Nsure® Audit: What's New and Beyond

Dave Adamson

Product Manager

Novell, Inc.

What’s happening in my systems?

Securing Organizational Resources

Partners /

Suppliers

Employees

Administrator

Linux

Unix

Customers

NetWare®

2003/XP

Directories

Custom Applications

Desktop Systems

Business Applications

Email Servers

Web Servers

Customer Struggles Continue

Logging

Organizations are still struggling to effectively centralize logs across the organization at all levels.

Disparity of systems (desktop OS, server OS, business applications, etc.) make it difficult to provide effective coverage.

Log collection is non-uniform and unsecured.

Auditing

Due to unsecured, non-uniform, disparity of system coverage and the ability to correlate and simplify event data, identifying risks and demonstrating policy compliance is a challenge.

Notification and Real-Time Monitoring

Event notification and alerts are time-consuming to create and maintain due to disparate and diverse systems.

Reports

Once centralized, effective normalization, correlation and report writing is difficult to implement.

Logging

Mining Logged Data – I want to investigate occurrences that have gone on in my system because I discovered an employee with access to a resource he/she should not have had access to

Centralized Logging

DirXML

eDirectory

SAP

Lotus Notes

PeopleSoft

Honeywell

iChain

BorderManager

ZENworks

NetWare

Active Directory

NT/2000/XP

Web Servers

Siebel

Auditing

Compliance With Policies – I need to Audit my compliance with organizational policies and regulations

DirXML

eDirectory

SAP

Lotus Notes

PeopleSoft

Honeywell

iChain

BorderManager

ZENworks

NetWare

Active Directory

NT/2000/XP

Web Servers

Siebel

Auditing Reports

Centralized Logging

Notification

Who Has Access To What? – I want to know who has access to which company resources and when any access to resources changes

*CVR – Critical Value Reset

Email

SNMP

SYSLOG

CVR*

Storage

Java

Real-Time Notifications

Auditing Reports

Centralized Logging

DirXML

eDirectory

SAP

Lotus Notes

PeopleSoft

Honeywell

Web Servers

iChain

BorderManager

ZENworks

NetWare

Siebel

Active Directory

NT/2000/XP

ILLEGAL

Real-Time Monitors

Knowledge of Uncommon Occurrences – I want to know when unusual things occur in any of my systems

Real-Time Monitors

Real-Time Notifications

Auditing Reports

Centralized Logging

DirXML

eDirectory

SAP

Lotus Notes

PeopleSoft

Honeywell

Web Servers

iChain

BorderManager

ZENworks

NetWare

Siebel

Active Directory

NT/2000/XP

Reports

Resource Utilization – I want to know which resources are used the most frequently, when and by whom.

DirXML

eDirectory

SAP

Lotus Notes

PeopleSoft

Honeywell

Web Servers

iChain

ZENworks

NetWare

Siebel

Active Directory

NT/2000/XP

Summary Reports

Nsure Audit Today

Instrumented System: A physical computer where one or more applications are generating and sending (but never receiving) log events to the logging server. Can have one or more IP address and one or more processor.

Secure Logging Server: The central server where all log events are collected and acted upon

Secure Logging Server

Instrumented Systems

How is Nsure Audit unique?

Integration with Novell products

As Novell’s official audit product, Nsure Audit collects events from the broadest set of Novell products (and the list is growing…)

Data integrity and security

Event signing and event chaining protect the integrity of logged data, making it forensically robust (non-repudiative)

Policy enforcement

Unauthorized changes to eDirectory values are detected and reset to appropriate values, as specified by company policy

Notifications

Administrators can be notified in real-time through a variety of methods if suspicious activity occurs or if logging applications go down

Real-time system monitoring tools

Administrators can build easy-to-read, dynamic dashboards with monitoring applications or Web services

Reporting and analysis tools

Prewritten Crystal reports, SQL queries wizard, iManager plug-ins and LETrans are included

What distinguishes Nsure Audit from other logging systems?

Secure Logging Server

Platform Agent

Notification

Service

Logging Service

Filter

SMTP

Flat File

Driver

Monitoring

Applications

Report

Generator

SNMP

SYSLOG

Storage

Java

CVR

…

Crystal Reports

Java API

TCP/IP

(TLS)

Alerts/

Notifications

JMS Event Adapter

Oracle

SQL Server

MySQL

File System

[11:58:18] MyApp\ IMAP\ Authentication: Valid login for account “FMSmith" from 137.65.47.144
[11:58:18] MyApp \POP3\ Authentication: Valid login for account "pfeiffer" from 195.224.28.4

C API

…

Monitoring Service

Disconnected

Mode Cache

Administrator

Nsure Audit Architecture Today

Application

Application

Application

SQL

Driver

Filter

Nsure Audit Supported Platforms

Platform Agent

Secure Logging Server

Monitoring App

Windows 2000 SP3

Windows 2003 Server

Windows XP

NetWare® 5.1

NetWare 6.0

NetWare 6.5

RH Linux 8

RH Ent. Linux AS 3&4

SUSE® LINUX 8&9

Solaris 8

Solaris 9

Windows 2000, SP3

Windows 2003

Windows XP

NetWare 5.1 (latest SP)

NetWare 6, SP3

NetWare 6.5

Solaris 8, 9

Red Hat 8.0

Red Hat Enterprise Linux AS 3&4

SUSE LINUX Enterprise Server 8&9

Windows 2000 SP3

Windows XP

Nsure Audit 1.x Agent Instrumentations

Server OS

Desktop OS

Applications

Novell DS 7, 8

Novell eDirectory™ 8.x

Novell iChain® 2.2 SP2

Novell Identity Manager 2

Novell BorderManager® 3.8

Novell NetMail®

Novell iManager 2.5

Novell NetWare File System

None

Novell NetWare 5.x

Novell NetWare 6.x

Nsure Audit Tomorrow

Centralized configuration, management and deployment.

