McAfee PASCDE-AB-IA - Policy Auditor For Servers Manuale utente

McAfee Policy Auditor 6.0 software

Product Guide for ePolicy Orchestrator 4.6

No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form

or by any means without the written permission of McAfee, Inc., or its suppliers or affiliate companies.

TRADEMARK ATTRIBUTIONS

AVERT, EPO, EPOLICY ORCHESTRATOR, FOUNDSTONE, GROUPSHIELD, INTRUSHIELD, LINUXSHIELD, MAX (MCAFEE

SECURITYALLIANCE EXCHANGE), MCAFEE, NETSHIELD, PORTALSHIELD, PREVENTSYS, SECURITYALLIANCE, SITEADVISOR, TOTAL

PROTECTION, VIRUSSCAN,WEBSHIELD are registered trademarks or trademarks of McAfee, Inc.and/or its affiliates in the US and/or other

countries. McAfee Red in connection with security is distinctive of McAfee brand products. All other registered and unregistered trademarks

herein are the sole property of their respective owners.

LICENSE INFORMATION

License Agreement

NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSEYOU

PURCHASED, WHICH SETS FORTHTHE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IFYOU

DO NOT KNOW WHICH TYPE OF LICENSEYOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE

GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANYYOUR SOFTWARE PACKAGING OR THATYOU HAVE RECEIVED

SEPARATELY AS PART OFTHE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE

FROM WHICHYOU DOWNLOADED THE SOFTWARE PACKAGE). IFYOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE

AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE,YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF

PURCHASE FOR A FULL REFUND.

McAfee Policy Auditor 6.0 software Product Guide for ePolicy Orchestrator 4.62

Contents

Introducing McAfee Policy Auditor.........................................................8

Audience.................................................................................8

Conventions..............................................................................8

Finding product documentation...............................................................9

Getting started with McAfee Policy Auditor ..............................................10

Introduction to compliance audits............................................................10

Auditing systems..........................................................................11

What's new..............................................................................11

Software components and what they do.......................................................12

Use of ePolicy Orchestrator software features..................................................13

Managed systems vs. unmanaged systems....................................................14

Configuring McAfee Policy Auditor........................................................16

Server settings and what they control.........................................................16

Edit McAfee Policy Auditor server settings.....................................................18

How permission sets work..................................................................18

Default permission sets....................................................................19

Edit permission sets.......................................................................21

Using the McAfee Policy Auditor agent plug-in...........................................22

The agent plug-in and how it works...........................................................22

Supported platforms.......................................................................22

How content is managed...................................................................24

Install and uninstall the agent plug-in.........................................................24

Install the McAfee Policy Auditor agent plug-in..........................................24

Uninstall the agent plug-in...........................................................25

Send a manual wake-up call to a group of systems.......................................25

Display the system tray icon on Windows systems..............................................26

Configuring agentless audits..............................................................27

How McAfee Policy Auditor integrates with the McAfee Vulnerability Manager extension................27

Uniform system management........................................................27

McAfee Vulnerability Manager extension integration with scannable systems..................28

Asset Discovery scans..............................................................28

3McAfee Policy Auditor 6.0 software Product Guide for ePolicy Orchestrator 4.6

Data collection scans...............................................................28

The Maintain Foundstone Audits server task............................................28

The Data Import server task.........................................................29

Server support....................................................................29

Configure McAfee Vulnerability Manager and the ePolicy Orchestrator extension.....................29

Create a McAfee Vulnerability Manager workgroup.......................................30

Configure the McAfeeVulnerability Manager single sign-on feature..........................30

Create a data source to synchronize McAfee Vulnerability Manager and ePolicy Orchestrator....31

Manage McAfee Vulnerability Manager credential sets....................................33

Create an Asset Discovery scan......................................................33

Create an MVM Data Import task.....................................................34

Add systems found by McAfee Vulnerability Manager scans to the System Tree...............35

Create a Data Collection Scan.......................................................35

View McAfee Vulnerability Manager scan status.........................................36

How to handle missing audit results..........................................................36

Troubleshoot missing audit results....................................................37

How to handle mismatched McAfee Vulnerability Manager certificates..............................37

