Integrating File Activity Monitoring (FAM) with CTE Linux

Software Requirements

Overview of FAM on CTE agents

File Activity Monitoring (FAM) catalogs, monitors, and secures unstructured data (files). Unstructured data refers to any data that is not stored in databases. You can find these files locally, on the network, or in the cloud. FAM provides insights into data location, ownership, access history, permissions, protection, sharing, and sensitivity, enabling informed decisions about data protection.

For more information on FAM, see the Introduction to the File Activity Monitoring User Guide

CTE agents enabled with both File System Encryption and FAM capabilities can perform file system monitoring and audit file operations, as per the requirements of the Data Security Fabric (DSF) policies.

Scope of FAM on CTE host

Enabling FAM will also monitor activity on files outside of CTE GuardPoints.

File Monitoring

The CTE agents monitor and audit user and application access to all files. Monitoring is not limited to files inside of CTE GuardPoints. Files outside of CTE GuardPoints are also monitored, except for those in the following directories:

/dev
/roc
/sys
/media
/opt/vormetric 
/CTE-custom-install-location

\BOOT
\Windows
\Program Files*
\Users\*\APPDATA\ROAMING\MICROSOFT\WINDOWSAPPDATA\ROAMING\MICROSOFT\WINDOWS*
\Users\*\APPDATA\LOCAL\MICROSOFT\*
\Users\*\APPDATA\LOCAL\TEMP\*
\Users\*\APPDATA\LOCAL\PACKAGES\*
\Users\*\APPDATA\LOCAL\GOOGLE\CHROME\*
\PROGRAMDATA\MICROSOFT\*
\PROGRAMDATA\DELL\*

Also excluded from monitoring:

• VSS volumes

• DFSR private folders

• CSV volumes

• File operations performed by:

  • CTE internal processes

  • Thales Data Discovery and Classification processes

  • CTE-managed internal system operations

  • Metadata files

FAM Policies vs CTE Policies

FAM policies, which are similar to CTE policies with respect to security rules, allow you to monitor activity on specific data locations and/or by specific users. FAM policies only allow audit rules to specify/filter the content to be monitored. They do not impact access to the file.

Performance Impact of FAM on CTE

File activity monitoring and audits consume system resources. This can potentially affect the performance of system and critical applications running on CTE agents. You can reduce the performance impact on the DSF management console by modifying the monitoring rules of the FAM policy applied to the CTE agent. For example:

• File operations, such as reading file attributes, are operations that are performed very frequently by applications and system utilities.

• If the CTE GuardPoint has policy rules with audit enabled, then with FAM also enabled, there may be additional overhead/performance impact due to the additional FAM policy evaluation and logging. However, the policy has no impact on file access/permissions.

Adjustments in the FAM policy to reduce, or eliminate highly frequent operations, can decrease the impact of FAM. Consult the FAM documentation for information on adjusting the FAM policy.

Enabling FAM on CTE Agent

You can enable FAM on CTE agent during CTE registration, or through the API.

Enable during Registration <!---link to cte-u install>

After installing CTE, you enable FAM when registering, or re-registering, to CipherTrust Manager. During registration, you are prompted with the following two questions:

Do you want this host to have Filesystem encryption support enabled on the server?  (Y/N) [Y]: Y

Do you want this host to have File Activity Monitoring support enabled?  (Y/N) [N]: Y

Make sure that you answer Y to both questions.

Restart Secfs

For CipherTrust Manager v2.19 on Linux, post registration, you must restart secfs. This is not required for CipherTrust Manager v2.20 and subsequent versions. To restart secfs:

1. Type:

   /etc/vormetric/secfs stop
   

2. Type:

   /etc/vormetric/secfs start
   

Enable through the CM API

You can enable FAM on CTE, post registration:

• As part of the CTE upgrade on reboot process.

• Through the CM API available for CM 2.20 and subsequent versions. See the API documentation available through the CipherTrust Manager software.

• Through the DSF management console. Refer to DSF documentation for more information.

Disabling FAM on CTE

• For CipherTrust Manager v2.19, you cannot completely disable FAM once enabled. However, you can remove the FAM policy associated with the client to temporarily disable FAM audit logging/monitoring.

• For CipherTrust Manager v2.20, you can disable FAM on CTE agent through the DSF management console or through the CM API. Refer to DSF documentation for disabling FAM on CTE agents.

Voradmin Support for FAM

The voradmin utility allows you to gather statistics and administer CTE on a host/client. It has slightly different syntax and command capabilities depending on whether the host/client is running in Linux or Windows. The voradmin command provides minimal support for FAM administration on CTE agents. You can check the state of FAM and the FAM policy name applied to the CTE host.

The following command reports the state of FAM, the FAM policy name applied to the CTE host, and the DSF GW configuration for forwarding FAM audits to the DSF GWs.

voradmin fam show config

FAM Output when policy not applied

Example

    # voradmin fam show config

Response

    FAM_STATE  : DISABLED
    FAM_POLICY : Not Applied

FAM Output when policy applied

Example

    # voradmin fam show config

Response

    FAM_STATE  : ACTIVE
    FAM_POLICY : fam-all-ops-policy

Limitation

• File path names included in the FAM audits that are generated from file operations performed inside Linux containers, or namespaces, under chroot enforcement, are relative to the directory created by the chroot, or container, as the root directory.

• CTE enforces a limit of 128 characters in the FAM policy names. FAM audits resulting from policies exceeding this limit, will have the policy name trimmed to the this limit.