Managing Profiles

A profile contains the CipherTrust Manager logging criteria for CTE clients, Syslog server configuration, default logging level, LDT Quality of Service (QoS) settings, server settings, Multifactor Authentication (MFA) settings, Ransomware protection settings, and additional settings that can be used for several CTE clients.

A default profile, DefaultClientProfile, is created automatically when either of the following happens:

• On successful registration of the first client if no profile is specified during registration.

• On creation of the first client group. A new client group is automatically linked to DefaultClientProfile.

When registering a CTE client, the installer prompts to specify a profile for the client. If not specified, DefaultClientProfile is automatically linked to the client on successful registration. The linked profile can be modified later. It is recommended to not delete or modify DefaultClientProfile.

Creating a Profile

To create a profile:

1. Open the Transparent Encryption application.

2. In the left pane, click Settings > Profiles.

3. Click Create Profile.

4. Specify a unique Name for the profile. This is a mandatory field.

5. Provide a Description for the profile.

6. Click Create.

The newly created profile appears in the profiles list.

After you have created a profile, you can define client logging criteria, Syslog configurations, QoS configurations, server settings, MFA configurations, and Ransomware protection settings. These configurations apply to the clients and client groups linked to this profile. Refer to the subsequent sections for details.

Setting Client Log Configuration

Client log configuration includes basic information such as the level of logs to capture, whether to enable the Syslog server, settings to upload logs to the CipherTrust Manager, and settings to store logs on clients.

To define client log configurations for a profile:

1. Open the Transparent Encryption application.

2. In the left pane, click Settings > Profiles.

3. Under Name, click the desired profile. The edit view of the profile is displayed. Profile settings are divided into categories, as shown below:

   

   

   Basic Settings

4. Specify the basic settings:

   Field	Description
   Log Level	Level of logs to generate. It defines the detail and extent of information to be logged by the linked agents. In sequence, the options are: • DEBUG: Fine-grained informational events that are targeted towards support engineers and developers. • INFO: Informational messages that highlight the progress of the application at coarse- grained level. • WARN: Potentially harmful situations. • ERROR: Error events that might still allow the application to continue running. This is the default log level. • FATAL: Severe error events that will presumably lead the application to abort. Log levels are cumulative. The level that you select not only generates log entries for events that occur at that level, but all the levels below. For example, the WARN level also includes events that occur on the ERROR and FATAL levels.
   Duplicates	Treatment for duplicate logs. The options are: • SUPPRESS: Messages follow the configured Threshold as to how many times duplicate messages are sent to the CipherTrust Manager during the given Interval. • ALLOW: All duplicate messages are captured and displayed in the log.
   Threshold (1-100)	(Used when the Duplicates field is set to SUPPRESS.) Maximum number of duplicate messages the CTE Agent can send to the CipherTrust Manager within the time specified by Suppress Interval (see below). The default value is 5 messages.
   Suppress Interval (sec) 1-1000	(Used when the Duplicates field is set to SUPPRESS.) Time in which the number of duplicate messages, specified by Threshold, can be uploaded to the CipherTrust Manager. When Suppress Interval exceeds, the count specified by Threshold starts again. The default interval is 600 seconds (10 minutes).
   Enable Concise Logging	Whether to enable Concise Logging for the linked clients. Select to enable, clear to disable. By default, Concise Logging is disabled. When enabled, a reduced number of audit log messages are captured. Refer to Concise Logging for details.
   Syslog Enabled	Whether the Syslog server is enabled. Select to enable, clear to disable. When you select Syslog Enabled, make sure that client Syslog configurations are defined. Refer to Setting Client Syslog Configuration for details. When the Syslog server is disabled, the logs are sent to the client messages file such as /var/adm/messages. On a Windows client, the messages are sent to the Event Viewer (Application events).

