DbProtect Installation Guide - AppSecInc is now Trustwave

1 DbProtect Installation Guide Last Modified December 5, 2010. Application Security, Inc. 1-866-9 APPSEC. DbProtect Installation Guide Contents Introduction 4. About DbProtect : The Enterprise Solution for Database Security 4. Intended Audience 5. DbProtect Components 6. Networking, Port, and Firewall Considerations 9. Data Repository 11. Customer Support 12. Planning Your DbProtect Installation 13. DbProtect Installation Checklist 13. DbProtect Version Compatibility Matrix 14. Minimum System Requirements 17. DbProtect Suite System Requirements 17. Scan Engine System Requirements 18. Sensor System Requirements 20. Typical Deploymnet: Recommended System Requirements 70. Licensing 76. Installing the DbProtect Components 79. Installing the DbProtect Suite Components 79. Installing Scan Engines 87. Installing, Starting/Stopping, and Reconfiguring the Sensors 89.

2 Your Initial DbProtect Login 152. Logging In to the Console 152. DbProtect Console Login Troubleshooting 156. Application Security, Inc. 2. DbProtect Installation Guide Uninstalling the DbProtect Components 161. Uninstalling the DbProtect Suite Components 161. Uninstalling and Unregistering a Sensor 162. Uninstalling and Unregistering a Scan Engine 165. Installation Troubleshooting 167. Appendices 176. Appendix A: Installing/Uninstalling Sensors in a SQL Server Cluster 176. Appendix B: Installing and Configuring a Host-Based Sensor for Oracle to Monitor Oracle Databases on an Oracle RAC 187. Appendix C: Modifying the Sensor Listener Port Number 189. Appendix D: Network Ports Used by DbProtect 190. Appendix E: Working with Oracle DDL Triggers (for Host-Based Sensors for Oracle In- stalled on *nix Platforms Only) 191.

3 Appendix F: Modifying the "Log On As" User for the DbProtect Sensor and DbProtect Message Collector Services 195. Appendix G: DB2 Administrative Client Driver Installation 196. Appendix H: DbProtect Log Files 197. Appendix I: Using App DSN, the Repair ODBC Utility 205. Appendix J: Configuring Your Oracle Audit Trail in Order to Monitor Logins 207. Appendix K: Required Client Drivers for Audits 208. Appendix L: Required Audit Privileges 219. Appendix M: Auditing SQL Server (Using Windows Authentication) Against a Machine on a Different or Untrusted Domain 280. Appendix N: Troubleshooting the Java Run Time Environment (JRE) Security Settings on Internet Explorer 6 and 7 282. Appendix P: Monitoring Multiple Instances on a DB2 Server 286. Appendix Q: Monitoring Oracle Databases in an Oracle Fail Safe Environment: Sensor and Cluster Configuration Steps 287.

4 Appendix R: Configuring Your Host-Based Sensor (Installed on a *nix Platform) to Start Automatically Upon System Reboot 291. Appendix S: DbProtect Requirements for Sybase ASE 293. Application Security, Inc. 3. Chapter 1 Introduction About DbProtect : The Enterprise Solution for Database Security DbProtect is a database security, risk and compliance application designed to meet the needs of companies with large heterogeneous database environments. DbPro . tects's IT risk management framework, security controls, continuous controls moni . toring, and governance for databases make it the leading solution on the market today. DbProtect is a centrally managed enterprise solution that uses a proven methodology for information assurance. It is built on the industry's leading and most comprehen . sive database security knowledgebase called SHATTER which accurately identi.

5 Fies vulnerabilities, risks, and actual threats. DbProtect accomplishes the following to secure enterprise data: DISCOVERY Identifies and locatates all data . bases on a given system CLASSIFICATION Identifies risks to business and development policies ASSESSMENT Analyzes database structures for security risks, and determines what privi . leges have been assigned to users PRIORITIZATION Creates a plan to mitigate risks FIX Executes the plan and fixes the violations MONITORING Applies compensating controls where a fix cannot be applied The DbProtect platform protects enterprise organizations around the world from internal and external threats, while also ensuring that those organizations meet or exceed regulatory compliance requirements. At its core, DbProtect is built on tools devleoped from the SHATTER Knowledgebase, including: Asset Manage.

6 Ment; Policy Management; Vulnerability Management; Rights Management; Con . figuration & Patch Management; Audit & Threat Management; and Analytics & Reporting. Intended Audience This Guide is intended for persons responsible for day to day usage of DbProtect . Typically, those responsible for installing DbProtect maintain one of (or a combi . nation of) the following roles: System Administrators System Administrators maintain and operate a computer system and/or network. Their duties vary from one organization to another. System administrators are usually charged with installing, supporting, and maintaining servers or other computer systems, and planning for and responding to service outages and other problems. Other duties may include scripting or light programming, project man . agement for systems related projects, supervising or training computer operators, and handling computer problems beyond the knowledge of technical support staff.

7 Network Administrators Network Administrators are responsible for the maintenance of the computer hardware and software that comprises a network. This normally includes the deployment, configuration, maintenance and monitoring of active network equipment. Network administration commonly includes activities and tasks such as network address assignment, assignment of routing protocols and routing table configuration, as well as configuration of authentication and authorization . directory services. A network administrator's duties often also include mainte . nance of network facilities in individual machines, such as drivers and settings of 5 Application Security, Inc. Intended Audience personal computers, as well as printers and so on. Network administrators are also responsible for the security of the network and for assigning IP addresses to the devices connected to the networks.

8 Database Administrators Database Administrators (DBAs) are responsible for the environmental aspects of a database. In general, these include: Recoverability creating and testing backups Integrity verifying or helping to verify data integrity Security defining and/or implementing access controls to the data Availability ensuring maximum uptime Performance ensuring maximum performance Development and testing support helping programmers and engineers to efficiently utilize the database The role of a DBA has changed according to the technology of database management systems (DBMSs), as well as the needs of the database owners. Application Security, Inc. 6. DbProtect Components The following diagram illustrates how DbProtect components interact and shows which standard listening ports must be open in order for DbProtect to work.

9 Console The Console is the web browser based, graphical component of DbProtect that allows you to navigate to the various features of DbProtect . The DbProtect Console consists of the following components. DbProtect Setup: support files that enable DbProtect upgrades and removal. 7 Application Security, Inc. DbProtect Components DbProtect Enterprise Services Host: an application server that manages remote connections to the system and various services that perform DbProtect functions. DbProtect Console Management Server: the browser based graphical interface. DbProtect Enterprise Services: services that implement support for various features visible in the GUI. DbProtect Naming and Directory Service: a service locator directory. DbProtect Message Collector: a service that collects and stores alerts from sensors.

10 DbProtect Analytics: a service that performs reporting functions. DbProtect Analytics Content: a collection of reports and dashboards. DbProtect VA Policy Editor: vulnerability assessment policy editing module. DbProtect Documentation and Content: includes this Guide and other reference documentation. DbProtect Scan Engine Proxy: a load balancing service for Scan Engines. Scan Engines Scan Engines are network based services that discover database applications within your infrastructure and assess their security strength by running penetration tests, audits and user rights reviews. DbProtect Scan Engine consists of the following components. DbProtect Scan Engine Host: an application server that manages various services that connect to target databases. DbProtect Scan Engine: a service that performs database discovery and vulnerability assessment functions.