Compliance focused reporting and monitoring

Policy-based management of platform agents.

Multi-tiered event filtering.

Management console plug-ins

Expanded instrumentation and log collection

Third party event correlation and analytics

Nsure Audit Tomorrow

Logging Event Collector

Pluggable Storage

Applications

FILE

SQL

...

Monitoring

Notification

Control

Events

Execution/

Rule Engine

Policy

Authoring

Mgmt.

Event Collection &

Processing Service

Log

Events

Storage

Subsystem

P:\

Nsure Audit Tomorrow

Instrumented System Category Groups

Some instrumentations will aggregate existing logs while other will maintain close integration.

Secure Logging Server (SLS): The central server where all log events are collected.

Secure Logging Server (SLS): Edge and mid-point deployable servers to enforce event filtering policies to enable event roll-up to logging servers.

Secure Servers

Instrumented Systems

SLS

SLS

Server

Policy-based Log Management

Policy-based Event Filtering – provides an intermediary step between the instrumented system and the Secure Logging Server.

Secure Logging Server

Secure Logging Server

Secure Logging Server

Internet

DirXML

SAP

Lotus Notes

PeopleSoft

Honeywell

iChain

ZENworks

NetWare

Active Director

NT/2000/XP

Web Servers

Siebel

DirXML

eDirectory

SAP

Lotus Notes

PeopleSoft

Honeywell

iChain

BorderManager

ZENworks

NetWare

Active Directory

NT/2000/XP

Web Servers

Siebel

DirXML

eDirector

SAP

Lotus Notes

PeopleSoft

Honeywell

iChain

ZENworks

NetWare

NT/2000/XP

Web Servers

Siebel

DirXML

eDirectory

SAP

Lotus Notes

PeopleSoft

Honeywell

iChain

BorderManager

ZENworks

NetWare

Active Directory

NT/2000/XP

Web Servers

Siebel

Nsure Audit Supported Platforms

Windows 2000 SP3

Windows Server 2003

Windows XP

NetWare 5.1

NetWare 6.0

NetWare 6.5

RH Linux 8

RH Ent. Linux (v3&4) WS, ES, AS

SUSE Linux 8&9

Solaris 8

Solaris 9

Windows 2000, SP3

Windows XP

Windows Server 2003

NetWare 5.1 (latest SP)

NetWare 6, SP3

NetWare 6.5

Solaris 8, 9

Red Hat 8.0

Red Hat Enterprise Linux (v3&4) WS, ES, AS

SUSE Linux 8&9

Windows 2000 SP3

Windows XP

Platform Agent

Monitoring App

Secure Logging Server

Server OS

Applications

Desktop OS

Nsure Audit Agent Instrumentations

Novell NetWare 5.x

Novell NetWare 6.x

MS Windows Server 2003

SUSE LINUX 8&9

Redhat Enterprise Linux v3&4

Solaris 8

Solaris 9

MS Windows 2000 Professional

MS Windows XP Professional

SUSE LINUX Pro 9*

SUSE LINUX Pro 8.2*

RedHat Entperise Linux v3 WS*

* via log harvester

Novell Directory Services® 7, 8

Novell eDirectory 8.x

Novell iChain 2.2 SP2

Novell DirXML® 2.0

Novell BorderManager 3.8

Novell SecureLogin

Novell GroupWise®

Novell ZENworks®

Microsoft Active Directory

Microsoft Exchange Server*

Microsoft IIS Server*

Microsoft ISA Server*

Lotus Notes/Domino Server*

If you look at the overall Secure Identity Management Solutions we ship today, there all kinds of activities taking place, interactions between users and systems, automated operations within and between systems. Theoretically, these interactions are all based on some policy that has been translated into rules and stylesheets within the implementation itself. The challenge in such a system, as our customers have told us is that there’s little or no ability to understand from a big-picture perspective what’s happening in this big system?

Novell has been told off and on for some time that we “need an auditing solution”

Lately, the volume on this request has been amplified back to the SIM Team:

We’ve been hearing if from our SEs and Consultants in the field,

We’ve been hearing it from Analysts,

We’ve been hearing it from Customers,

We heard it loud and clear in our Security CI,

We’ve even been telling each other we need it.

But what do customers really mean when they say they need Audit?

What do customers want to be able to do?

Here are some of the things we’ve been hearing:

NOTE: Based on what we’ve learned, we consider “Auditing” to be process of analyzing data that tells what has occurred within systems and then comparing that data to corporate or regulatory policies that an organization is required to adhere to.

Customers have told us that they want to get a record of all of the occurrences in the enterprise into one location.

Once the data is in one location, they can run reports to compare what has happened to organizational policies, or external regulations they’re required to comply with, such as HIPAA, GLBA and others.

They’ve also told us that they want to watch for specific occurrences in their systems. When something occurs that shouldn’t, they want to get some sort of alert. They also want flexibility around how they can get these alerts. Email alone is a good start, but what they really want is the ability to be paged, send SNMP traps, write a custom log of what has happened or even script custom responses to illegal events.

Customers also told us that they wanted to have real-time views of the activity going on within their systems.

Finally, we heard a lot of requests for utilization reports, such as:

What resources is this service consuming versus that?

How many queries are being run against this Directory

How many authentications are occurring against that Directory

Etc.

This chart shows the main selling points of Nsure Audit compared to competition.

The top 3 bullets make Nsure Audit unique from major competition.

The last 3 bullets show parity with major competition.

2003-12-08T12:43:39