   Log Upload Settings

5. Configure settings to upload logs to the CipherTrust Manager:

   Field	Description
   Log Upload to Key Manager	Whether to enable log upload to the CipherTrust Manager. Select to enable, clear to disable. When this option is selected, you can configure the settings listed below. The logs are displayed under the Client Records page of the CipherTrust Manager GUI.
   Upload Log Level	Level of logs to upload. In sequence, the options are: • DEBUG: Fine-grained informational events that are targeted towards support engineers and developers. • INFO: Informational messages that highlight the progress of the application at coarse- grained level. • WARN: Potentially harmful situations. • ERROR: Error events that might still allow the application to continue running. This is the default log level. • FATAL: Severe error events that will presumably lead the application to abort. Log levels are cumulative. The level that you select not only generates log entries for events that occur at that level, but all the levels below. For example, the WARN level also includes events that occur on the ERROR and FATAL levels.
   Connection Timeout (sec) 1-60	Interval after which the connection attempt to the key manager expires. The default value is 59 seconds.
   Drop if Busy	Whether to slow log generation and drop log files during periods of extreme logging (that is, when the server is busy). Select to drop, clear to keep trying. This setting is clear by default.
   Upload Timeout (sec) 1-900	Interval after which the log upload attempt expires. The default period is 600 seconds (10 minutes).
   Max Interval (sec) 1-1000	Maximum interval to wait before the CTE Agent can upload messages to the CipherTrust Manager. Use this option to update the log viewer even when the Message Upload Range has not been reached. Lower the interval if there is little CTE Agent activity. The default maximum interval is 20 seconds.
   Min Interval (sec) 1-30	Minimum interval to wait before the CTE Agent can upload messages to the CipherTrust Manager. Increase the interval if there is considerable CTE Agent activity, so the agents do not flood the network with log messages. The minimum interval is 10 seconds.
   Message Upload Range (100-1000)	Maximum number of logs to upload at one time. When the specified number of logs is reached, they are uploaded to the CipherTrust Manager. The default number is 1000.
   Cache Settings	Settings to cache logs. The options are: • Max Files: Maximum number of log files to cache. The default number is 200. • Max Space (MB): Maximum log size to cache. The default value is 100 MB.

   Log to File Settings

6. Configure settings to gather logs in files on clients:

   Field	Description
   Log to File	Whether to write logs to files on clients. This option is selected by default. This means that, by default, the logs are written to files on clients. The logs are sent to the /var/log/vormetric/vorvmd_root.log file of a UNIX client, or a Windows equivalent, such as \Documents and Settings\All Users or WINDOWS\Application\ Data\Vormetric\DataSecurityExpert\agent\log\vorvmd.log. When the Log to File option is selected, you can configure the settings listed below.
   File Log Level	Level of logs to capture in the log file. In sequence, the options are: • DEBUG: Fine-grained informational events that are targeted towards support engineers and developers. • INFO: Informational messages that highlight the progress of the application at coarse- grained level. • WARN: Potentially harmful situations. • ERROR: Error events that might still allow the application to continue running. This is the default log level. • FATAL: Severe error events that will presumably lead the application to abort. Log levels are cumulative. The level that you select not only generates log entries for events that occur at that level, but all the levels below. For example, the WARN level also includes events that occur on the ERROR and FATAL levels.
   Max File Size (1-1000 MB)	Maximum size of a log file. The CTE Agent starts a new, empty log file when the specified limit is exceeded. The default maximum file size is 1000 MB.
   Max Old Files (1-100)	The maximum number of old log files to keep. The default number is 100.
   Allow Purge	Whether to allow purging the old log files. Select to allow purge, clear to disallow. This option works in conjunction with the Max Old Files option (see above). For example, set Max Old Files to 3 and select the Allow Purge check box. After 3 log files are generated, the first log file, log1, is deleted and a new log file, log4, is created.If the Allow Purge check box is clear, log files continue to accumulate in the server database and you have to remove them manually.

7. Click Update.

The changes are effective immediately and apply to the clients linked with the profile.

The CTE client logs can be seen on the Records > Client Records page of the CipherTrust Manager GUI. Filter the records by Client Type and look for the CTE records, as shown below.

Refer to Records for details.

Setting Client Syslog Configuration

When you have Syslog servers up and running in your environment, you can redirect your client logs to them. A CipherTrust Manager administrator can configure profiles to redirect client logs to Syslog servers.

To configure Syslog settings in a profile:

1. Open the Transparent Encryption application.

2. In the left pane, click Settings > Profiles.

3. Under Name, click the desired profile.

4. Expand CLIENT SYSLOG CONFIGURATION.

   

5. Specify the following details:

   Note

   • You can configure up to four servers, labeled as Server 1, Server 2, Server 3, and Server 4. By default, Server 1 and Server 2 are visible. To view Server 3 and Server 4, click Show Additional Servers.

   • This document describes steps to configure one server, Server 1. Extend the steps to suit your setup requirements.

