PowerSC Compliance/Monitoring and Pass-through Authentication with ISDS & MSAD

Stephen Dominguez, World Wide AIX and Linux Security Technical Lead – IBM Lab Services – sdoming@us.ibm.com - http://www.securitysteve.net - @Secur1tySteve

July 30th 2015

AIX VUG Webinar – AIX Security

Who am I ?

Peyton Manning/Broncos fan and also love jazz

World-wide AIX and Linux on Power SecurityLead for IBM Lab Services

Worked with Power for 18 years, specifically security for 12

I've worked with around 300 corporate customers throughout the world

I have a security blog, www.securitysteve.net

Who am I ?

I have a security blog, www.securitysteve.net

You can follow me on twitter, @Secur1tySteve

IBM Lab Services is a cost center that works closely with IBM development to assist Power customers with their systems

To learn about all Lab Services' security services: www.securitysteve.net/consulting-services/

We have several flexible funding IBM programs available to provide security consulting services at no charge to eligible customers

If you'd like for me to setup a conference call so we can chat about security, shoot me an email at sdoming@us.ibm.com

Agenda Recent statistics on security breaches

PowerSC Security and Compliance Automation (pscxpert)

PowerSC Real Time Compliance (RTC)

Pass-through Authentication with IBM Security Directory Server and Microsoft Active Directory

Recent Statistics on Security Breaches

From the Ponemon Institute's “2015 Cost of Data Breach Study: Global Analysis”

My blog's “hacking and breaches” links section

http://map.norsecorp.com/

http://www.informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks/

Ponemon Institute's findings

350 companies surveyed from 11 different countries

Average cost of security breach of large company globally: 3.79 million

Average cost of security breach of large company in US: 6.5 million

Since 2013, the costs have risen globally by 23%

Since 2013, the costs have risen in the US by 11%

Average cost of stolen record in US is $217

Average cost of stolen record globally is $154

The cost of simply investigating a breach is $1 million globally

Ponemon Institute's findings

CEO Jamie Dimon personally informed shareholders following theJPMorgan Chase data breach that by the end of 2014 the bank willinvest $250 million and have a staff of 1,000 committed to IT security.

Ponemon indicated the 3 major reasons for higher breach costs:1) Cyber attacks have increased in frequency and in the cost to remediate the consequences2) The consequences of lost business are having a greater impact on the cost of data breach 3) Data breach costs associated with detection and escalation increased

Hackers or criminal insiders(employees, contractors or other 3rd parties) cause most data breaches 47%

Time to identify and contain a data breach affects cost

Average time to identify breach was 206 days, with range of 20 to 582

Average time to contain breach was 69 days, with a range of 7 to 175

PowerSC Security and Compliance Automation

Using the pscxpert command for security hardening

What is Security and Compliance Automation Deploys security controls on AIX and VIOS partitions according to 4

regulatory security standards

Helps customers deploy regulatory-based controls to help their generalAIX and VIOS systems meet compliance standards

It is a system security hardening tool

The command used pscxpert (replacing aixpert)

4 Security Standards & 1 database profile

Payment Card Industry Data Security Standard v 3.0 (PCI-DSS)

Sarbanes-Oxley Act and Cobit Compliance (SOX/COBIT)

US Dept. of Defense Security Technical Implementation Guide (DoD-STIG)

Health Insurance Portability and Accountability Act (HIPAA)

Database.xml (general purpose)

System Requirements?

3 PowerSC Managed System Types

AIX 6 TL 7 and greater

AIX 7 TL 1 and greater

VIOS 2.2.1.0 and greater

16

pscxpert

AIX System Security Hardening Tool

Single consistent view to all security configurations

Brings 300+ Security Settings to Central Control

Easy to implement – can choose desired security level

− Low, Medium, High, PCI, HIPAA, DOD, SOX-COBIT

Provides compliance check and undo option

Easy to distribute to other systems

Network

File PermissionsServices

Firewall Users & Groups

pscxpert

17

How pscxpert implements security policy

Policy Requirements:

Minimum length of password to be 8 characters

Change user password every 90 days

Disable vulnerable services – FTP, Telnet

Enable auditing

XML ProfileFile

LPAR 1 LPAR 2 LPAR N

pscxpert

How are the security controls deployed?