Troubleshoot mismatched McAfee Vulnerability Manager certificates........................38

Creating and managing audits.............................................................39

Audits and how they work..................................................................39

Audit frequency....................................................................40

When audits are run................................................................40

Per audit data maintenance..........................................................40

Benchmark profiles and their effect on audits...........................................41

Considerations for including systems in an audit.........................................41

Benchmark labels and how they are used..............................................41

Findings..........................................................................42

Agentless audits...................................................................42

Activate benchmarks......................................................................42

Create an audit...........................................................................43

Run an audit manually.....................................................................43

Disable an audit..........................................................................44

Delete audits.............................................................................44

Audit whiteout and blackout periods..........................................................44

Set whiteout and blackout periods.....................................................44

Service Level Agreements..................................................................45

McAfee Policy Auditor 6.0 software Product Guide for ePolicy Orchestrator 4.64

Contents

Create, edit, and delete Service Level Agreements.......................................45

How viewing audit results works.............................................................46

Exporting audits and audit results............................................................47

Export audits.............................................................................47

Scoring Audits..............................................................................49

Default scoring model......................................................................49

Flat unweighted scoring model..............................................................50

Flat scoring model........................................................................50

Absolute scoring model....................................................................51

Changing the scoring model................................................................51

Managing Audit Waivers...................................................................52

Types of waivers..........................................................................52

Exception waivers..................................................................53

Exemption waivers.................................................................53

Suppression waivers...............................................................53

Waiver status............................................................................54

Filtering waivers by status...........................................................54

How start and expiration dates work..........................................................54

Examples of filtering waivers by date.........................................................54

Filtering waivers by date............................................................55

Filtering waivers by group..................................................................55

How waiver requests and grants work........................................................56

Requesting waivers................................................................56

Granting waivers...................................................................57

Making waivers expire.....................................................................57

Deleting waivers..........................................................................57

File Integrity Monitoring and entitlement reporting......................................59

How file integrity monitoring works...........................................................59

File information monitored...........................................................60

File baselines.....................................................................60

Monitored and excluded files.........................................................60

File versioning.....................................................................61

File version comparison.............................................................62

Accept file integrity monitoring events..................................................62

Purge file integrity monitoring events..................................................62

Entitlement reporting......................................................................62

Create and apply a file integrity monitoring policy...............................................63

5McAfee Policy Auditor 6.0 software Product Guide for ePolicy Orchestrator 4.6

Contents

Create a file integrity monitoring policy.................................................63

Apply a policy to systems............................................................65

Compare file versions...............................................................65

Accept file integrity monitoring events..................................................66

Purge file integrity monitoring events..................................................66

Create a new file integrity monitoring baseline...........................................67

Query reports for file integrity monitoring......................................................67

Rollup reporting............................................................................68

Rollup capabilities.........................................................................68

Rollup reporting considerations..............................................................68

Rollup server tasks........................................................................69

Rollup Data - PA: Audit Benchmark Results.............................................69

Rollup Data - PA: Audit Rule Result ...................................................70

Rollup Data - PA: Audit Patch Check Result ............................................71

Rollup reports............................................................................71

Configure rollup reporting..................................................................72

Findings....................................................................................74

How findings work........................................................................74

Types of violations.................................................................74

Violation limit......................................................................75

Other Findings enhancements.......................................................75

Hide or unhide Findings results..............................................................75

Dashboards and Queries..................................................................77

Policy Auditor default dashboards............................................................77

PA: Compliance Summary dashboard.................................................80

PA: MS Patch Status Summary dashboard.............................................80

PA: Operations....................................................................80

PA: PCI Summary..................................................................81

Queries as dashboard monitors.............................................................82

Policy Auditor agent plug-in debug tool..................................................83

Execute the agent plug-in debug tool.........................................................83

Display help..............................................................................84

Run an audit.............................................................................84

Run a benchmark.........................................................................85

Run a check.............................................................................85

Save debug information....................................................................86

McAfee Policy Auditor 6.0 software Product Guide for ePolicy Orchestrator 4.66

Contents

Appendix A: Implementing the Security Content Automation Protocol.................87

Statement of FDCC compliance.............................................................87

Statement of SCAP implementation..........................................................88