   Field	Description
   Log Level	Level of logs to redirect. In sequence, the options are: • DEBUG: Fine-grained informational events that are targeted towards support engineers and developers. • INFO: Informational messages that highlight the progress of the application at coarse- grained level. • WARN: Potentially harmful situations. • ERROR: Error events that might still allow the application to continue running. This is the default log level. • FATAL: Severe error events that will presumably lead the application to abort. Log levels are cumulative. The level that you select not only generates log entries for events that occur at that level, but all the levels below. For example, the WARN level also includes events that occur on the ERROR and FATAL levels.
   Local	Whether logs are sent to the client. If selected, the logs are saved on the client at /var/log/messages. By default, the option is clear.
   Server 1
   Hostname or IP	Hostname or IP address of the Syslog server.
   Port	Port of the Syslog server.
   Message Format	Format in which the log messages are transferred to the Syslog server. The options are: • Plain Message • CEF • RFC5424 • LEEF The default log format is RFC5424. This format adheres to the Syslog Protocol RFC 5424 guidelines.
   Protocol	Transport protocol for the Syslog connection. The options are UDP, TCP, and TLS. The default protocol is TCP. When you select TLS, the following fields appear: • CA Certificate: Click Browse to select the CA certificate. • Certificate: Click Browse to select the certificate. • Private Key: Click Browse to select the private key.

6. Click Update.

The Syslog server settings are configured.

Setting Quality of Service Configuration

The QoS configuration settings apply to clients that have the LDT feature enabled on them. Administrators use these settings to maintain operational efficiencies in their systems in conjunction with LDT operations. They can specify percentage of CPU usage or a rekey rate and schedules for LDT operations. Refer to the CTE-Live Data Transformation with CipherTrust Manager for best practices about using LDT and QoS.

A CipherTrust Manager administrator can configure LDT QoS on the CipherTrust Manager.

To configure LDT QoS settings in a profile:

1. Open the Transparent Encryption application.

2. In the left pane, click Settings > Profiles.

3. Under Name, click the desired profile.

4. Expand QUALITY OF SERVICE CONFIGURATION.

   

5. Specify the rekey option. The options are:

   • Rekey by Rate: Select to rekey by rate (in MB/s). This is the default setting. Specify the LDT QoS Rekey Rate. The default value is 0.

   • Rekey by CPU: Select to rekey by CPU usage. By default, LDT operations use all of the available CPU memory.

     Optionally, you can reserve percentage of the clients' CPU for LDT rekey operations. To do so:

     1. Select Cap CPU Allocation. The CPU Percentage field becomes editable.

     2. Enter the CPU Percentage. The value must be greater than 0.

   • LDT Status Check Rate: Select the frequency to check and update the LDT status on the CipherTrust Manager. The valid value ranges from 10 to 1440 minutes. The default value is 60 minutes.

6. Specify a QoS schedule to run LDT. Under QoS Schedules, select an LDT QoS Schedule. The options are:

   Name	Time Ranges	Description
   ANYTIME	Sunday 12:00 AM - Saturday 11:59 PM	LDT runs any day at any time of the week
   WEEKNIGHTS	Monday 12:00 AM - Monday 07:00 AM Monday 09:00 PM - Tuesday 07:00 AM Tuesday 09:00 PM - Wednesday 07:00 AM Wednesday 09:00 PM - Thursday 07:00 AM Thursday 09:00 PM - Friday 07:00 AM Friday 09:00 PM - Friday 11:59 PM	LDT runs between midnight to 7:00 AM from Monday to Friday
   WEEKENDS	Sunday 12:00 AM - Monday 07:00 AM Friday 09:00 PM - Saturday 11:59 PM	LDT runs between 9:00 PM Friday to 7:00 AM on Monday
   CUSTOM	< Custom Range >	LDT runs at a custom schedule (described below)

   Creating a Custom LDT Schedule

   To create a custom LDT schedule:

   1. Select CUSTOM from the LDT QoS Schedule drop-down list. Now, the Create New QoS Schedule button is available.

      

   2. Click Create New QoS Schedule. The Create QoS Schedule dialog box is displayed.

      

      1. Select the Starting Day. The LDT process will start on this day of the week. The default starting day is Monday.

      2. Specify the Starting Time in the HH:MM AM/PM format. Use the arrows to select time in hours (1 to 11) and minutes (00 to 59). Select AM or PM from the drop-down list. The default starting time is 1:00 AM.

      3. Select the Ending Day. The LDT process will end on this day of the week. The default ending day is Monday.

      4. Specify the Ending Time in the HH:MM AM/PM format. The default ending time is 2:00 AM.

   3. Click Create. The custom LDT QoS schedule is displayed on the screen. The specified Time Ranges are also displayed.

      

7. Click Update. The configuration is saved successfully.

Setting Ransomware Protection Configuration

Common Ransomware Protection settings for clients and client groups is configured in profiles. In the profile, specify the process set to be excluded from monitoring and the action to be taken on all other processes that attempt to access the sensitive data.

