cloud Data Encryption Administrator Guide 76
drwx------ 4 postgres postgres 1024 Dec 3 00:21 pg_logical drwx------ 4 postgres postgres 1024 Dec 3 00:21 pg_multixact drwx------ 2 postgres postgres 1024 Dec 3 01:32 pg_notify drwx------ 2 postgres postgres 1024 Dec 3 00:21 pg_replslot drwx------ 2 postgres postgres 1024 Dec 3 00:21 pg_serial drwx------ 2 postgres postgres 1024 Dec 3 00:21 pg_snapshots drwx------ 2 postgres postgres 1024 Dec 3 01:35 pg_stat drwx------ 2 postgres postgres 1024 Dec 3 00:21 pg_stat_tmp drwx------ 2 postgres postgres 1024 Dec 3 00:21 pg_subtrans drwx------ 2 postgres postgres 1024 Dec 3 00:21 pg_tblspc drwx------ 2 postgres postgres 1024 Dec 3 00:21 pg_twophase drwx------ 3 postgres postgres 1024 Dec 3 00:21 pg_xlog
-rw------- 1 postgres postgres 88 Dec 3 00:21 postgresql.auto.conf
-rw------- 1 postgres postgres 20801 Dec 3 00:21 postgresql.conf
-rw------- 1 postgres postgres 144 Dec 3 01:32 postmaster.opts
-rw------- 1 postgres postgres 1273 Dec 3 05:01 ppm.crt
-rw------- 1 postgres postgres 1844 Dec 3 05:01 ppm.key
8. Edit /etc/postgresql/<version>/main/posgresql.conf, set properties: ssl=true ssl_cert_file='ppm.crt' ssl_key_file='ppm.key' ssl_ca_file='ppm.crt'
# enable ssl
# server certificate file
# server private key
# server trusted CA certificate file ssl_ciphers = 'AES256:!3DES:!aNULL' # only AES256, no 3DES, no NULL ciphers ssl_prefer_server_ciphers = on # prefer server ciphers
9. Edit /etc/postgresql/<version>/pg_hba.conf, add property: hostssl all all 0.0.0.0/0 md5 clientcert=1
10. (Optional/Recommended) Comment out (prepend #) host property to prevent unencrypted communications:
#host all all 0.0.0.0/0 md5
11. Import keypair into PPM Web Keystore and Truststore settings.
a. Go to Settings Page, Select Web tab
IBM Multi-Cloud Data Encryption Administrator Guide 77
b. Update the
Keystore password
field with the keystore password. c. Click
Update Password
. d. Click
Choose File
, select the JKS file generated at step 1. e. Click
Upload Keystore
. f. Repeat the same steps for trust store fields. Since we are using self-signed certificate and mutual authentication, use the same certificate for the trust store.
12. Go to Advanced Properties, set property com.securityfirstcorp.atlantis.bundles.dataman.useSSL to true
. Approve the
Property Change job for the change to take effect.
13. Stop the MDE server or appliance.
14. Restart the PostgreSQL server.
15. Start the MDE server or appliance.
16. Delete all key material that was generated temporarily to avoid compromising the private keys.
If everything was set up correctly, at this point you should be able to log in to the
MDE server. The MDE server should connect securely (SSL) to the database server using the uploaded certificate, and the MDE database data should be located in an encrypted filesystem and protected against bare metal attacks.
If postgresql.conf
property log_connections
is set to true
, you should see entries like these from PostgreSQL logs, indicating the type of SSL connection and cipher being used:
2016-12-03 05:34:08 UTC [20944-1] [unknown]@[unknown] LOG: connection received: host=192.168.1.199 port=51487
2016-12-03 05:34:08 UTC [20944-2] sfcpolicy@sfcpolicy LOG: connection authorized: user=sfcpolicy database=sfcpolicy SSL enabled (protocol=TLSv1.2, cipher=ECDHE-RSA-
AES256-GCM-SHA256
, compression=off
IBM Multi-Cloud Data Encryption Administrator Guide 78
Appendix II: Sample Postgres Setup
1. Deploy the turnkey Postgres OVA to your hypervisor
2. Power on the VM
3. Change/create root password
4. Initialize HUB services (simply hit the ‘Apply’ button)
5. Skip setting up email alerts (hit the ‘Skip’ button)
6. Install security updates (hit the ‘Install’ button) and wait for it to finish
7. Go into the ‘Advanced Menu’ and choose the ‘Reboot’ option
8. Once the VM has rebooted, note the IP and port for “Adminer”
9. Go to the above IP/port and log into the system with the db administrator
(postgres account)
*All passwords are set at system initialization time.
