Table Of Contents
Release Notes for Management Center for Cisco Security Agents 5.0
File Integrity Check Instructions
SQL Server Desktop Engine Installation
Duplicate Configuration Naming Convention
Internationalization Support Tables
CSA MC Local Agent and Policies
RME Gatekeeper Remote Access Issue
Cisco Product Security Overview
Reporting Security Problems in Cisco Products
Obtaining Technical Assistance
Cisco Technical Support & Documentation Website
Definitions of Service Request Severity
Obtaining Additional Publications and Information
Release Notes for Management Center for Cisco Security Agents 5.0
These release notes are for use with Management Center for Cisco Security Agents (CSA MC) 5.0. The following information is provided:
•
File Integrity Check Instructions
•
•
•
•
•
•
Installation Information
This CSA 5.0 release is supported with VMS 2.3.
It is recommended that you do not install other VMS products on the system to which are installing Management Center for Cisco Security Agents. Only install the "Common Services" needed for VMS in addition to CSA MC.
Caution
Obtaining a License Key
The Management Center for Cisco Security Agents CD contains a license key which is used to operate the MC itself. If you need further license keys, before deploying Cisco Security Agents, you should obtain a license key from Cisco. To receive your license key, you must use the Product Authorization Key (PAK) label affixed to the claim certificate for CSA MC located in the separate licensing envelope.
To obtain a production license, register your software at one of the following web sites.
If you are a registered user of Cisco.com, use this website:
http://www.cisco.com/pcgi-bin/Software/FormManager/formgenerator.pl.
If you are not a registered user of Cisco.com, use this website: http://www.cisco.com/pcgi-bin/Software/FormManager/formgenerator.pl.
After registration, the software license will be sent to the email address that you provided during the registration process. Retain this document with your VMS bundle product software records.
File Integrity Check Instructions
You can perform integrity checks on the files provided with Management Center for Cisco Security Agents 4.5. Use the verify_digests.exe file provided to check the MD5 hashes of the files.
When you run the verify_digests.exe file, you can enter the CD drive letter and check the files on the CD itself or you can copy the files to your system and check them from the directory to which they were copied.
The following output is displayed:
•
•
How to install obtain and install VMS 2.3:
Step 1
Step 2
Step 3
Step 4
Step 5
How to install CSA MC V5.0:
Note
Step 1
Step 2
Note
The provided policies are meant as a starting point to enterprise security. In general, you will want to run in test mode and create exceptions with the event wizard to create a suitable rule set for your environment. At that point, you can remove your agents from the test mode group and allow them to operate in protect mode. Test mode is turned on in the Auto-enrollment groups for each OS type. From the Group page, expand the Rule overrides section and uncheck the Test mode checkbox to turn test mode off for that group. Then Generate rules.
Product Notes
The following are issues that exist with the product, but are not product bugs. Therefore, they are not in the bug list.
–
Solution: It is recommended that you install an agent on this CSA MC system.
–
Solution: The majority of the backup does succeed despite the message that appears about the profiler database. There is no solution at this time.
–
Solution: Administrators can perform maintenance, configuration or installation of packages using one of the following methods:
1. Locally in a trusted session such as Single User mode (init level 1) on Solaris or from a VTY session (Ctrl-Alt-F1) on Linux.
2. Remotely via SSH from a trusted host. In this case, the trusted host's IP address must be added to the list of trusted hosts on CSA MC.
3. Local Login via serial port.–
Solution: You may change the File access control rule from the previous version of CSA MC in this module to query the user if your security policy permits the use of the application in question.
–
–
–
–
Solutions: There are several different solutions to this issue:
•
•
•
There may be other issues between CSA's network shim and Compaq/HP Teaming and thus we highly recommend dissolving the team prior to installing CSA if you plan to install the network shim.
–
"The process 'C:\WINDOWS\explorer.exe' (as user HostName\Administrator) attempted to communicate with 10.123.124.125 on TCP port 80. The attempted access was to initiate a connection as a client (operation = CONNECT). The operation was denied." The Windows search function is vulnerable to a redirection attack and the rule is designed to prevent just such an attack.