Statement of CVE implementation...........................................................88

Statement of CCE implementation...........................................................89

Statement of CPE implementation...........................................................89

Statement of CVSS implementation..........................................................90

Statement of XCCDF implementation.........................................................90

Statement of OVAL implementation..........................................................90

Appendix B: Common Criteria requirements.............................................92

7McAfee Policy Auditor 6.0 software Product Guide for ePolicy Orchestrator 4.6

Contents

Introducing McAfee Policy Auditor

McAfee®Policy Auditor version 6.0 automates the process required for system compliance

audits.It measures compliance by comparing the actual configuration of a system to the desired

state of a system.

To understand what the software does and how to use it, you must be familiar with these basics:

•What an audit is, when you should use it, and why you should use it.

•The supported deployment solutions based on the type(s) of systems you want to audit.

•The system classifications that determine which functional components can be used.

•The functional components you can use to audit systems.This includes leveraging the

software with McAfee Policy Auditor and other McAfee and third-party software.

•The functional components you can use to audit systems.This includes leveraging the

software with McAfee®Vulnerability Manager and other McAfee and third-party software.

This document introduces these concepts, successively builds your understanding, and provides

details about the use of each functional component. In addition, it helps you understand how

the software fits into the framework provided by McAfee®ePolicy Orchestrator®.

Contents

Audience

Conventions

Finding product documentation

Audience

McAfee documentation is carefully researched and written for the target audience.

The information in this guide is intended primarily for two audiences:

•Network administrators who are responsible for implementing and enforcing the policy for

protecting the company's intellectual property.

•Security officers who are responsible for determining sensitive and confidential data, and

defining the corporate policy that protects the company's intellectual property.

Conventions

This guide uses the following typographical conventions.

Title of a book, chapter, or topic; introduction of a new term; emphasis.Book title or Emphasis

Text that is strongly emphasized.Bold

McAfee Policy Auditor 6.0 software Product Guide for ePolicy Orchestrator 4.68

Commands and other text that the user types;the path of a folder or

program.

User input or Path

A code sample.

Code

Words in the user interface including options, menus, buttons, and dialog

boxes.

User interface

A live link to a topic or to a website.Hypertext blue

Additional information, like an alternate method of accessing an option.Note

Suggestions and recommendations.Tip

Valuable advice to protect your computer system, software installation,

network, business, or data.

Important/Caution

Critical advice to prevent bodily harm when using a hardware product.Warning

Finding product documentation

McAfee provides the information you need during each phase of product implementation, from

installing to using and troubleshooting.After a product is released, information about the product

is entered into the McAfee online KnowledgeBase.

1Go to the McAfee Technical Support ServicePortal at http://mysupport.mcafee.com.

2Under Self Service, access the type of information you need:

Do this...To access...

User Documentation 1Click Product Documentation.

2Select a Product, then select a Version.

3Select a product document.

KnowledgeBase •ClickSearch the KnowledgeBase foranswersto yourproduct questions.

•Click Browse the KnowledgeBase for articles listed by product and

version.

Introducing McAfee Policy Auditor

Finding product documentation

9McAfee Policy Auditor 6.0 software Product Guide for ePolicy Orchestrator 4.6

Getting started with McAfee Policy Auditor

McAfee Policy Auditor is an extension to ePolicy Orchestrator software software versions 4.5

and 4.6 that automates the process for risk and compliance system audits. Audits can perform

tasks such as check system settings, including password length, open or closed ports, file

changes, and the presence of software updates.

Contents

Introduction to compliance audits

Auditing systems

What's new

Software components and what they do

Use of ePolicy Orchestrator software features

Managed systems vs.unmanaged systems

Introduction to compliance audits

Before using McAfee Policy Auditor, it is important to understand what audits are, when you

should use them, and why you should use them.

What are compliance audits?

A compliance audit is a comprehensive review of an organization's adherence to external

regulatory guidelines or internal best practices.McAfee Policy Auditor automates the compliance

audit process and allows you to demonstrate compliance to auditors by producing an audit trail

showing compliance, compliance history, and actions taken to mitigate risks.Organizations that

are out of compliance might be subject to fines or other sanctions, including criminal liability.