10. Click on the “SQL command” link in the left-hand column
11. In the SQL command box that appears, type the following:
CREATE USER <user> WITH PASSWORD ‘********’;
CREATE DATABASE <ppmDB> OWNER <user> TEMPLATE template0;
Note
• Capitalization does matter here
• That is a zero at the end of the word template in the second line
12. Click the execute button at the bottom of the page to create a PostgreSQL user with password, and database owned by the created user to be used with the engine.
IBM Multi-Cloud Data Encryption Administrator Guide 79
Appendix III: Sample Agent Installation
Processes
The following sections outline the general process for installation of the agent install bundle. These are only example methods and are not supported installation instructions.
Red Hat / CentOS Process
Transferring install bundle via CURL:
1. Login to the target system
2. Ensure a valid connection with the MDE server
3. Ensure that all users, groups and paths or devices that are identified in policy are created, attached, and configured to the system
4. Login to MDE
5. Within MDE, provision an agent for the target system
6. Within MDE, view the agent details and note the Download URL
7. From the target system, download the tar bundle using the following curl command:
curl -k --header “Accept: application/x-tar” -u admin:admin https://<PPM
IP>/<Download URL> > package.tar
Example using PPM defined user:
curl -k --header “Accept: application/x-tar” -u admin:admin
https://1.1.1.10/rest/agents/1/install_bundle > package.tar
Example using PPM LDAP defined user: curl -k --header "X-Directory: tenant1" --header “Accept: application/x-tar” -u john:secret https://1.1.1.10/rest/agents/1/install_bundle > package.tar
(assuming directory identifier "tenant1", with user "john" and password "secret")
IBM Multi-Cloud Data Encryption Administrator Guide 80
8. From the target system, untar the package:
tar -xf package.tar
9. From the target system, run the setup script
./setup.sh
10. Once the setup script has completed the agent is installed and policy will be downloaded from MDE and will be in effect.
Windows Server Process
Transferring install bundle:
1. Login to the target system
2. Ensure a valid connection with the MDE server
3. Ensure all users, groups and paths or devices identified in policy are created, attached and configured to the system
4. Login to MDE
5. Within MDE, provision an agent for the target system
6. Within MDE, view the agent details and note the Download URL
7. Click “Download Zip Bundle” to download the zip file bundle for the agent software to the local system
8. Transfer the install bundle to the target system
9. On the target system, extract the contents of the zip file bundle
10. Execute the msi file of the install bundle
FileAgent-<version>.msi
Example:
FileAgent-4.2.11-0030.msi
11. Once the setup script has completed the agent is installed and policy will be downloaded from MDE and will be in effect.
IBM Multi-Cloud Data Encryption Administrator Guide 81
Appendix IV: Sample Conversion of Client Private
Key and Client Certificate into a PKCS12 File
Use the following steps to combine the client private key and client certificate into a single PKCS12 (Public Key Cryptography Standard #12) file: openssl pkcs12 -export -out ppmclient.p12 -inkey client_key.pem -in client_cert.pem -name ppmclient keytool -v -list -keystore ppmclient.p12 -storetype pkcs12
IBM Multi-Cloud Data Encryption Administrator Guide 82
Appendix V: Do’s and Don’ts
Changing Assigned Keys
Overview
I have data within a protected directory and I want to modify the key associated with that directory.
Background
Data within a directory is encrypted with the key defined at time of data creation (or movement into that directory). Changing a policy key does not migrate the preexisting data to the new key.
When a policy has been applied to an agent and is active, it is potentially very dangerous to modify the key values of the protected directories. While not strictly forbidden, modifying a key value can lead to loss of data.
Do
If the administrator wishes to migrate an entire directory from one key to another key, the data would first have to be moved out of that directory. Once the directory is empty, the key value associated via policy can be changed and applied. Then the data can be moved back into that directory and the data will be encrypted with the new key.
Don’t
Don’t modify the key value associated to the policy and activate the policy without first migrating the data out of the directory. If the best practice methodology is not followed than the data originally present in the directory will continue to be encrypted with the original key. Once modifying policy to a new key, the data will become inaccessible. Furthermore, if the original key is rotated, the data will be permanently inaccessible as there would be no way to modify policy back to the original key value.