–
Solution: Note that once a File has been opened and marked as protected, that instance of the file will remain protected even if you remove it from the File Lock list. Only unchecking the enable box on the agent turns off the File Lock entirely. You can then re-enable the File Lock to continue to protect other files on the list.
New Features
This release contains the following new features:
Action Name Changes
Although the functionality and general precedence of action types has not changed, the names have been altered. The "High priority" actions are now named "Priority".
CTA 2.0 Plug-in Support
The CTA 2.0 plug-in to support NAC Phase 2 is packaged with the Cisco Security Agent for optional deployment in this release.
Differentiated Service
By using the Set action available from certain rule types, you can specify Differentiated Service for a traffic flow by setting a QoS marking which is a recognizable value in an IP packet. This allows routers and switches to identify and take action on QoS-marked traffic, providing finer granularity of control in forwarding traffic.
Detected Access Protection
By using the Set action available from certain rule types, you can configure the MC to notify you (via the event log) and optionally take action (via a system state) when an application or service, or other system component that is marked as "detected access" Unprotected does not have a corresponding "detected access" Protected rule and is therefore not being protected by the agent.
Event Aggregation and Suppression
When first deploying rules to agents, it is not unusual to have an overwhelming flurry of events appearing in the event log. In some cases, most of these events are similar events or simply "noisy", not useful events to view. If this is the case, the event log provides two mechanisms for paring down the number of events that appear. Event Filtering: When event filtering is enabled, the event log displays an aggregation of events. This aggregation means that one representative event is displayed for all events that are considered similar on the MC. Event Suppression: When event suppression is enabled, all chosen events are no longer displayed in the event log. Event suppression is best used when you have a reoccurring event that is more noisy than useful to you.
Host Managing Tasks
The configuration options on this new page let you add, move, and remove hosts from selected groups at set times so that the action occurs automatically. Using a configured, automatic, management task could be useful in various recommended scenarios. For example, you're conducting a pilot of the product and you want all newly registered hosts to remain in a group that has test mode enabled for certain period of time before those hosts move to a group that is not in test mode. Having this group movement occur automatically can reduce the administrative burden of having to manually do this. Especially, if it is your policy to have all new hosts start off in test mode. This same scenario can also applied to the learn mode feature.
Host Operations Box
From the Hosts Search page, you can perform certain operations on found hosts. When you the click the Operations button from the Hosts Search page, a new pop-up window appears from which you can move a host to the recycle bin, attach/detach a host from a group.
Hosts Recycle Bin
A recycle bin window is now available from the Hosts list page. To manually move hosts to the recycle bin, you must select the checkbox beside the host in question and click the Move to Recycle Bin button. This is how you remove an inactive or irrelevant host from the Hosts list. If you do not perform this task manually, as mentioned earlier, hosts that have been inactive for 30 days are automatically moved the recycle bin.
IP Address Quarantining
Addresses can be added to the quarantine list by using the Set action - Host address - Untrusted - locally or globally - in a System API rule type.
Learn Mode
Learn mode is intended to localize policies on individual systems, eliminating the initial flurry of pop-up queries that users may experience when the agent is first installed on a system. The learn mode feature should be enabled for a temporary period of time. Learn mode directs the agent not to display query pop-ups, and to instead take an immediate Allow query response when a query rule is triggered, and to persistently save the allow response. Once query responses are taken, and Learn mode is turned off, the majority of queries no longer appear and system security provided by the agent is normalized to the individual system. At this point, users should only see query pop-ups for unusual or suspicious system behavior.
Network Access Control Rules take Source Ports into Account
This is useful when the destination port is ephemerally allocated, but the source port is a well-known port. For example, most network connections are keyed off of well-known destination ports. Applications that only have well-known source ports, such a multimedia applications or Active FTP data connections, must be controlled off the source port. Therefore, if you are specifying a differentiated service marking for a multimedia connection, you would key off the source port.
Platform Support
In this V5.0 release, there is now agent support for the following platforms: Solaris 9, Windows XP Tablet PC Edition 2005, VMware.
