ADMINISTRATION GUIDE Version 7.2
Total Page:16
File Type:pdf, Size:1020Kb
GUIDE STORMSHIELD ENDPOINT SECURITY ADMINISTRATION GUIDE Version 7.2 Document last update: June 2, 2021 Reference: ses-en-administration_guide-v7.2 SES - ADMINISTRATION GUIDE - V 7.2 Table of contents Preface 9 Thanks! 9 What is the target audience? 9 Contact 9 1. Use environment 10 1.1 Recommendations on security watch 10 1.2 Recommendations on keys and certificates 10 1.3 Recommendations on algorithms 10 1.4 Recommendations on administrators 10 1.5 Recommendations on workstations 10 1.6 Recommendations on administration workstations 11 1.7 Certification and qualification environment 11 2. Stormshield Endpoint Security Overview 12 2.1 Concepts 12 2.1.1 Concept 1: Integrated security 12 2.1.2 Concept 2: Proactive protection 12 2.1.3 Concept 3: Adaptive control 13 2.1.4 Concept 4: Flexible policy control 13 2.1.5 Concept 5: Application of policies based on the organization's directory 13 2.1.6 Concept 6: Information feedback 13 2.1.7 Concept 7: Data encryption 13 2.2 Protection mechanisms 13 2.2.1 Rule-based protection 14 2.2.2 Automatic protections 14 2.3 Architecture 15 2.3.1 Concepts 15 2.3.2 Stormshield Endpoint Security components 15 2.4 Packages and licenses 18 2.4.1 Packages 18 2.4.2 Licenses 21 3. Stormshield Endpoint Security Installation and Uninstallation 24 3.1 Downloading the Stormshield Endpoint Security software 24 3.1.1 Downloading from the client area 24 3.1.2 Checking software authenticity 24 3.2 System prerequisites for Stormshield Endpoint Security under Windows 25 3.2.1 Active Directory prerequisites 25 3.2.2 Stormshield Endpoint Security server prerequisites 25 3.2.3 Stormshield Endpoint Security database prerequisites 27 3.2.4 Management console prerequisites 30 3.2.5 Stormshield Endpoint Security agent prerequisites 31 3.3 Stormshield Endpoint Security installation 33 3.3.1 Prerequisites 33 3.3.2 Procedure 34 3.3.3 About Stormshield Endpoint Security 46 3.4 Downloading certificates 46 3.4.1 Certificate validity period 46 3.4.2 Login and password for downloading certificates 46 Page 2/393 ses-en-administration_guide-v7.2 - 06/02/2021 SES - ADMINISTRATION GUIDE - V 7.2 3.4.3 Compatibility with system cloning tools 47 3.5 Post-installation tests 47 3.5.1 Component tests 47 3.6 Possible changes 48 3.6.1 Changing a Stormshield Endpoint Security server IP address 48 3.6.2 Changing the database server IP address 49 3.6.3 Changing the server TCP ports for HTTP and SSL services 49 3.7 Uninstalling components 50 3.7.1 Uninstalling the server and the console 50 3.7.2 Uninstalling the agent 50 3.7.3 Removing the databases 51 4. Migrating and Updating Stormshield Endpoint Security 53 4.1 Migrating StormShield 6.0 to version Stormshield Endpoint Security 7.2 53 4.1.1 Complete migration 53 4.1.2 Partial migration 57 4.2 Updating Stormshield Endpoint Security 7.2 64 4.2.1 Prerequisites 64 4.2.2 Complete update 66 4.2.3 Partial update 71 5. Management Console Configuration 78 5.1 Getting started with the console 78 5.1.1 Connection with an internal account 78 5.1.2 Connection with a Windows account 78 5.2 Console overview 79 5.2.1 "Environment Manager" section 79 5.2.2 "Monitoring" section 89 5.2.3 "Console Manager" section 90 5.2.4 "Devices" section 94 5.2.5 Status bar 94 6. Stormshield Endpoint Security Server Configuration 95 6.1 Stormshield Endpoint Security Server list 95 6.2 Adding an additional Stormshield Endpoint Security server 95 6.2.1 Declaring an additional server 95 6.2.2 Configuring an additional server 96 6.3 Creating a server configuration policy 97 6.4 Editing a server configuration policy 97 6.4.1 Agent connection management 98 6.4.2 Deploying policies on agents and collecting logs 99 6.4.3 Log Monitoring Configuration 100 6.4.4 Syslog Configuration 101 6.4.5 SMTP Configuration 101 6.4.6 Encryption 101 6.4.7 Software Updates Settings 102 6.4.8 Authentication Service 102 6.5 Applying a server configuration policy 103 7. Stormshield Endpoint Security Agent Configuration 104 7.1 Creating a Dynamic Agent Configuration Policy 104 7.2 Editing the Dynamic Agent Configuration Policy 104 7.2.1 Agent Configuration 104 Page 3/393 ses-en-administration_guide-v7.2 - 06/02/2021 SES - ADMINISTRATION GUIDE - V 7.2 7.2.2 Temporary web access 108 7.3 Applying a dynamic agent configuration policy to an object of the directory 111 7.4 Creating a Static Agent Configuration Policy 112 7.5 Editing a Static Agent Configuration Policy 112 7.5.1 Challenges 112 7.5.2 Manage update 118 7.6 Applying a static agent configuration policy to an object of the directory 118 7.7 Stopping the agent 118 7.7.1 If the "Stop Agent" option