# pscxpert -f /etc/security/aixpert/custom/DataBase.xml -pProcessing prereqbinaudit :cachedProcessing prereqcde :cachedProcessing prereqgated :cachedProcessing prereqipsec :cached.....Processing db_minage .....:done.Processing db_maxage .....:done.Processing db_maxexpired .....:done.Processing db_minlen .....:done.Processing db_minalpha .....:done.Processing db_minother .....:done....Processing db_SecurityPatches

***************************************************************************************************************

The Operating System should be patched regularly to minimise exposure to security vulnerabilities. Consider using Power SC Trusted Network Connect for Patch Management to keep the systems updated

****************************************************************************************************************

:done.Processedrules=83 Passedrules=82 Failedrules=1 Level=DB Input file=/etc/security/aixpert/custom/DataBase.xml

pscxpert –f <profile_name>

Before and after

# lsuser -f rootroot: id=0 pgrp=system .... login=true su=true rlogin=true ..... logintimes= loginretries=0 pwdwarntime=0 account_locked=false minage=0 maxage=0 maxexpired=-1 minalpha=0 minloweralpha=0 minupperalpha=0 minother=0 mindigit=0 minspecialchar=0 mindiff=0 maxrepeats=8 minlen=0 histexpire=0 histsize=0 pwdchecks= dictionlist= .......

# lsuser -f rootroot: id=0 pgrp=system .... login=true su=true rlogin=false .... logintimes= loginretries=0 pwdwarntime=0 account_locked=false minage=0 maxage=13 maxexpired=8 minalpha=1 minloweralpha=0 minupperalpha=0 minother=1 mindigit=0 minspecialchar=0 mindiff=0 maxrepeats=8 minlen=7 histexpire=52 histsize=4 pwdchecks= dictionlist=/etc/security/aixpert/ dictionary/English .......

User attributes before applying the profile

User attributes after applying the profile

20

pscxpert – compliance check

Reports compliance violation

# pscxpert –c# cat /etc/security/aixpert/check_report.txt***** famsdev : Jun 22 14:49:35 ******

chusrattr.sh: User attribute maxage, should have value 13, but it is 0 nowchusrattr.sh: User attribute maxexpired, should have value 8, but it is -1 nowchusrattr.sh: User attribute minlen, should have value 7, but it is 0 nowchusrattr.sh: User attribute minalpha, should have value 1, but it is 0 nowchusrattr.sh: User attribute minother, should have value 1, but it is 0 nowchusrattr.sh: User attribute histexpire, should have value 52, but it is 0 nowchusrattr.sh: User attribute histsize, should have value 4, but it is 0 nowchusrattr.sh: User attribute loginretries, should have value 6, but it is 0 nowchdefstanza.sh: User attribute logindisable, should have value 6, but it is 0 nowchdefstanza.sh: User attribute loginreenable, should have value 30, but it is 0 nowchuserstanza.sh: User attribute rlogin in stanza root, should have value false, but its value is NULL nowcomntrows.sh: Daemon/Script/String:lpd: should have status disabled, however its entry is not found in file /etc/inittabcomntrows.sh: Daemon/Script/String:dt: should have status disabled, however its entry is not found in file /etc/inittabcominetdconf.sh: Service ftp using protocol tcp should be disabled, however it is enabled now

Incompliance reported

Easy to implement periodical compliance check via crontab or PowerSC RTC

21

Generating a compliance audit report

Compatibility check without applying the profile

The –P flag accepts profile name as input:

pscxpert –c –P <profile name>

# pscxpert -c -P /etc/security/aixpert/custom/PCI.xml -pProcessing pci_minage :done.Processing pci_maxage : failed.Processing pci_maxexpired : failed.Processing pci_minl en : failed.Processing pci_minalpha : failed.Processing pci_minother : failed.Processing pci_maxrepeats :done.Processing pci_histexpire : failed.Processing pci_histsize : failed.Processing pci_loginretries : failed.Processing pci_logindisable : failed.Processing pci_loginreenable : failed.Processing pci_rootrlogin : failed.Processing pci_rootlogin :done.……………………………………………....:done.Processedrules=82 Passedrules=43 Failedrules=39 Level=PLS Input file=/etc/security/aixpert/custom/PCI.xml

Compatibility check is a game changer

Allows you to identify what controls have a high probability of immediately integrating to your system

Controls that fail the compatibility check are what you need toresearch

The compatibility feature allows you to detect what your existinghardening tooling is NOT doing

One integration possibility is deploying the security controls notbeing deployed by your existing tooling

This and the audit report feature are fantastic features only availablewith the PowerSC pscxpert command

pscxpert – Customization Feature

Modify existing security rules to meet your compliance requirements

Create new custom rules according to your security policy

Create compliance check for periodical compliance verification

Create rules to automate day to day administrative tasks

Create readily deployable security profiles to meet compliance requirements of security standards like PCI DSS, HIPAA, SOX-COBIT etc

