Install and Configure CAS (Configuration Audit System) in Guardium v11.2

A database is a program that is installed at the operating system level and makes use of operating system services. There are many configuration elements that reside within operating system constructs rather than within the database itself. Examples include files, registry values and environment variables. Many of these files and values control some of the most important aspects of database security. A good example is the authentication method of the database. In almost all database platforms, an administrator can change the way that a database authenticates users by changing such a value, either in addition to or instead of using SQL. The IBM InfoSphere Guardium Configuration Audit System (CAS) tracks all changes made to the database at various levels, and reports on these changes to a centralized web-based console. Using the CAS module, database security administrators can know that no changes that may affect security have been made in ways that bypass the database's SQL engine.

This post will illustrate how we can check to make sure CAS is installed and configured on both the appliance and database server, describe and create a template and utilize CAS to distinguish changes made on the operating system that may affect database performance, using the following steps: 

1. Validate that CAS is installed on the database server.
2. Ensure that CAS is running.
3. Discuss and create and utilize a template for mapping changes.
4. Create changes on operating system and view CAS results.
5. Automate CAS report for future usage.

This post is only focusing on Windows environment. 

Pre-requisites on Windows

1 Make sure that Microsoft .NET 4.5 or later is installed.

2 Make sure 64b Java (JRE) environment. There is a version requirement.

3 Make Sure GIM installed properly

Install CAS into Windows DB Server over GIM

1 Manage - Module Installation - Upload Modules: Upload CAS GIM file.

2 Manage - Module Installation - Set up by Client: Deploy CAS through GIM

Required parameters :

• CAS_JVM_PATH : C:\Program Files\Java\jre1.8.0_261\bin\server
• CAS_INSTALL_DIR : C:\Program Files\IBM\CAS

Reconfiguring JAVA_HOME (JVM) location for CAS

In most cases, the installation program takes care of finding the JAVA_HOME value. This value is placed in the CAS configuration file.

If for any reason (for example, you install a new Java version after the Guardium CAS product is installed), you need to change the location of JAVA_HOME (JVM), use the following procedure.

• Locate and open the CAS configuration file for editing. The full path name of the configuration file is <installation directory>/cas/conf/casclient.cfg.
• Within the configuration file, locate the [RUNTIMELIB] section, and change the value of the JVM directory (JVM=C:\Java\jre\bin\classic\jvm.dll).
• Save the file and restart the CAS service (service name: casclient or display name: IBM Security Guardium Change Audit System).

Configure CAS to Test a Change on a Windows File

1 Harden - Configuraton Change Control (CAS Application) - CAS Template Set Configuration

2 Harden - Configuraton Change Control (CAS Application) - CAS Template Set Configuration - CAS Configuration Navigator - New

Monitored Item : 

3 Harden - Configuraton Change Control (CAS Application) - CAS Host Configuration

Since we are auditing changes on file, datasource configuration does not matter here. 

You can pause , run auditing instance from Host Instance Definition without waiting the interval comes.