When should you use audits?

Use compliance audits when you are subject to government regulations that require your

organization to determine system compliance and maintain records.You should also use audits

to determine compliance with organizational requirements such as password complexity,

password length, the presence of unsupported software, and software patch requirements.

Why should you use audits?

McAfee Policy Auditor automates the process for mandated and organizational audits. Its

companion product, McAfee Benchmark Editor, contains built-in benchmarks that the software

can use for mandated audits, such as Sarbanes-Oxley (SOX) and the Payment Card Industry

Data Security Standards (PCI DSS).The reporting system allows you to demonstrate compliance

to auditors while the Findings feature helps you to find solutions to audit issues.

McAfee Policy Auditor 6.0 software Product Guide for ePolicy Orchestrator 4.610

Questo manuale è adatto per i seguenti modelli

Indice

Altri manuali McAfee Software

McAfee

McAfee QUICKCLEAN 3.0 Manuale utente

McAfee

McAfee ENDPOINT ENCRYPTION ENTERPRISE - BEST PRACTICES... Manuale utente

McAfee

McAfee INTERNET SECURITY 2008 Manuale utente

McAfee

McAfee HISCDE-AB-IA - Host Intrusion Prevention Manuale utente

McAfee

McAfee EPOLICY ORCHESTRATOR 4.5 - Manuale utente

McAfee

McAfee MTP08EMB3RUA - Total Protection - PC Manuale utente

McAfee

McAfee VIRUSSCAN 8.7I Manuale di istruzioni

McAfee

McAfee INTERNET SECURITY 2009 Manuale utente

McAfee

McAfee Agent 4.0 Manuale di istruzioni

McAfee

McAfee MFN10EMB3RAA - Family Protection - PC Manuale utente

McAfee

McAfee VPF40E001RAA - VirusScan 2005 - PC Manuale utente

McAfee

McAfee VPM80E005RAA - VirusScan Professional 2004 Manuale utente

McAfee

McAfee EPOLICY ORCHESTRATOR 4.5 RELEA Manuale di istruzioni

McAfee

McAfee VIRUSSCAN HOME EDITION 7.0 Manuale utente

McAfee

McAfee EPOLICY ORCHESTRATOR 4.5 - Manuale utente

McAfee

McAfee EPOLICY ORCHESTRATOR 4.0 PATCH 5 - S... Manuale di istruzioni

McAfee

McAfee EBCACE-AA-HA - E-Business Client - PC Manuale utente

McAfee

McAfee STUDENT SURVIVAL KIT 1.0-GETTING STARTED Manuale utente

McAfee

McAfee UTILITIES 4.0 Manuale utente

McAfee

McAfee ANTI-THEFT FILE PROTECTION Manuale utente

McAfee

McAfee FIREWALL 2.1-GETTING STARTED Manuale utente

McAfee

McAfee QUICKCLEAN 1.0 Manuale utente

McAfee

McAfee MANAGEMENT EDITION 2.5 Manuale utente

McAfee

McAfee DR SOLOMON S ANTI-VIRUS 8.5 Manuale di servizio

Manuali Software popolari di altre marche

COMPRO

COMPRO COMPROFM Manuale utente

Muratec

Muratec OFFICEBRIDGE ONLINE Manuale utente

Oracle

Oracle Contact Center Anywhere 8.1 Manuale utente

Adobe

Adobe 65007312 - Photoshop Lightroom Manuale

Avaya

Avaya NULL One-X for RIM Blackberry Manuale utente

HP ProLiant BL420c Manuale utente

PS Audio

PS Audio PowerPlay Manuale del proprietario

Brady

Brady LOCKOUT PRO 3.0 Manuale di servizio

Avaya

Avaya Interaction Center Manuale utente

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manuale

Novell

Novell GROUPWISE 8 - INTERNET AGENT Manuale utente

Oracle

Oracle Application 9i Manuale utente

Acer

Acer RDM Manuale utente

Canon

Canon Vixia HF21 Manuale utente

Canon

Canon ZR950 Manuale utente

Samsung

Samsung Auto Backup Manuale utente

Polycom

Polycom Vortex EF2201 Istruzioni per l'installazione e il funzionamento

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manuale utente