Creating new rules

pscxpert provides a framework to integrate user define scripts tocreate new rules

Example:

− Create rules to implement password policy

− Create rules to implement login settings

− Create rules to disable services that should be disabled

− Create rules to enable auditing and logging

− Create rules to implement security features like RBAC, EFS, Trusted Execution

− Create rules to enforce network security

− Create rules to secure SSH server configuration

− Create rules to set file permissions

Beyond security – administrative tasks

In addition to security rules, pscxpert customization feature can be used to automate other administrative tasks

Example:

− LDAP setup

− Set and verify permissions and ownership of system files

− Implement PowerSC features

− Network tuning

Security and Compliance Automation Summary

Helps companies with meeting compliance

Helps companies verify the hardening has stayed applied

Single tool for hardening AIX & VIOS

Provides framework to define your own security rules

Automation saves time and effort

Best paired with PowerSC RTC, to receive alerts concerning policy violations

Security and Compliance Automation Summary

Helps companies with meeting compliance

Helps companies verify the hardening has stayed applied

Single tool for hardening AIX & VIOS

Provides framework to define your own security rules

Automation saves time and effort

Best paired with PowerSC RTC, to receive alerts concerning policy violations

PowerSC Real Time Compliance

Monitoring file content, file access and security policy changes in real time

WHY RTC?

RTC is different from typical security monitoring applications

It registers files with the operating system using AHAFS, Autonomic Health Advisory File System

AHAFS is a pseudo file system implemented as an AIX kernel extension

AHAFS will in turn will notify rtcd when one of the registered files changes

This saves on computing cycles and allows immediate real time notification.

Communication of messages Standard emails can be sent using sendmail

An alternative method is using SNMP

Local Logging of messages

Email message of content change

Email message of access change

Content change resulting in security policy violation

Monitoring details By default, approximately 280 files are monitored

You can customize the set of monitored files

Attributes Monitoring triggers an alert when the access to a file changes

Content Monitoring triggers an alert when the contents of a file changes

Requirements

For AIX 6: bos.ahafs 6.1.7.0 or later

For AIX 7: bos.ahafs 7.1.1.0 or later

powerscExp.rtc

powerscExp.license

OPTIONAL: for automated compliance:powerscExp.ice

NOTE: all PowerSC filesets in PowerSC Express Ed.

39

SUMMARY PowerSC provides unique compliance and monitoring capabilities only

available with PowerSC

PowerSC – Security & Compliance Automation provides comprehensive security controls

PowerSC – RTC provides a sophisticated kernel-based tool for real time monitoring which dramatically enhances the capabilities of PowerSCSecurity & Automated Compliance

IBM Lab Services provides a 3 day workshop: pscxpert & RTC - install, configure and customize

Additional integration assistance services are available

40

PowerSC pricing by Edition and System Tier

PowerSC Standard Edition(PID 5765-PSE) is priced per-activated-core similar to the way PowerVM is priced, Pre-requisite PowerVM.

– Intended for hardening virtualization deployments on PowerVM

Power Systems Tiers PowerSC Standard Edition

Large $625+125

Medium $313+63

Small (includes Blades) $125+25

Pricing is per-activated-core license + SWMA after 1st Year (example shown is $US for NA region)

• PowerSC Trusted Surveyor(PID 5765-PTS) is priced per monitored HMC. $10,000 per HMC no tiering. Only one license is needed for dual-HMC configurations

Per Monitored Console PowerSC Trusted Surveyor

HMC $10,000+2,000 SWMA after 1st Year (example shown is $US for NA region)

41

PowerSC pricing for maximum POWER models

Pricing for Express is Capacity based pricing. Example above is for all cores.Pricing is per-activated-core license (example shown is $US for NA region)Standard Edition

TierPOWERModel Cores

PowerSC Standard

Large 795 256 $160,000

Medium 770 64 $20,032

Small 750 32 $4,000

Small S822 16 $2,000

Pass-through Authentication with IBM Security Directory Server and Microsoft Active DirectoryThe perfect general solution for centralized AIX user management

No ISDS licensing and support cost for AIX No cost --- $0

Use of ISDS for AIX authentication and identification is covered underyour AIX SWMA

This only applies to an LDAP client or LDAP server running on AIX with SWMA

If you have a technical issue, open and AIX ticket and it will be routedto Tivoli support

I have a US customer that has been happily using ISDS for several hundred AIX partitions for over 5 years

Why LDAP? - #1 make life easier

Why LDAP? #2 Improve security Separation of Duties

Reduce Shared Access

User auditing based on general user accounts

Promote integrity of security tooling

What is AIX Authentication?

