Creating Policy Elements

Policy rule criteria consist of resource sets, user sets, signature sets, process sets, action, and effect, and are called policy elements. These elements should exist on the CipherTrust Data Security Platform Service before you can use them in security policies.

Although you can add policy elements when creating policies, it may be a better approach to have them created in advance. This document describes creation of policy elements separately, before creating policies.

A CipherTrust Data Security Platform Service administrator can create, modify, and delete resource sets, user sets, process sets, and signature sets on the CipherTrust Data Security Platform Service. Actions and effects are preconfigured on the CipherTrust Data Security Platform Service.

After you have created policy elements, you can use them in creating and configuring policies. Refer to Creating Policies for details.

Creating Resource Sets

A resource is a combination of a directory, a file, and patterns or special variables. A resource set is a named collection of directories, files, or both, that a user or process will be permitted or denied access to.

Use the Create Resource Set wizard to create resource sets.

1. Open the Transparent Encryption application.

2. Click Policies > Policy Elements.

3. On the Resource Sets tab, click Create Resource Set. The Create Resource Set wizard is displayed.

4. On the General Info screen:

   1. Enter a unique Name for the set.

      • The name must start with a character. The maximum length can be 64 characters.

      • The name can contain alphanumeric characters, underscores ( _ ), and dashes ( - ).

      • The name cannot contain the following special characters:
        ? : ; | ! @ # $ % ^ & * < = > + ( ) { } ~ , \ / [ ] ' "

   2. Make sure that Directory is selected as the Resource Set Type.

   3. Provide a Description for the set.

   4. Click Next. The Add Resources screens is displayed.

5. Specify the resource Directory.

   Note

   • Resource sets must be relative to the guard path. Resource sets created using the absolute paths are not supported.

   • The path must end with a slash. For example, a Windows path must end with a \ (backward slash). A Linux path must end with a / (forward slash).

6. Specify a File or enter the asterisk ( * ). The asterisk acts as a wild card character.

   Note

   An asterisk can be used to include all files of a specific extension in the resource set. For example, to include all text files under a resource directory, specify *.txt.

   Later, a policy with desired permissions can be applied to the resource set. That policy will apply to all files of the specified extension under the specified resource directory.

7. (Optional) Specify whether to include subfolders in the set. Turn on Include Sub Folders. By default, the subfolders are not included.

   

8. (Optional, Linux only) Turn on the HDFS File System toggle for an HDFS resource. When you turn on this toggle, ensure that Directory and File contain HDFS paths.

   HDFS is applicable to Linux clients. By default, the HDFS File System toggle is turned off. Keep it turned off for a non-HDFS resource.

   Note

   To protect an HDFS resource, the CTE clients (NameNode and DataNodes in the HDFS cluster) must be configured for HDFS. Refer to the "Installing CTE on Hadoop" section in the CTE Agent for Linux Advanced Configuration document for details.

   Note

   For the list of supported HDFS systems, refer to the Compatibility Matrix for CTE Agent with Data Security Manager. The matrix also applies to the CTE clients registered with the CipherTrust Data Security Platform Service.

9. Click Next. The Confirmation screen is displayed.

   The screen shows general information about the set and the selected sources.

   

10. Verify the resource set details.

    If the details are incorrect or you want to modify them, click Back and update the details. To add another resource, click Add Another Resource, and specify the details, as described above.

11. Click Save. The resource set is created.

The newly created resource set appears on the Resource Sets tab.

Creating User Sets

A user set is a collection of users and user groups that you want to grant or deny access to GuardPoints. User sets are configured in policies. Policies can be applied to user sets, not to individual users.

Use the Create User Set wizard to create user sets. The wizard provides two options to add user sets. Specify a user set either by querying the registered client or by manually entering the members (individual members, groups, or group members). If needed, you can manually add AD users to a user set.

Creating User Sets by Browsing the Client

To create a user set:

1. Open the Transparent Encryption application.

2. Click Policies > Policy Elements.

3. Click the User Sets tab.

4. Click Create User Set. The Create User Set wizard is displayed.

5. On the General Info screen:

   1. Enter a unique Name for the set.

      • The name must start with a character. The maximum length can be 64 characters.

      • The name can contain alphanumeric characters, underscores ( _ ), and dashes ( - ).

      • The name cannot contain the following special characters:
        ? : ; | ! @ # $ % ^ & * < = > + ( ) { } ~ , \ / [ ] ' "

   2. (Optional) Provide a Description for the set.

   3. Click Next. The Add Users screen is displayed.

6. On the Add Users screen:

   1. Click Create User. By default, the Manually Add Users tab is active.

   2. Click the Browse to Add Users tab.

      This tab allows you to browse the client for members. To add members manually, refer to Creating User Sets by Adding Members Manually.