Rotating Keys with Encrypted Backups
Overview
I want to backup data from a protected directory.
IBM Multi-Cloud Data Encryption Administrator Guide 83
Background
Backup up data in its encrypted format ties that data to the key value at time of backup. If the key is rotated after the backup operation is performed, it cannot be properly restored.
Keys should be associated with a protected location, not data. This will prevent unintentional data access problems on a restore.
Do
Data within a directory is encrypted with the key defined at time of data creation (or movement into that directory). To backup data it is best to copy it out of the protected directory and into unprotected space prior to (or during) the backup process. Copying the data out of the protected directory will decrypt the data. The backup location can be a separate protected directory, so the data could only be unprotected during the backup operation.
Don’t
Copy the protected directory in its encrypted form (e.g. a disk image or VM snapshot). If this is done, the data could become inaccessible once the original key is rotated.
IBM Multi-Cloud Data Encryption Administrator Guide 84
Appendix VI: Glossary
Term
Agent
Auto-Generated Keys
Cloud Auditing Data Federation
(CADF)
Comma Event Format (CEF)
Comma Separated Value (CSV)
Coordinated Universal Time (UTC)
Cryptographic Access Controls
Directory Lightweight Access
Protocol (LDAP)
Domain Name (DN)
Domain Name Service (DNS)
Dynamic Host Configuration Protocol
(DHCP)
File Agent
Graphical User Interface (GUI)
High Availability (HA)
Definition
A managed application server running Security
First encryption and access control software.
Policy Enforcement Keys created and managed by
MDE. These are indicated during policy creation by the ${autgen} label.
A common event record type that is forwarded to a
Security Information and Event Management
(SIEM) system.
A common event record type that is forwarded to a
Security Information and Event Management
(SIEM) system.
A data format that uses comma as a field delimiter and a return as a record delimiter.
The primary time standard by which the world regulates clocks and time.
The ability to separate user access by leveraging different encryption material.
An open, vendor neutral, industry standard protocol for accessing and maintaining distributed directory information over a network. A software protocol for enabling anyone to locate organizations, individuals and other resources such as files and devices in a network.
An internet resource name that is universally unique and linked to IP destination information
An Internet Service that translates domain names into IP addresses.
A client/server protocol that automatically provides an Internet Protocol (IP) host with its IP address and other related configuration information such as the subnet mask and default gateway.
A file agent enforces file based operational access policy definitions and association of one or more protected file paths. Each protected file path can have its own operational and cryptographic access control.
A type of user interface that allows users to interact with MDE through graphical icons as opposed to text-based interfaces and typed commands
System operations continue even if components fail because of redundancy (redundant power
IBM Multi-Cloud Data Encryption Administrator Guide 85
Term
Hybrid Agent
Hypertext Transfer Protocol (HTTP)
Hypervisor
Key Rotation
Key Revocation
Key Shredding
Keystore
Network Time Protocol (NTP)
Open Virtualization Archive (OVA)
PEM
Protected
Role Based Access Control (RBAC)
Secure Socket Shell (SSH)
Definition supplies, CPUs, drives, software, etc.)
A hybrid agent leverages the volume policy protection of a volume agent and allows for file based operational access control policies to be applied and enforced for one or more protected file paths.
An application protocol that is the foundation of data communications for the World Wide Web.
Also called Virtual Machine Monitor. A hypervisor or virtual machine monitor (VMM) is a piece of computer software, firmware or hardware that creates, runs and manages virtual machines. A computer on which a hypervisor runs one or more virtual machines is called a host machine; and each virtual machine is called a guest machine.
The VMware Hypervisor is also called an ESXi
Host.
The migration of policy enforcement keys within an agent environment resulting in no user-visible change to data access.
The removal of policy enforcement keys from an agent environment resulting in recoverable cryptographic data access restriction. This action makes the data temporarily unreadable.
The removal of policy enforcement keys from an agent environment resulting in an unrecoverable cryptographic data access restriction. This action makes the data permanently unreadable.
The configured storage location of policy enforcement keys.
A networking protocol for clock synchronization between computer systems.
A tar archive file. It is all the OVF files zipped and or compressed into a single file.