Query Logging Granularity
In addition to deciding which query actions (Allow, Deny, Terminate) are available to the user for query pop-up, you can also configure the query response to log only when a particular query action is selected by the user. Using the multi-select box available from the Logged query responses section, you can select one or more response types to produce a log message. For example, if all query actions are being made available for the query, you can configure only a Terminate response to produce a log message. (By default, all query responses are logged.)
Reset Options Added
The MC lets you centrally reset agent settings back to their original states and clears all user-configured settings. When you click the Reset Cisco Security Agents link, a pop-up window appears displaying various checkboxes that let you to reset various specific agents settings or to reset all settings. You can reset the following agent settings: Cached Responses and Logging, Local Firewall Settings, Learned Information, System Security, System State, Untrusted Applications, and User Query Responses.
Secure Boot Mode
Use the Set detected boot attribute to detect when a previous system boot occurred in a non-standard manner. For example, the system was booted from a peripheral device (CD ROM) rather than from the hard drive. This type of boot can be considered non-standard and therefore possibly suspicious. (This is one way of introducing a Trojan to a system.) This type of peripheral device insecure boot detection works in conjunction with a particular type of compatible BIOS on compliant systems.
Note
Set Action
A Set action is available for certain rule types. Set is a singular configuration action that causes a particular, one-time, configuration item to occur when the criteria configured in the rule triggers on a system. For example, when a rule with "Set" configured triggers, a specific action occurs, such as the security level being set to low.
The Set action functionality is now used to perform some of the Add/Remove built-in application process tagging that was available in previous releases. The following built-in applications that were available in previous releases have been removed for V5.0 and although the functionality is the same, they are now implemented using the Set function: Authorized rootkit, Unauthorized rootkit, Processes communicating with Untrusted Hosts, Processes requiring Security Level <High, Medium, Low>, Processes Copying Untrusted Content, Processes Writing Untrusted Content.
You use Set in a rule to perform the following one-time actions: detected access, detected boot, detected rootkit, Differentiated Service (QoS), file trust markings, and host address trust markings. See the User Guide for details.
Status Summary - Host History
There is one item in the Network Status section that is configurable. Host history collection is a feature that you enable and disable from this page. You optionally, globally enable Host history collection for all hosts if you want to maintain individual host histories of the following types of information: host registration, test mode setting changes, learn mode setting changes, IP address changes, CTA posture changes, CSA version changes, host active/inactive status changes.
Status Summary - Most Active
Use the links available in the Most Active section to view the Hosts, Rules, Applications, or Rule/Application pairs that have been the most active or triggered the most (logged the most events to the MC). This information is useful to help you tune your policies for rules that are being tripped too often. This can also alert you to common unwanted occurrences that may be triggering across your enterprise. Additionally, you can purge the events that appear in these lists.
Third Party Certificates
Third party certificates have been qualified with CSA MC.
Wizard Changes
You can use the Wizard to suppress an event from the event log. (This is one way to make use of the new Event Aggregation and Suppression feature.) Event suppression is configured using the Rule ID of the event and the application (including file path) as the criteria for suppressing the event in question and all similar events.
System Requirements (CSA MC)
CSA MC is a component of the VPN/Security Management Solution (VMS).
For information on all bundle features and their requirements, see CiscoWorks2000 VPN/Security Management Solution Quick Start Guide.
Table 1 shows the minimum VMS bundle server requirements for Windows 2000 systems. These requirements are sufficient if you are running a pilot of the product or for deployments up to 500 agents. If you are planning to deploy CSA MC with more than 500 agents, these requirements are insufficient. See the Installation Guide for more detailed system requirements.
Table 1 Minimum Server Requirements
•
•
•
•
SQL Server Desktop Engine Installation
As part of the installation process on a system where CSA MC has not previously been installed, the setup program first installs Microsoft SQL Server Desktop Engine (MSDE). You can use the included Microsoft SQL Server Desktop Engine (provided with the product) if you are planning to deploy no more than 500 agents. When the MSDE installation completes, it may prompt you to reboot the system. In that case, you must reboot the system before restarting the CSA MC setup program. If the MSDE installation does not prompt you to reboot the system, you may restart the setup program without rebooting the system.