   3. Select the Agent for the Connection Type.

   4. Click Select. The list of registered clients is displayed.

   5. Select the desired client. Members, groups, or group members of this client will be added to the set.

      

   6. From the User Type drop-down, select System.

   7. From the Member Choice drop-down, select members, the options are:

      • Users: Users of the client.

      • Groups: User groups of the client.

      • Group Members: Group members of the client. When you select this option, the Select Groups field appears. This is a mandatory field. Select a group from the drop-down list. Search will retrieve members of the selected group.

   8. Click Apply. The search result based on the specified criteria is displayed on the right. A set of sample system users/groups is displayed below.

      

      The search can display only the first 100 results. Refine your search by entering the exact name.

   9. Select the desired members from the list.

7. Click Create.

   

   To add more users, click Create User. You can add System and LDAP users and groups simultaneously.

   If you want to remove users from the set, identify the user and click Remove.

8. Click Next. The Confirmation screen shows general information about the set and the selected members.

9. Verify the set details.

   If the details are incorrect or you want to modify them, click Back and update the details.

10. Click Save. The user set is created.

The newly created set appears on the User Sets tab.

Creating User Sets by Adding Members Manually

This method is useful when you already know the names of users and groups that should be added to a user set. Also, use this method to add AD users and groups to the user set.

Using Variables

You can also use the variables |uname| (user name) and |gname| (group name) when addng members manually. On the UNIX systems, |uid| and |gid| can also be used.

When the security rule is applied, the variable is replaced by the actual user name or user group name. For example, if Directory is set to /opt/local/|gname|, when you later make /opt/local the GuardPoint, only the members of the group engineering in Users are allowed access to /opt/local/engineering. |uname| and |gname| act like macros.

Similarly, if you want to define a policy to protect all of the user directories under /home, you don't need to enumerate /home/user1, /home/user2, /home/user3, and so on. You only need to define /home/|uname|. When the agent evaluates the policy, it replaces |uname| with the actual user. So, when user1 logs on, the agent evaluates the policy with /home/user1. They can't access /home/user2.

To create a user set:

1. Open the Transparent Encryption application.

2. Click Policies > Policy Elements.

3. Click the User Sets tab.

4. Click Create User Set. The Create User Set wizard is displayed.

5. On the General Info screen:

   1. Enter a unique Name for the set.

      • The name must start with a character. The maximum length can be 64 characters.

      • The name can contain alphanumeric characters, underscores ( _ ), and dashes ( - ).

      • The name cannot contain the following special characters:
        ? : ; | ! @ # $ % ^ & * < = > + ( ) { } ~ , \ / [ ] ' "

   2. (Optional) Provide a Description for the set.

   3. Click Next. The Add Users screen is displayed.

   4. Click Create User.

      To browse the client for adding members manually, click the Browse to Add Users tab. This tab allows you to browse the client for members. Refer to Creating User Sets by Browsing the Client for details.

6. On the Manually Add Users tab, specify the following details, as appropriate:

   Element	Description
   uname	Login name of the user.
   UID	(AIX/Linux only) ID of the user.
   gname	Comma-separated list of group names.
   GID	(AIX/Linux only) Group ID of the user. Specify only the primary group ID.
   OS domain	(Windows only) Network domain of the user. Multiple domain names, separated by commas, can be entered. Specify the string localhost to configure a generic domain.

7. Click Create.

   To add more users, click Create User. You can add different types of users and groups simultaneously.

   If you want to remove users from the set, identify the user and click Remove next to the user.

8. Click Next. The Confirmation screen shows general information about the set and the selected members.

9. Verify the set details.

   If the details are incorrect or you want to modify them, click Back and update the details.

10. Click Save. The user set is created.

The newly created set appears on the User Sets tab.

Creating Signature Sets

A signature set is a collection of hashes of processes and executables that you want to grant or deny access to GuardPoints. A signature set can be configured in a policy as part of a process set to verify the integrity of a process before it is allowed access to guarded data. Policies are applied to signature sets, not to individual signatures.

To create a signature set:

1. Open the Transparent Encryption application.

2. Click Policies > Policy Elements.

3. Click the Signature Sets tab.

4. Click Create Signature Set. The General Info screen of the Create Signature Set wizard is displayed.

General Info

1. Enter a unique Name for the set.

   • The name must start with a character. The maximum length can be 64 characters.

   • The name can contain alphanumeric characters, underscores ( _ ), and dashes ( - ).

   • The name cannot contain the following special characters:
     ? : ; | ! @ # $ % ^ & * < = > + ( ) { } ~ , \ / [ ] ' "

2. Select Application as the Type. The signature set will have signatures of the running applications.

3. (Optional) Provide a Description for the set.

4. Enable or disable the Add Signatures toggle. If you enable this option, an 3 - Add Signatures screen becomes available.

5. Click Next. The Add Sources screen is displayed. On this screen, you can add files to be signed, as described below.

Add Sources

Specify path of the directory or file to be signed. If a directory is specified, all files in the directory and its subdirectories are signed.