When an AIX user accesses a system, his password is verified toauthenticate the userid to the system

What is AIX identification?

The list of user and group attributes on the system

AIX User Authentication & Identification

AIX’s LAM frameworkeg compat, nis, files, LDAP

AIX’s compound LAM frameworkeg LDAPAfiles, KRB5files, KRB5Afiles

What is files-based Security

User passwords (authentication) stored locally on each individual LPAR

User accounts (identification) stored locally on each individual LPAR

Decentralized[

Why LDAP is so important?

Centralized authentication – (authentication is the checking and updating of passwords)

Centralized identification – (identification determines the set of attributes that describe your users and groups)

Benefits of LDAP

Manage one password per user account

Allows applications to operate correctly that rely on user-identification in a distributed environment. For example, NFS

User creation only on one system vs. many

User deactivation only on one system vs. many

When using ITDS, user access can be specified on server for all AIX clients being accessed by user

What is LDAP Schema?

Controls how information is added to the Directory

There are 3 major types:

RFC2307AIX

RFC2307

IDMU

A major issue migrating to LDAP

File-based user accounts out of sync

LDAP servers export the same namespace to LDAP clients

LDAPAfiles is the solution

LDAPAfiles

Allows you to use LDAP only for authentication

You use this when your local account is completely out of sync with the user account on LDAP

You use the local account information

You can determine which users are LDAP users and LDAPAfiles users on a per system and per user basis. For example, LPAR_01 has 100 out 100 AIX general accounts using LDAP for authentication and identification, but on LPAR_02, 90 users are pure LDAP users and 10 users are LDAPAfiles.

Restricting system access

A typical LDAP client sees all users in your directory

Typical question is limiting a select users on a partition basis

Netgroups, host_allow_login, pam_modules possible

Most sophisticated method is “login tagging”

What is login tagging?

We tag a user's ldap account with various tags

The tags indicate what type of system access the user should have eg user, steve, could be tagged with “db2” and “nfs_server”, so steve should be able to login to db2 systems or nfs servers

The LDAP client system is configured to only see users with certain tags.

The LDAP client can define logical operations on login tags eg the client only sees users who are tagged either “db2” or “nfs_server” but never tagged “tnc server”

Lab Services provides a login tagging tool in our services that greatly simplifies this configuration and ongoing administration

LDAP Server Options

IBM’s Tivoli Directory Server

MSAD

Other RFC2307 servers

MSAD AIX User Attribute Administrative Interface

ISDS AIX User Attribute Administrative Interface

Additional Centralized Options only for ISDS

Enhanced RBAC policies

Security Expert Policies

Trusted Execution’s TSD Database

EFS

HMC RBAC roles

VIOS RBAC roles

HMC login

VIOS login

76

Why Should MSAD handle authentication?

99.9% of IBM customers using AIX use MSAD for their corporate Identity Management.

99.9% of IBM customers using AIX have a corporate MSAD-based password

Instead of having to remember a separate AIX/Unix/Linux password,use the existing MSAD corporate password for AIX/Unix/Linux authentication

77

Why Should ISDS handle Identification?

ISDS implements RFC2307AIX schema, which is the most compatible schema for AIX user management

Unlike MSAD, ISDS provides a graphical web-based administrativeinterface that can manage all the user attributes possible withRFC2307AIX Schema

In addition to AIX, ISDS can support your other UNIX/Linux operatingsystem LDAP clients

78

Who Benefits Using PTA?

Administrators needing access to their AIX/Unix/Linux systems

Application user community who needs to access an application that is running on AIX/Unix/Linux

Simple Topology

PTA features

Can support any level and any configuration of MSAD

No alteration of your existing MSAD environment

Uses SSL to encrypt for all communication

Provides the ability to use a Windows based password when loggingonto an AIX/UNIX/Linux partition

When an application server utilizes OS-based security, allows usersrunning application clients on any operating system to authenticate access to the application server using their MSAD-based password

Can eliminate recurring password resets for non-MSAD-based passwords

Any length of password and login name can be used on your AIXLDAP clients

The aix login username doesn't need to be identical to the MSAD login username

Allows you to utilize LDAPAfiles for accounts out of sync

81

PTA features continued

On a per AIX user basis, you may exclude a user from PTA authentication and use a separate password stored on ISDS

