Security Analytics Engine 1.0

Chat now with support

Adding and managing applications Adding and managing risk policies

Adding a new risk policy Managing risk policies

Introduction Auditing page Filtering the audit events Configuring the retention settings Displaying details for an individual audit event Adding and managing overrides on the Auditing page

Policy Overrides

Introduction Policy Overrides page Adding and managing overrides on the Policy Overrides page

Fallback Password

Introduction Fallback Administrator Password page

Security Settings

Introduction Security wizard

Adding new authentication providers

Security wizard pages

Glossary About Dell

Security wizard pages

The Security wizard is displayed when the Security Settings link is clicked on the Home page. This wizard is used to enter connection settings to your directory service provider, enable two factor authentication, and assign permissions to groups.

The following table provides a description of the options available in the Security wizard.

Table 14. Security wizard

Authentication Provider page

The first page of the wizard is used for selecting between the two supported directory service provider types and specifying the settings to use for authentication. The panes and fields available on this page vary according to the selection made in the Directory Type pane.

Authentication Provider Settings pane

In the Display Name field, enter a name for the authentication provider. This is a display name that is only used within the Administration web pages.

Directory Type pane

On this pane, select the type of directory service provider to use to authenticate users of this application.

•

Active Directory - (Default) Select this option to use Active Directory® to authenticate users.

•

LDAP - Select this option to use an LDAP directory to authenticate users. You should only select this option if you understand the LDAP schema necessary for configuring the Security Analytics Engine.

NOTE: The Connection Information, Authentication Schemes and Attributes Mapping panes appear according to the Directory Type selected.

Connection Information pane (Active Directory)

If Active Directory was selected as the directory type, the following fields appear allowing you to select how to connect to Active Directory.

Use Current Domain

Select this option to connect using the domain member server where the Security Analytics Engine is installed. This option is intended to be used when you install the Security Analytics Engine on a member server of your corporate Active Directory domain in which you want to authenticate users. The Security Analytics Engine Windows® service uses the credentials of the service account (LocalSystem or an account specified during installation) to connect to Active Directory.

Manual

Select this option to manually provide the connection information. This option is intended to be used when you install the Security Analytics Engine on a stand-alone server that is not joined to a domain, such as a test server or a server in the DMZ.

The following fields are activated:

•

IP Address - Enter the IP address or host name of a Global Catalog Active Directory domain server from which to authenticate users.

•

User Name - Enter the name of a user from the Active Directory domain that has read access.

•

Password - Enter the password for the account.

Connection Information pane (LDAP)

If LDAP was selected as the directory type, you have the flexibility to authenticate users against a wide range of directory service providers. Use the following fields to provide information on connecting to your desired LDAP server.

Hostname/IP Address

Enter the IP address or host name of the LDAP server. The value should be of the form ‘hostname:port’.

NOTE: If no port value is specified, the default port of 389 is used.

NOTE: Specify multiple LDAP servers by separating the values with a comma.

Is Secure

Select this check box to enable LDAPS to secure communication to the LDAP server using SSL. To use this feature, the LDAP server must have a properly installed SSL certificate with a host name or DNS name matching the value entered in the Hostname/IP Address field.

DN of User to Bind With

Enter the name of an account that can be used to bind and perform read-only searches against the LDAP server.

NOTE: You must enter a full distinguished name (DN) such as ‘CN=stsServiceUser,CN=Users,DC=ldapvm,DC=local’.

Password

Enter the password for the account.

Search Base

Enter the full distinguished name of the location (or container) within your directory from which all user and group objects are accessible.

NOTE: For example, if all your users and groups exist in the Users container, you may specify something like ‘CN=Users,DC=ldapvm,DC=local’. Or if you have your users separated into multiple containers, just specify the base ‘DC=ldapvm,DC=local’.

Authentication Schemes pane (Active Directory)

When using Active Directory as the underlying directory service provider for authentication, the Security Analytics Engine has several different ways, or schemes, in which it can accept and validate user credentials. On this page, you can configure which scheme(s) to use.

NOTE: At least one scheme must be selected.

NOTE: If all three schemes are selected, the following order is used for authentication:

•

The Security Analytics Engine login page first attempts to authenticate the user via Kerberos.