The CipherTrust Manager provides an option to add multiple sources. A maximum of 200 sources can be added at once.

1. Click Add Source.

2. Click Select Client. The list of registered clients is displayed.

3. Select the desired client.

   

4. Click Select. The selected client appears next to the Change Client button (previously Select Client).

   If needed, change the client by clicking Change Client.

5. Specify the path to be signed by either typing manually or using the browser.

   

   To jump to a specific directory, enter the directory path in the Start Directory field and click Apply. The browser shows the subdirectories and files, as shown below.

   

   You cannot browse above the Start Directory. Enter a start point that is higher in the directory hierarchy than all the directories and files that you want to select, or you will have to re-enter start points to locate and select the desired files. The default is the top-level, either slash (Linux) or backslash (Windows).

   Alternatively, if you know the directory path, you can enter it manually in the Path field.

6. Click Add Source. The selected source is displayed in the SELECTED SOURCES list.

   

   Optionally, you can add a new source by clicking Add Source. To remove a source, click Remove to the right of the source. A signature set must contain at least one source.

7. Click Add. The selected source is displayed in the Source Directory list.

   Optionally, you can add a new source by clicking Add Source. To remove a source, click the overflow icon () corresponding to the source and click Remove.

8. Click Next. The Add Signatures screen is displayed. On this screen, you can manually add signatures or upload a CSV file containing signatures.

Add Signatures

If you enabled Add Signatures on the General Info screen, CipherTrust Data Security Platform Service provides options to add signatures to a signature set manually, and to upload the signatures to a signature set through CSV.

Click the desired tab to view the instructions.

Confirmation

1. Verify the set details. If the details are incorrect or you want to modify them, click Back and update the details.

2. Click Save.

The newly created set appears on the Signature Sets tab. By default, the signature set has the status UNSIGNED.

It is recommended that the signature set is signed before you apply policies to processes. This ensures that a tampered with or compromised process executable is not granted permissions to access protected GuardPoints. Refer to Signing Files in a Signature Set for details.

Creating Process Sets

A process set is a collection of processes (executables) that you want to grant or deny access to GuardPoints. Like user sets, process sets can be configured in policies. Policies can be applied to process sets, not to individual processes.

Optionally, file signing can be configured to check the authenticity and integrity of executables and applications before they are allowed to access GuardPoint data. A signature set must already exist before you can configure file signing in a policy for a process set.

Use the Create Process Set wizard to create process sets.

To create a process set:

1. Open the Transparent Encryption application.

2. Click Policies > Policy Elements.

3. Click the Process Sets tab.

4. Click Create Process Set. The Create Process Set wizard is displayed.

5. On the General Info screen:

   1. Enter a unique Name for the set.

      • The name must start with a character. The maximum length can be 64 characters.

      • The name can contain alphanumeric characters, underscores ( _ ), and dashes ( - ).

      • The name cannot contain the following special characters:
        ? : ; | ! @ # $ % ^ & * < = > + ( ) { } ~ , \ / [ ] ' "

   2. Provide a Description for the set.

   3. Click Next. The Add Processes screen is displayed.

6. On the Add Processes screen:

   1. Click Create Process.

   2. Click Select next to the Directory field. The Browse Path dialog box is displayed.

      1. Click Select Client. The list of registered clients is displayed.

      2. Select the desired client and click Add. The selected client appears next to the Change Client button. Click this button to change the client. The dialog box shows the fileystem of the selected client.

      3. Select the directory and file(s). The selected path automatically appears in the Search Local Path field.

         Alternatively, specify the process name (with its path) in the Search Local Path field. Use / (forward slashes) to specify the path. A directory path must end with /.

         You can also Add Full Directory or select multiple files of a single directory individually. Select a file and click Add Path.

         The selected directory and process appear in the Selected Directory and Selected Files fields. If a process is not selected, the Selected Files field shows an ( * ) asterisk. The asterisk acts as a wild card character.

      4. Click Add.

      Alternatively, you can update or specify the directory and process in the Directory and File fields. Use / (forward slashes) to specify the path. A directory path must end with /.

   3. Link the desired signature set to the process set.

      1. Click Select next to the Signature field. The list of Application type signature sets is displayed.

         Optionally, you can create a new signature set by clicking Create Signature Set, and link it with the process set. Refer to Creating Signature Sets for details.

      2. Select the desired signature set.

      3. Click Add.

      The selected signature set appears in the Signature field.

7. Click Add. The Confirmation screen shows general information about the set.

   

8. Verify the set details.

   If the details are incorrect or you want to modify them, click Back and update the details. To add another process, click Create Process, and specify the details, as described above.

   To remove a process, click the overflow icon () corresponding to the desired process and click Remove.

9. Click Next.

10. Review the process set details.

11. Click Save. The process set is created.

The newly created set appears on the Process Sets tab.

After you have created policy elements, you can use them in creating and configuring policies. Refer to Creating Policies for details.