is set to Allowed 119 7.7.2 If the "Stop Agent" option is set to "Denied" 120 7.7.3 If the user wants to uninstall the Stormshield Endpoint Security agent 123 7.8 Information about the configuration of the agent in the registry base 124 7.8.1 Availability and location 124 7.8.2 Keys and values added to the registry base 124 8. Protection Mechanisms 126 8.1 Protection mechanisms 126 8.1.1 Automatic protections 126 8.1.2 Rule-based protection 126 8.1.3 Order used to apply protection mechanisms 126 8.2 Automatic protections 127 8.2.1 Principles 127 8.2.2 Accessing automatic protections parameters 127 8.2.3 Configuring automatic protections 127 8.3 Rule-based protection 127 8.3.1 Rule categories 128 8.3.2 Whitelists and blacklists 128 8.3.3 Combining whitelists and blacklists 128 8.3.4 Rule management 129 9. Security Policies 133 9.1 Application identifiers 133 9.1.1 Types of application identifiers 133 9.1.2 Creating application identifiers 134 9.2 Importing signature certificates 138 9.3 Creating a security policy 138 9.4 Importing security policies 139 9.4.1 Import a new policy 139 9.4.2 Importing a policy from an existing policy 139 9.5 Editing a security policy 140 9.5.1 System Behavior 140 9.5.2 Device Control 148 9.5.3 Network security control 160 9.5.4 Application control 174 9.6 Applying a security policy to an object of the directory 188 10. Scripts 190 10.1 Overview 190 10.1.1 Scripts feature 190 10.1.2 Scripts 190 10.1.3 Script Resources 191 10.2 Tests 193 10.2.1 Overview 193 Page 4/393 ses-en-administration_guide-v7.2 - 06/02/2021 SES - ADMINISTRATION GUIDE - V 7.2 10.2.2 Statements 193 10.2.3 Built-in tests 194 10.2.4 User-defined tests 201 10.2.5 Creating a test script 201 10.3 Actions 203 10.3.1 Overview 203 10.3.2 Built-in actions 204 10.3.3 User-defined actions 206 10.3.4 Creating an action 206 10.4 Scripts 208 10.4.1 Overview 208 10.4.2 True/False results 209 10.4.3 Creating and applying a script to an object of the directory 209 10.5 Transferring files towards the agents 213 10.5.1 Overview 213 10.5.2 Procedure 214 11. Removable Device Administration 216 11.1 Overview 216 11.2 Preparation of the removable device enrollment 216 11.3 Delegation of the removable device administration 218 11.3.1 Overview 218 11.3.2 Device administration permissions 218 11.3.3 Enrolled devices display 219 11.3.4 Device enrollment and revocation 220 11.3.5 Pre-enrollment of removable devices 221 12. Removable Device Encryption 223 12.1 Overview 223 12.1.1 Purpose 223 12.1.2 Characteristics 223 12.1.3 What can be encrypted 223 12.1.4 Unencrypted partitions 224 12.1.5 Encryption key 224 12.1.6 Synchronization 224 12.1.7 Symbology 224 12.2 Creating an encryption policy to be applied to a group of devices 225 12.2.1 Encryption settings 225 12.3 Connecting a removable device 226 12.3.1 Password 226 12.3.2 Synchronization 226 12.3.3 Access to the device without password 227 12.3.4 Access to encrypted data 227 12.3.5 Behavior when deactivating removable device encryption 227 12.3.6 Using encrypted devices on other computers 228 12.3.7 Removing SD cards 228 12.4 Decrypting a removable device 228 12.4.1 Administrator side 228 12.4.2 Agent side 229 12.5 Passwords 230 12.5.1 Administrator side 230 12.5.2 Agent side 233 12.6 Repairing a corrupted encryption key 236 Page 5/393 ses-en-administration_guide-v7.2 - 06/02/2021 SES - ADMINISTRATION GUIDE - V 7.2 13. Encryption 238 13.1 Data encryption overview 238 13.1.1 Purpose 238 13.1.2 Characteristics 238 13.1.3 Supported system, hardware and software 239 13.1.4 Interoperability with versions previous to the certified 7.2.06 version 240 13.2 Encryption types 240 13.2.1 File encryption 240 13.2.2 Full disk encryption 240 13.3 Creating an encryption policy 241 13.3.1 Graphical interface 241 13.3.2 Procedure 242 13.4 File encryption features 243 13.4.1 Multi-user security 243 13.4.2 Data erasure security 243 13.4.3 File encryption options 244 13.4.4 Password creation and user logon 244 13.4.5 Synchronizing 245 13.4.6 Synchronization with multiple users 246 13.5 Encryption parameters 247 13.5.1 General Settings 247 13.5.2 File Encryption Parameters 250 13.5.3 Full Disk Encryption Parameters 256 13.6 Applying an encryption policy to an object of the directory 260 13.7 Recovery 261 13.7.1 Password recovery when using file encryption 261 13.7.2 Recovering data from encrypted files (decryption) 264 13.7.3 Password recovery when using full disk encryption 266 13.7.4 Recovering an encrypted disk on removable media 269 13.8 Uninstalling Stormshield Endpoint Security agents 273 13.8.1 Decryption before uninstallation 273 13.9 Changing a user account on a machine 274 14.