book

Deployment Guide for InfoSphere Guardium

by Whei-Jen Chen, Boaz Barkai, Joe M DiPietro, Vladislav Langman, Daniel Perlov, Roy Riah, Yosef Rozenblit, Abdiel Santos

March 2014

Intermediate to advanced

472 pages

9h 39m

English

IBM Redbooks

Read now

Unlock full access

Trademarks
AuthorsNow you can become a published author, too!Comments welcomeStay connected to IBM Redbooks
1.1 Introduction to regulation compliance and auditing requirement1.2 Database security and lifecycle1.3 Architecture and functional characteristics1.3.1 Product architecture components1.3.2 Product functionality1.3.3 Product architecture options1.3.4 S-TAP architecture options1.4 Integration with IT infrastructure1.5 Supported platforms
2.1 Knowing product deployment types2.2 Sizing and topology considerations2.2.1 Audit level2.2.2 Database to collector sizing2.2.3 Collector to aggregator ratio2.2.4 Central Manager ratio2.3 Contingency and design considerations2.3.1 Appliance location2.3.2 Appliance configuration options2.3.3 S-TAP agent contingency and configuration2.4 Implementation approach2.5 Implementation schedule2.6 Roles and responsibilities2.7 Installation and configuration sessions2.8 Future growth considerations
3.1 Schedule of Implementation activities3.2 Installation and configuration planning3.3 Guardium appliance overview3.3.1 Hardware and software appliance modes3.3.2 Appliance types3.4 Database and appliance inventory3.4.1 Database inventory3.4.2 Collector sizing3.4.3 Aggregator sizing3.5 Appliance deployment considerations3.5.1 Managed or stand-alone environment3.5.2 Contingency3.5.3 Networking3.5.4 Other allocation factors3.5.5 Start with a test environment3.5.6 Licensing3.6 Appliance installation and configuration3.6.1 Rack or build appliance3.6.2 Configuring the appliance3.7 Agent deployment, installation, and configuration3.7.1 Guardium installation manager3.7.2 S-TAP3.7.3 Command-line options3.7.4 S-TAP and its inspection engine configuration3.7.5 More information3.8 Configure remaining appliances3.8.1 Managed units grouping3.8.2 Creating a group3.9 Guardium operations3.9.1 Configuration3.9.2 Transferring configuration to managed units3.9.3 Data management3.9.4 System backup3.9.5 Aggregation3.9.6 Job schedules3.9.7 Enterprise systems interface configuration3.9.8 Self-monitoring3.10 Vulnerability assessment3.10.1 Creating a database account3.10.2 Creating a data source3.10.3 VA tests3.10.4 Creating an assessment3.10.5 Custom reports3.10.6 Scheduling an assessment3.10.7 More information3.10.8 High-level steps summary3.11 Where to find more help3.11.1 Product documentation3.11.2 Release notifications and bulletins3.11.3 Product support3.11.4 User community and support
4.1 Regulations and compliance4.2 Auditing categories4.2.1 Privilege user monitoring4.2.2 Sensitive object monitoring4.2.3 Comprehensive monitoring4.3 Auditing requirements4.4 Database activity monitoring4.5 Vulnerability assessment4.6 Mapping audit requirements to the solution4.6.1 Requirement 2: Do not use vendor-supplied defaults for system passwords4.6.2 Requirement 3: Protect stored cardholder data4.6.3 Requirement 6: Identify systems missing patches and enforce change controls4.6.4 Requirement 7: Compensating control for network segmentation4.6.5 Requirement 8: Assign a unique ID for each person with a computer access4.6.6 Requirement 10: Track and monitor all access to cardholder data4.6.7 Requirement 11: Regularly test systems4.6.8 SOX requirement: Prevent unauthorized changes to the financial CRM, ERP, and HR data
5.1 Monitoring setup overview5.2 Monitoring planning5.3 Grouping5.3.1 Wildcards5.3.2 Hierarchical groups5.3.3 Group deletion5.3.4 Public versus private groups5.3.5 Groups in federated environment5.3.6 Size and performance effect5.4 Policy5.4.1 Policy types and policy rules5.4.2 Logging granularity5.4.3 Generating real-time alerts with policy5.4.4 Extrusion rules5.4.5 Database exceptions5.4.6 Policy for z/OS5.4.7 Policy installation5.5 Reports5.5.1 Reports versus queries5.5.2 Domain, entities, and attributes5.5.3 Query conditions5.6 Compliance workflow5.7 Real-time and threshold alerting5.7.1 Alert generating5.7.2 Alerter5.8 Data level access control5.8.1 S-TAP setup5.8.2 Policy setup5.8.3 Policy violation report5.9 Vulnerability assessment setup5.10 Configuration audit system setup5.10.1 Prerequisites5.10.2 High-level steps5.10.3 Installation and configuration5.10.4 Reviewing results5.10.5 Next steps5.11 Entitlement reporting setup5.11.1 Prerequisites5.11.2 High-level steps5.11.3 Configuration steps5.11.4 Review the entitlement data5.12 Database auto-discovery setup5.12.1 Prerequisites5.12.2 High-level steps5.12.3 Configuration steps5.12.4 Viewing the results5.12.5 Next steps5.13 Sensitive data finder setup5.13.1 Use cases and highlights5.13.2 Prerequisites5.13.3 High-level steps5.13.4 Configuration steps5.13.5 Viewing classification process results5.13.6 Next steps5.14 Adding a menu tab to your portal
6.1 Access management overview6.1.1 Roles, portals, applications, and users6.1.2 Managed configuration6.1.3 Authorization versus authentication6.1.4 Data-level security6.2 User accounts6.2.1 Creating a user account manually6.2.2 Importing user accounts from LDAP6.2.3 Modifying a userâ€™s role6.3 User role browser6.3.1 Custom role6.3.2 Adding a role
7.1 Performance optimization and tuning7.1.1 S-TAP optimization and tuning7.1.2 Inspection Core performance and unit usage7.1.3 Interactive reports7.1.4 Audit process reports7.1.5 Back up and purge7.1.6 Central management7.2 Maintenance and updates7.2.1 Appliance updates7.3 Diagnostic tools7.3.1 Appliance diagnostic tools7.3.2 Agents diagnostic tests7.4 Restoring audit data for forensic analysis7.4.1 Restore strategies7.4.2 Restore audit process result sets