A widely used encoding format for security certificates with syntax and content defined by
X.509 v3 standards.
Any data that has been processed.
A method of regulating access to computer or network resources based on the roles of individual users within an enterprise. In this context, access is the ability of an individual user to perform a specific task, such as view, create, or modify a file.
A network protocol that provides administrators with a secure way to access a remote computer.
IBM Multi-Cloud Data Encryption Administrator Guide 86
Term
Selector
Share
Unique Identifier (UUID)
Virtual Machine (VM)
Virtual Router Redundancy Protocol
(VRRP)
Volume Agent
Definition
SSH also refers to the suite of utilities that implement the protocol.
OS defined users and groups that can access data, pathsets, and other policy related features.
Location on the operating system pointing to storage on drives, which could be RAID storage,
JBOD, or a single drive.
Universally Unique Identifier (UUID) is an identifier standard used in software construction. A UUID
(128-bit number) is used to uniquely identify some object or entity on the internet.
An emulation of a computer system that is based on the computer architecture and functions of a real or hypothetical computer.
A computer networking protocol that provides for automatic assignment of available Internet
Protocol (IP) routers to participating hosts. This increases the availability and reliability of routing paths via automatic default gateway selections o an IP subnetwork.
A volume agent enforces the volume policy definition and association of one or more protected volumes.
IBM Multi-Cloud Data Encryption Administrator Guide 87
Notices
This information was developed for products and services offered in the U.S.A.
This material may be available from IBM in other languages. However, you may be required to own a copy of the product or product version in that language in order to access it.
IBM may not offer the products, services, or features discussed in this document in other countries. Consult your local IBM representative for information on the products and services currently available in your area. Any reference to an IBM product, program, or service is not intended to state or imply that only that IBM product, program, or service may be used. Any functionally equivalent product, program, or service that does not infringe any IBM intellectual property right may be used instead. However, it is the user's responsibility to evaluate and verify the operation of any non-IBM product, program, or service.
IBM may have patents or pending patent applications covering subject matter described in this document. The furnishing of this document does not give you any license to these patents. You can send license inquiries, in writing, to:
IBM Director of Licensing
IBM Corporation
North Castle Drive
Armonk, NY 10504-1785 U.S.A.
The following paragraph does not apply to the United Kingdom or any other country where such provisions are inconsistent with local law:
INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT
WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Some states do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement may not apply to you.
This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice.
Any references in this information to non-IBM Web sites are provided for convenience only and do not in any manner serve as an endorsement of those Web sites. The materials at those Web sites are not part of the materials for this IBM product and use of those Web sites is at your own risk.
IBM may use or distribute any of the information you supply in any way it believes appropriate without incurring any obligation to you. Licensees of this program who wish to have information about it for the purpose of enabling:
(i) the exchange of information between independently created programs and other programs (including this one) and (ii) the mutual use of the information which has been exchanged, should contact:
IBM Director of Licensing
IBM Corporation
North Castle Drive, MD-NC119
Armonk, NY 10504-1785 U.S.A.
Such information may be available, subject to appropriate terms and conditions, including in some cases, payment of a fee.
The licensed program described in this information and all licensed material available for it are provided by IBM under terms of the IBM Customer Agreement, IBM International Program License Agreement, or any equivalent agreement between us.
Information concerning non-IBM products was obtained from the suppliers of those products, their published announcements or other publicly available sources. IBM has not tested those products and cannot confirm the accuracy of performance, compatibility or any other claims related to non-IBM products. Questions on the capabilities of non-IBM products should be addressed to the suppliers of those products.
All statements regarding IBM's future direction or intent are subject to change or withdrawal without notice, and represent goals and objectives only.
This information contains examples of data and reports used in daily business operations. To illustrate them as completely as possible, the examples include the names of individuals, companies, brands, and products. All of these names are fictitious and any similarity to the names and addresses used by an actual business enterprise is entirely coincidental.
COPYRIGHT LICENSE:
This information contains sample application programs in source language, which illustrate programming techniques on various operating platforms. You may copy, modify, and distribute these sample programs in any form without payment to IBM, for the purposes of developing, using, marketing or distributing application programs conforming to the application programming interface for the operating platform for which the sample programs are written. These examples have not been thoroughly tested under all conditions. IBM, therefore, cannot guarantee or imply reliability, serviceability, or function of these programs. The sample programs are provided "AS IS", without warranty of any kind. IBM shall not be liable for any damages arising out of your use of the sample programs. Depending on how you are viewing this information, some images and illustrations may not appear.