To configure Ransomware Protection settings in a profile:

1. Open the Transparent Encryption application.

2. In the left pane, click Settings > Profiles.

3. Under Name, click the desired profile.

4. Expand RANSOMWARE PROTECTION CONFIGURATION.

   

5. Specify the Ransomware Protection configuration.

   1. Next to Process Set, click Select. The Select Process Set dialog box shows the list of available process sets.

      1. Select the process set to be excluded from monitoring.

      2. Click Select. The CTE Agent will ignore the processes in the selected process set. All other process sets will be monitored for suspicious behavior.

   2. Select the Operation to be performed on the monitored processes. The available operations are:

      • Monitor: Logs an audit message that a suspicious activity has been detected, and allows the activity on the sensitive data. The default operation is Monitor.

      • Block: Logs an audit message that a suspicious activity has been detected, and blocks its access to the sensitive data.

   3. Click Update.

Setting MFA Configuration

Common MFA configuration for clients and client groups is configured in profiles. When the security configuration for a client is built, the MFA configuration is fetched from the associated profile.

To set up MFA configuration, specify an OIDC connection and the set of exempted users. MFA will not be enforced for users in the exempted user set. By default, MFA is enforced for all users of the associated clients.

To configure MFA settings in a profile:

1. Open the Transparent Encryption application.

2. In the left pane, click Settings > Profiles.

3. Under Name, click the desired profile.

4. Expand MULTIFACTOR AUTHENTICATION.

   

5. Specify the MFA configuration.

   • Select OIDC Connection from the drop-down list. This is the OIDC connection over which MFA configurations will be enforced. OIDC connections are created on the CipherTrust Manager. Refer to Connection Manager for details.

   • Select MFA Exempted User Set from the drop-down list. This user set will be exempted from MFA. MFA will not be enforced on the users of this set.

     Note

     • A CipherTrust Manager administrator with sufficient privileges can delete an OIDC connection being used by a profile. When an in-use OIDC connection is deleted, the security configuration for the associated clients cannot be built and pushed to the clients. The errors are logged in audit records. The CTE Agent continues working with the current configuration until the connection is restored.

     • You can delete the existing OIDC connection and MFA Exempted User set by clicking Delete (X).

6. Click Update.

Configuring Server Settings

A CTE administrator can configure preferred nodes of a CipherTrust Manager cluster for sending status updates from CTE clients. The administrator assigns a priority to every node of the cluster.

The cluster nodes can be categorized into tiers on the CipherTrust Manager GUI, with every tier assigned a priority. For example, Tier 1 is assigned higher priority than Tier 2. All tiers (for example, Tier 1 + Tier 2) can have a total of 20 nodes. This preference is configured through server settings in profiles. If not configured, the CipherTrust Manager continues working with the default settings. Refer to Communication with CipherTrust Manager for the default behavior.

After the server settings are configured, the CTE clients associated with the profile first try to send status updates to the top tier. If none of the nodes in the tier is reachable, the CTE clients try to send updates to the next tier.

To configure the cluster node preference in a profile:

1. Open the Transparent Encryption application.

2. In the left pane, click Settings > Profiles.

3. Under Name, click the desired profile.

4. Expand SERVER SETTINGS.

5. Click Configure Settings.

   Before proceeding, make sure the CipherTrust Manager is part of a cluster. Refer to Clusters and Nodes for information on CipherTrust Manager clusters and nodes.

   When the CipherTrust Manager is part of a cluster, the Server Settings section displays cluster nodes grouped into tiers.

6. Add/modify cluster node preference as appropriate.

   • To add/modify the priority of a cluster node, drag it from one tier and drop to another. Alternatively, click the add button () in the target tier and select the node from the displayed list.

   • To remove a node from a tier:

     1. Click the delete icon () in the node name. A message box appears prompting to confirm the action.

     2. Click Yes to confirm.

     The change will be effective only after you click Update in the SERVER SETTINGS section of the Profiles page.

   • To add a new tier, click Add Another Tier. By default, one tier is visible. You can set preference for all nodes of a CipherTrust Manager cluster.

     A maximum of 20 tiers can be added.

   • To delete a tier, click the delete button (). Tier 1 cannot be deleted.

7. Click Update. The server settings are saved successfully.

   The Update button is enabled only when the tier list is modified and every tier has at least one node.