•

If Kerberos authentication fails, the Security Analytics Engine login page then attempts to authenticate the user via a Client Certificate or Smart Card. This may involve a prompt and user interaction to select a certificate depending on the web browser or User-Agent.

•

If neither Kerberos nor Client Certificates were successful at authenticating the user, the Security Analytics Engine Administration Forms authentication scheme is used.

HTML Forms

Selected by default, this is the standard login page of the Security Analytics Engine in which a user manually enters their domain username and password to be authenticated.

NOTE: When users are already logged into their Windows machines, this may seem a redundant step which defeats the purpose of single sign-on. However, it is recommended that this option remain selected because the HTML Forms authentication can be used as a fallback mechanism when users access the site from a non-domain joined computer (e.g., over the internet at a hotel).

Kerberos

Selecting this scheme automatically authenticates users via Kerberos when the user is currently logged into and has access to the domain. The Security Analytics Engine silently attempts the Kerberos authentication, and if it fails attempts to fall back to the HTML Forms authentication (if enabled).

NOTE: This option is NOT available when Manual is selected on the Connection Information pane or when the Security Analytics Engine is installed on a non-domain joined server.

Client Certificates (Smart Cards)

Selecting this scheme only allows authentication to users that possess an X509 certificate or Smart Card containing a certificate that has been associated to their domain account using Microsoft® Active Directory Certificate Services.

When this scheme is enabled, the user’s web browser may prompt them to choose a certificate from their local machine or Smart Card. If the certificate is valid, the user is authenticated without having to enter their credentials.

Check for Client Certificate Revocation (CRL)

Select this option to enable an additional network call for each authentication. As is standard practice, if a user were to lose their certificate or Smart Card you have the option of revoking that certificate in Active Directory Certificate Services before its expiration date. This provides protection against attempts by malicious users to log in using the lost certificate.

NOTE: This requires that Client Certificates (Smart Cards) is selected as an authentication scheme.

Attribute Mappings pane (LDAP)

If LDAP was selected as the directory type, use this pane to tell the LDAP provider what user and group attributes to use when attempting to authenticate credentials, as well as how to access a user’s group membership and what attributes to use for the default claims that are returned by the Security Analytics Engine.

Object Class of Users

(Required) Specify the Object Class in your LDAP schema that represents a User object. For example, some LDAP servers use ‘inetOrgPerson’ as the most fine grained object class of user accounts.

Object Class of Groups

(Required) Specify the Object Class in your LDAP schema that represents a Group object. For example, some LDAP servers use ‘groupOfNames’ for the groups object class.

User’s Unique ID Attribute

(Optional) Enter the name of an attribute that can be used to uniquely identify a user account. If no value is specified, the object’s distinguished name is used. If you know that the Group’s Member Attribute value contains something other than distinguished names, you need to set the User’s Unique ID Attribute field accordingly.

The value from this attribute (or the distinguished name if not specified) is returned in the default NameIdentifier claim.

Group’s Unique ID Attribute

(Optional) Enter the name of an attribute that can be used to uniquely identify a group. If no value is specified, the object’s distinguished name is used.

The value of the specified attribute (or the group’s distinguished name if not specified) is returned in an authenticated user’s Role claims.

User’s Login Name Attribute

(Required) This field corresponds to the attribute that contains the value a user types on the Security Analytics Engine login page when entering their credentials. The value of this attribute is also returned in the default UPN claim of an authenticated user. A typical attribute name within many LDAP servers for this might be ‘uid’.

Group’s Name Attribute

(Required) Enter the attribute name that corresponds to a group’s display name. A typical attribute within many LDAP servers for this might be ‘cn’ for ‘common name’.

User’s Email Attribute

(Optional) Specify an attribute name from which an authenticated user’s email address can be found. If specified, the value is returned in the Email default claim type. If not specified, the same value that appears in the UPN claim is used.

Group’s Members Attribute

(Required) Enter the name of a multi-valued attribute that contains a list of the group’s members. This is used when performing a search to create all of the Role claims for an authenticated user. A typical attribute within many LDAP servers for this might be ‘member’.