Trademarks
SPx and Security First Corp are trademarks or registered marks of Security First Corp., registered in many jurisdictions worldwide. Other products and services may be trademarks of Security First Corp. or other companies.
IBM, the IBM logo, and ibm.com® are trademarks or registered marks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the web at "Copyright and trademark information" at: http://www.ibm.com/legal/copytrade.shtml
.
Adobe, the Adobe logo, PostScript, and the PostScript logo are either registered trademarks or trademarks of
Adobe Systems Incorporated in the United States, and/or other countries.
The Apache Software Foundation (ASF) owns all Apache-related trademarks, service marks, and graphic logos on behalf of our Apache project communities, and the names of all Apache projects are trademarks of the ASF.
Node.JS is a registered trademark of Joyent, Inc. CORPORATION DELAWARE 345 California Street; Suite 2000
San Francisco CALIFORNIA 94104.
Unicode and the Unicode Logo are registered trademarks of Unicode, Inc. in the U.S. and other countries.
The CentOS Marks are trademarks of Red Hat, Inc. (“Red Hat”).
“Red Hat,” Red Hat Linux, the Red Hat “Shadowman” logo, and the products listed are trademarks or registered trademarks of Red Hat, Inc. in the US and other countries.
Linux is a registered trademark of Linus Torvalds in the United States, other countries, or both.
Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft Corporation in the United
States, other countries, or both.
Java and all Java-based trademarks and logos are trademarks or registered trademarks of Oracle and/or its affiliates.
Terms and conditions for product documentation
Permissions for the use of these publications are granted subject to the following terms and conditions:
Applicability: These terms and conditions are in addition to any terms of use for the IBM website.
Personal use: You may reproduce these publications for your personal, noncommercial use provided that all proprietary notices are preserved. You may not distribute, display or make derivative work of these publications, or any portion thereof, without the express consent of IBM.
Commercial use: You may reproduce, distribute and display these publications solely within your enterprise provided that all proprietary notices are preserved. You may not make derivative works of these publications, or reproduce, distribute or display these publications or any portion thereof outside your enterprise, without the express consent of IBM.
Rights: Except as expressly granted in this permission, no other permissions, licenses or rights are granted, either express or implied, to the publications or any information, data, software or other intellectual property contained therein. IBM reserves the right to withdraw the permissions granted herein whenever, in its discretion, the use of the publications is detrimental to its interest or, as determined by IBM, the above instructions are not being properly followed. You may not download, export or re-export this information except in full compliance with all applicable laws and regulations, including all United States export laws and regulations.
IBM MAKES NO GUARANTEE ABOUT THE CONTENT OF THESE PUBLICATIONS. THE PUBLICATIONS ARE
PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING
BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, NON-INFRINGEMENT, AND FITNESS
FOR A PARTICULAR PURPOSE.
Privacy policy considerations
IBM Software products, including software as a service solutions, (“Software Offerings”) may use cookies or other technologies to collect product usage information, to help improve the end user experience, to tailor interactions with the end user, or for other purposes. In many cases no personally identifiable information is collected by the
Software Offerings. Some of our Software Offerings can help enable you to collect personally identifiable information. If this Software Offering uses cookies to collect personally identifiable information, specific information about this offering’s use of cookies is set forth below. This Software Offering does not use cookies or other technologies to collect personally identifiable information.
If the configurations deployed for this Software Offering provide you as customer the ability to collect personally identifiable information from end users via cookies and other technologies, you should seek your own legal advice about any laws applicable to such data collection, including any requirements for notice and consent.
For more information about the use of various technologies, including cookies, for these purposes, see IBM’s
Privacy Policy at http://www.ibm.com/privacy and IBM’s Online Privacy Statement at http://www.ibm.com/privacy/details the section entitled “Cookies, Web Beacons and Other Technologies” and the
“IBM Software Products and Software-as-a-Service Privacy Statement” at http://www.ibm.com/software/info/product-privacy .
Product Number: 5737-C67
Printed in the USA
Завантажити
Публічне посилання оновлено
Публічне посилання на ваш чат було оновлено. You may view and manage your chat links after registration here.
Публічне посилання на документ
Реклама