Caution
For a local database configuration, you also have the option of installing Microsoft SQL Server 2000 instead of using the Microsoft SQL Server Desktop Engine that is provided. Microsoft SQL Server Desktop Engine has a 2 GB limit. In this case, you can have CSA MC and Microsoft SQL Server 2000 on the same system if you are planning to deploy no more than 5,000 agents. Note that of you are using SQL Server 2000, it must be licensed separately and it must be installed on the system before you begin the CSA MC installation. (See the Installation Guide for details on installation options.)
We also recommend that you format the disk to which you are installing CSA MC as NTFS. FAT32 limits all file sizes to 4 GB.
System Requirements (Agent)
To run Cisco Security Agent on your Windows XP, Windows Server 2003, Windows 2000 or Windows NT 4.0 servers and desktop systems, the requirements are as follows:
Table 2 Agent Requirements (Windows)
Note
To run Cisco Security Agent on your Solaris server systems, the requirements are as follows:
Table 3 Agent Requirements (Solaris)
Caution
To run the Cisco Security Agent on your Linux systems, the requirements are as follows:
Table 4 Agent Requirements (Linux)
Upgrade Support
Upgrading CSA versions earlier than Cisco Security Agent V4.X is not supported.
See "Installing Management Center for Cisco Security Agents" provided as a PDF file in Documentation directory on the product CD for product installation instructions.
Duplicate Configuration Naming Convention
Configuration items shipped with CSA MC and provided by Cisco contain a version column with a version number. Administrator-created items have no version number.
When you import configuration items provided by Cisco, if it is found that there is already an existing exact match for an item, the new configuration data is not copied over. Instead, the existing item will be reused and the name will reflect the new versioning.
If the import process finds that there is an existing item with the same name, the same version number, and different configuration components (variables, etc.), the newly imported item is changed by appending the name of the export file. The new item is always the item that the export file name appended to it. Existing items are not renamed or reversioned if there is a collision.
Also note that CSA MC automatically appends the name of the export file to any administrator configured item collision it finds during administrator imports. The imported item is given a different name and both new and old items can co-exist in the database.
Internationalization Support
All Cisco Security Agent kits contain localized support for English, French, German, Italian, Japanese, Korean, Simplified Chinese, and Spanish language desktops. This support is automatic in each agent kit and no action is required by the administrator. The agent UI, events, and help system will appear in the language of the end user's desktop.
The following table lists CSA localized support and qualification for various OS types.
Table 5 CSA Localizations
Explanation of terms:
Localized: Cisco Security Agent kits contain localized support for the languages identified in Table 5. This support is automatic in each agent kit and no action is required by the administrator. The agent UI, events, and help system will appear in the language of the end user's desktop. All localized languages are agent qualified and supported. (CSA MC is not localized.)
Qualified: The Cisco Security Agent was tested on these language platforms. Cisco security agent drivers are able to handle the local characters in file paths and registry paths. All qualified languages are supported.
Supported: The Cisco Security Agent is suitable to run on these language platforms. The localized characters are supported by all agent functions.
Refer to the following tables.
Internationalization Support Tables
The following tables detail the level of support for each localized version of Windows operating systems. Note that support for a localized operating system is different from localized agent. A localized operating system may be supported even though the corresponding language is not translated in the agent. In this case, the dialogs will appear in English. The tables below define the operating system support, not agent language support. Note, for Multilingual User Interface (MUI) supported languages, installs are always in English (Install shield does not support MUI), and the UI/dialogs are in English unless the desktop is Chinese (Simplified), French, German, Italian, Japanese, Korean, or Spanish.
Any Windows 2000, Windows XP or Windows 2003 platforms/versions not mentioned in the tables below should be treated as not supported.
The following letter combinations are used to describe the level of support:
Table 6
Support Level Key
Table 7 Windows 2000 Support
Table 8 Windows XP Support
Table 9 Windows 2003 Support
On non-localized but tested and supported language platforms, the administrator is responsible for policy changes arising from directory naming variations between languages.
If the previous operating system tables do not indicate that CSA is localized (L), then the system administrator is responsible for checking to ensure that the tokens are in the language they expect and the directory path is the one they intend to protect. See Installing Management Center for Cisco Security Agents for the procedure to determine if language tokens are correct. Also note that if you are upgrading to V5.0 from a version earlier than 4.5, and you are carrying policies forward, you will want to change literal string system path references to token paths for localization purposes.