No Delay --- Passwords reset on Windows, will be immediatelyeffective on AIX systems

It is possible to map multiple AIX/UNIX/Linux login names to a singleMSAD password

On different AIX LDAP clients, it is possible to map the same loginname to different MSAD passwords

When using an MSAD trusted root certificate, high availability canbe provided to the PTA server, by pointing the ISDS server to theMSAD domain

Allows AIX administrators to update UNIX user/group attributes byleveraging the AIX standard command line interface without needingto access to the MSAD server

82

Lab Services PTA Consulting Services

3 week Identity Management consulting services

Knowledge transfer, SSL implementation, replication, upgradecomponents, web based administration tool, training in LDAP essential concepts, essential LDAP server administration, LDAP client functionality

Also provide assistance with integrating other UNIX/LINUX clients

Lab Services customers obtain a PTA mapping tool and also thelogin tagging tool only available via our consulting service

LDAP References

• Redbook: Integrating AIX into Heterogenous LDAP Environments

• AIX Knowledge Center

• IBM Security Directory Server Administration Guide

• I have an LDAP section of links on my links page on securitysteve.net

83

IBM Systems Lab Services & Training - Power SystemsServices for AIX, i5OS, and Linux on Power – PowerCare Eligible

http://www.ibm.com/systems/services/labservices/platforms/labservices_power.html RHEL Security Assessment

Terms and Conditions: Actual Tasks, Deliverables, Service Estimates,,and travel requirements vary with each client’s environment. When we have reached a final agreement on the scope of your initiative and our level of assistance, a formal document describing our proposed work effort, costs, etc, will be presented for your approval and signature.

Overview:As detailed in the Ponemon Institute's survey, “2015 Cost of Data Breach Study”, the average cost of a computer breach at a large company globally was $3.79 million. For U.S.-based companies, the average cost was much higher, 6.5 million. These costs have risen globally 23% since 2013. In the “2014 Global Report on the Cost of Cyber Crime”, the Ponemon Institute, a security research center, recommends that deployment of security intelligence systems and maintaining a strong security posture makes a difference and moderates the cost of cyber attacks.

IBM Lab Services is providing the following services to help you reduce your security risk and improve the security of your information assets. These services are being provided to help you deploy the type of security intelligence systems and achieve the strong security posture recommended by the Ponemon Institute.

The RHEL Security Assessment's goal is to identify effective security controls for your company to utilize which will significantly reduce your security risk.

This service is designed for IBM Power Systems customers. The security controls have been recommended for Red Hat Enterprise Linux by the United States NSA Information Assurance Directorate. The controls are primarily based on Red Hat and security community concesus-based recommendations.

Client Benefits• Helps achieve regulatory compliance, such PCI, HIPAA, etc• Helps improve RHEL security configurations and lower risk• Helps promote the adoption of the latest RHEL security solutions• Provides a baseline for defining standard RHEL image builds• Learn of hundreds of security controls to reduce security risk

Duration• Time varies depending on scope requested: 1-3 days on-site

Phase 1 – Preparation (remote):Conference calls are held prior to the service to validate the scope,

agenda, schedule and required materials. Client provides overview of their current RHEL security environment IBM team prepares the service agenda/schedule IBM team details security data collection process IBM team provides customer security questionnaire Identify required materials / Finalize key players

Phase 2 – RHEL Security Assessment (on-site):

Assessment Phase• Partition data is collected• Data is processed and assessment documents are created

Review Phase• Consultant holds a review of the results of the assessment with key

customer staff• Additional presentations may be provided on recommended security

solutions

Deliverables – Detailed RHEL Security Assessment Findings document, Heat Map, Executive Summary

References:NSA RHEL Guidelineshttps://www.nsa.gov/ia/mitigation_guidance/security_configuration_guides/operating_systems.shtml

Erin M. Hansen - PowerCare Opportunity Manager erinh@us.ibm.comLinda Hoben – Opportunity Manager hoben@us.ibm.com 1-720-395-0556Stephen Brandenburg – Opportunity Manager sbranden@us.ibm.com 1-301-240-2182

IBM Systems Lab Services & Training - Power SystemsServices for AIX, i5OS, and Linux on Power – PowerCare Eligible

86

Stephen Dominguez

www.securitysteve.net

If you'd like for me to setup a conference call so we can chat about security, shoot me an email at sdoming@us.ibm.com

Let’s Stay in Touch!