Concise Logging

CTE's standard operational logging sends audit messages for every file system operation. An audit message is sent every time a file is opened, read, updated, or written. Standard logging can generate high volumes of log data. Security administrators might not need most of these logs to monitor file system activities on the protected clients.

A CipherTrust Manager administrator can enable or disable Concise Logging for a profile. After Concise Logging is enabled or disabled, CTE Agent generates a log message to record that event:

"[CGA] [INFO] [CGA3201I] [08/07/2020 10:57:18] Concise logging enabled"
"[CGA] [INFO] [CGA3202I] [08/07/2020 10:57:27] Concise logging disabled"

Advantages

Concise Logging:

• Helps security administrators to focus on relevant audit messages and important actionable messages such as errors and warnings.

• Can eliminate repetitive and unimportant audit messages generated by read and write activities on a file, read and write directory attributes, and other file system activities.

• Eliminates audit messages:

  • For each block read by a user or an application. Only one audit message is sent for every read/write activity.

  • That read the attributes, basic information of file set attributes, and other event-based messages.

  • For directory open, read directory attributes, and directory close.

Considerations

Concise Logging:

• Changes the set of messages that are sent to Security Information and Event Management (SIEM) software systems. If this results in loss of data required for customer reports, then disable Concise Logging.

• Applies to all GuardPoints and for all users of the clients linked with a profile. There is no fine-grained control such as per GuardPoint, user, or message type.

• Applies to the existing clients and the new clients to be linked with the profile subsequently.

• Is supported by CTE secfs only.

• Should not be used with Learn Mode.

Modifying Profiles

To modify a profile:

1. Open the Transparent Encryption application.

2. In the left pane, click Settings > Profiles.

3. Under Name, click the desired profile.

   Alternatively, click the overflow icon () corresponding to the desired profile and click Edit.

4. Expand CLIENT LOGGING CONFIGURATION.

   1. Modify the settings, as appropriate. Refer to Setting Client Log Configuration for details.

   2. Click Update.

5. Expand CLIENT SYSLOG CONFIGURATION.

   1. Modify the settings, as appropriate. Refer to Setting Client Syslog Configuration for details.

   2. Click Update.

6. Expand QUALITY OF SERVICE CONFIGURATION.

   1. Modify the settings, as appropriate. Refer to Setting Quality of Service Configuration for details.

   2. Click Update.

7. Expand RANSOMWARE PROTECTION CONFIGURATION.

   1. Modify the settings, as appropriate. Refer to Setting Ransomware Protection Configuration for details.

   2. Click Update.

8. Expand MULTI FACTOR AUTHENTICATION.

   1. Modify the settings, as appropriate. Refer to Setting MFA Configuration for details.

   2. Click Update.

9. Expand SERVER SETTINGS.

   1. Modify the settings, as appropriate. Refer to Configuring Server Settings for details.

   2. Click Update.

The profile settings are updated.

You can also modify or delete a CUSTOM QoS.

Modifying a CUSTOM LDT QoS Schedule

To modify a CUSTOM schedule:

1. Click the overflow icon () corresponding to the desired custom QoS schedule.

2. Click Edit. The Create QoS Schedule dialog box is displayed.

3. Modify the schedule, as appropriate. Refer to Creating a Custom LDT Schedule for details.

4. Click Update.

The CUSTOM LDT QoS schedule is modified.

Deleting a CUSTOM LDT QoS Schedule

To delete a CUSTOM schedule:

1. Click the overflow icon () corresponding to the desired custom QoS schedule.

2. Click Delete.

3. Click Yes to confirm the deletion.

The CUSTOM LDT QoS schedule is deleted.

Deleting Profiles

Single or multiple profiles can be deleted from the CipherTrust Manager GUI in one go. Before deleting a profile make sure that no clients or client groups are linked to it.

Deleting Individual Profiles

To delete a profile:

1. Open the Transparent Encryption application.

2. In the left pane, click Settings > Profiles.

3. Click the overflow icon () corresponding to the desired profile.

   Alternatively, select the desired profile and click the delete icon ().

4. Click Delete.

The selected profile is removed from the profiles list.

Deleting Multiple Profiles

To delete multiple profiles:

1. Open the Transparent Encryption application.

2. In the left pane, click Settings > Profiles.

3. Select the check boxes corresponding the desired profiles.

   To select all profiles visible on the page for deletion, select the top check box to the left of the Name heading.

4. Click the delete icon (). A dialog box appears prompting to confirm the action.

5. Click Delete.