8.1 Overview8.1.1 System backup and restore8.1.2 Data archive and restore8.1.3 Storage location8.2 Appliance recovery8.3 Appliance recovery steps8.3.1 Stand-alone collector8.3.2 Collector with Aggregator no CM8.3.3 Aggregator: Not centrally managed8.3.4 Centrally managed collector8.3.5 Centrally managed aggregator8.3.6 Dedicated central manager (no data aggregation)
9.1 Content delivery for 32-bit and 64-bit systems9.2 Compatibility considerations for 32-bit versus 64-bit systems9.2.1 Central management9.2.2 Aggregation9.2.3 Central management and aggregation combo appliances9.3 RAM memory considerations9.4 Enterprise upgrade strategy9.4.1 Change control management9.4.2 Top-to-bottom rollout order9.4.3 Strategies9.4.4 Enterprise upgrade summary9.5 Appliance upgrade methods9.5.1 Resource download locator9.5.2 Upgrading appliances by using V8.2 to V9.0p50 upgrade bundle9.5.3 Rebuilding appliances with V9.1p100 (64-bit) ISO image and restoring the V8.2 or V9.0 backup9.5.4 Building new separate V9.1p100(64-bit) appliances and gradually retiring the old ones9.6 Agents upgrade methods9.6.1 GIM upgrades9.6.2 UNIX S-TAP upgrade9.6.3 Windows S-TAP upgrade9.7 Upgrading bundle monitoring and status validation9.7.1 Health check monitoring9.7.2 Upgrade process monitoring9.7.3 Troubleshooting upgrade issues
10.1 Creating an integrated change management report10.1.1 Importing change tickets with Enterprise Integrator10.1.2 Uploading the data from the external table10.1.3 Defining the custom domain10.1.4 Defining custom query with new external domain entities10.1.5 Customizing the reports10.2 Connection profiling and security best practices
11.1 Security and audit11.1.1 BigInsights integration11.2 Databases and data warehouses11.2.1 Basic database activity monitoring11.2.2 Advanced database activity monitoring11.2.3 Basic vulnerability assessment11.2.4 Advanced vulnerability assessment11.3 Data lifecycle management integration11.3.1 Identifying archive candidates11.3.2 Auditing archive access11.3.3 Test data management integration11.3.4 Exchanging the sensitive information location with InfoSphere Discovery11.4 Identifying the user activity11.4.1 Custom identification procedures11.4.2 GuardAppEvents and GuardAppUser11.4.3 Setting client user ID11.4.4 WebSphere application user information11.4.5 CICS application user11.4.6 InfoSphere MDM and Data Stage application user11.4.7 Cognos application user11.5 Security integration11.5.1 Guardium and QRadar integration11.5.2 Tivoli Netcool11.5.3 IBM Security Access Manager for enterprise single sign-on11.5.4 Tivoli Directory: Lightweight Directory Access Protocol11.5.5 IBM Endpoint Manager and Guardium Integration11.5.6 Tivoli Storage Manager and Guardium Integration
Online resourcesHelp from IBM

Content preview from Deployment Guide for InfoSphere Guardium

Related publications

The publications that are listed in this section are considered particularly suitable for a more detailed discussion of the topics that are covered in this book.

Online resources

The following websites also are relevant as further information sources:

•IBM InfoSphere Guardium V9.1 Information Center:

http://pic.dhe.ibm.com/infocenter/igsec/v1/index.jsp

•Processor Value Unit [PVU] licensing for Distributed Software:

http://www-01.ibm.com/software/lotus/passportadvantage/pvu_licensing_for_customers.html

Help from IBM

IBM Support and downloads:

http://www.ibm.com/support

IBM Global Services:

http://www.ibm.com/services

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Start your free trial

IBM QRadar Version 7.3 Planning and Installation Guide

Elias Carabaguiaz, Fabian Alfaro, Francisco Villalobos, Jeffry Arias, Kenneth Gonzalez, Warren Perez

Proactive EarlyThreat Detection and Securing Oracle Database with IBM QRadar, IBM Security Guardium Data Protection, and IBM Copy Services Manager by using IBM FlashSystem Safeguarded Copy

Shashank Shingornikar, Raninder Ravi Bhandari

IBM Cloud Pak for Data

Hemanth Manda, Sriram Srinivasan, Deepak Rangarao

Proactive Early Threat Detection and Securing Oracle Database with IBM QRadar, IBM Security Guardium Database Protection, and IBM Copy Services Manager by using IBM FlashSystem Safeguarded Copy

Shashank Shingornikar, Raninder Ravi Bhandari

Publisher Resources

ISBN: 0738439355Purchase book