VMware Environment Support
The following tables provide support details for the Cisco Security Agents running in a VMware environment for host and guest operating systems.
Table 10 VMware Support
Overview
Note that the table above assumes that the VMware virtualization layer between the guest operating system and the host operating system isolates it from underlying differences. The following tables list the specific host and guest operating systems that this capability is qualified on. While other operating systems may work, only those listed here have been verified.
Table 11 VMware WS 5.0
Host OS Support
Table 12 VMware WS 5.0
Guest OS Support
Table 13 VMware GSX 3.2
Host OS Support
Table 14 VMware GSX 3.2
Guest OS Support
Windows Firewall Disabled
The Cisco Security Agent automatically disables the Windows XP and Windows 2003 firewall. This is done per recommendation of Microsoft in their HELP guide for their firewall. If you want to read this recommendation, you can access the "Windows Security Center" console from a Windows XP or Windows 2003 installation, click on "Windows Firewall", and select "on." The firewall status will warn you as follows: "Two or more firewalls running at the same time can conflict with each other. For more information see Why you should only use one firewall."
Because the Cisco Security Agent, in part, utilizes firewall-like components, the agent disables the Windows firewall per the recommendation from Microsoft.
Cisco Security Agent Policies
CSA MC default agent kits, groups, policies, rule modules, and configuration variables provide a high level of security coverage for desktops and servers. These default agent kits, groups, policies, rule modules, and configuration variables cannot anticipate all possible local security policy requirements specified by your organization's management, nor can they anticipate all local combinations of application usage patterns. We recommend deploying agents using the default configurations and then monitoring for possible tuning to your environment.
CSA MC Local Agent and Policies
When you install CSA MC, an agent containing the policies necessary to protect a system only running CSA MC and Security Monitor as part of your VMS bundle on the CiscoWorks system (the recommended configuration) is automatically installed as well. The policy in question contains a "restrictive" rule module which puts tighter restrictions on the system because it does not have to account for other VMS bundle products that might be running on the system.
If you are running additional products as part of your VMS bundle on the CiscoWorks system, you must remove the CiscoWorks Restrictive VMS Module from the CiscoWorks VMS Systems policy in order to allow this additional software to operate.
To do this, navigate to Configuration>Policies and locate "VMS CiscoWorks - Windows" in the list of policies. Click on the "VMS CiscoWorks - Windows" policy. This takes you to the main policy page with the list of rule module associations. Click the Modify rule module associations link. Locate the "CiscoWorks Restrictive VMS Module" in the right-side Attached rule modules swap box. Select this module and click the Remove button. Then Generate rules. (Note that this is not the recommended deployment.)
Caution
If you do not disable the agent service and you attempt to alter a CiscoWorks system configuration, the agent may disallow the action or it may display multiple queries to which you must respond.
RME Gatekeeper Remote Access Issue
It is recommended that you do not install other VMS products on the system to which are installing Management Center for Cisco Security Agents. However, if you do not follow this recommendation, you should be aware of the following.
Remote access to the CiscoWorks RME Gatekeeper daemon is not required for correct operation of any of the components in the VMS bundle. Therefore, remote client access to this daemon is normally disabled through a deny rule in the "CiscoWorks VMS Module" within the CiscoWorks VMS Policy.
If other products that require the RME Gatekeeper daemon to be accessed remotely, such as Campus Manager or ACLM, are installed on the same system as the VMS bundle, the CSAMC "CiscoWorks VMS Module" protecting the VMS system should be modified as follows:
Step 1
Step 2
Step 3
Step 4
Step 5
Cisco VPN Client Support
Cisco Security Agent is a supported configuration for the "Are You
There?" feature of the Cisco VPN Client, Release 4.0. For configuration
details, please refer to Chapter 1 of the Cisco VPN Client Administrator
Guide, in the section entitled "Configuring VPN Client Firewall Policy—Windows Only."Known Issues
Table 15 provides information on known issues found in this release.
Guest