NOTE: The values in the attribute should correspond to some unique identifier of the object (user account) belonging to that group. Therefore, it must match the value that is specified by the User’s Unique ID Attribute.

Often, the values in the group’s member attribute are distinguished names. Therefore, if you leave the User’s Unique ID Attribute field empty, they will match. If you know that the group’s member attribute value contains something other than distinguished names, you need to set the User’s Unique ID Attribute field accordingly.

User’s First Name Attribute

(Required) Enter the user’s First Name attribute in order to create the default Name claim that is returned for an authenticated user.

User’s Last Name Attribute

(Required) Enter the user’s Last Name attribute in order to create the default Name claim that is returned for an authenticated user.

Two Factor Authentication page

The second wizard page is used when you want certain applications to require users to perform an additional level of authentication. When enabled, a user is not considered logged in until they successfully authenticate against both factors.

None

(Default) Select this option if you do not want to use two factor authentication.

Dell SMS

Select this option to use the Dell SMS Service for additional authentication.

If you choose to use the Dell SMS Service, you must first purchase the service and obtain an access key from Dell. Contact Dell Support for purchasing instructions.

RADIUS

Select this option to use a RADIUS server that issues one-time password codes for additional authentication.

NOTE: Selecting Dell SMS or RADIUS enables two factor authentication, and a new pane appears allowing you to set up the additional authentication.

Connection Information (Dell SMS)

If Dell SMS was selected, the following fields appear allowing you to provide connection information.

NOTE: If using the Dell SMS Service for two factor authentication and you have more than one server on which the Security Analytics Engine is running in a load balanced environment, you must configure sticky sessions in your load balancer in order for the service to work correctly.

Dell SMS Service Access Key

Enter the access key code provided by Dell.

Mobile Phone Number Attribute

Enter the attribute name from within your directory service provider that contains your user’s cell phone numbers. For example, in Active Directory this is often the ‘mobile’ attribute.

Connection Information (RADIUS)

Corporations may have an existing RADIUS server used to authenticate and grant network access to remote users, or they may choose to configure a RADIUS server (such as Dell™ One Identity Defender) and utilize hardware or software tokens for two factor authentication in Active Directory domains. If so, the same two factor authentication features can be applied to your federated relying party applications. The Security Analytics Engine supports connecting to a RADIUS server when the user possesses a hardware token (such as a key fob) that contains a one-time password they must enter as their second form of authentication. The RADIUS server may also be configured to perform a set of challenge/response questions the user must answer in order to be authenticated.

The following fields allow you to configure the connection information to your RADIUS server, so that it can be used by the Security Analytics Engine for two factor authentication.

Server

Enter the RADIUS server’s host name or IP address.

Port

Enter the port number for the RADIUS server.

Shared Secret

Enter the RADIUS server’s shared secret string (used by the protocol for hashing).

Username Attribute

Enter the name of the directory service provider attribute that uniquely identifies a user account on your RADIUS server. For example, if using Active Directory and One Identity Defender, you would enter ‘samAccountName’.

Pre-authenticate for Challenge/Response

Select this check box if you know your RADIUS server is configured for Challenge/Response authentication. If configured, a user may have to answer several questions correctly before being able to log in.

Authorized Groups page (optional)

The final page of the wizard is used for specifying groups and/or individual accounts as Administrators or Help Desk Operators.

NOTE: If groups or individual accounts are not added then the Fallback account is always used to access the Security Analytics Engine Administration web site. We strongly recommend assigning permissions if multiple users need access to the Administration web site.

Authorized Security Analytics Engine Administrators

This section lists the groups currently assigned Administrator privileges for the Security Analytics Engine Administration web site. The following fields and buttons appear in this section:

Groups:

•

Search for Text - In this field enter the name or partial name of a group. Leaving the field blank searches for all groups.

•

Search - Click this button to display the search results on the Authorize Administrator Groups dialog which is then used for adding groups.

•

- Click this button to remove a group from the list.

Individual Accounts:

•

Search for Text - In this field enter the name or partial name of an account. Leaving the field blank searches for all accounts.

•

Search - Click this button to display the search results on the Authorize Administrator Accounts dialog which is then used for adding accounts.

•

- Click this button to remove an account from the list.

Authorized Help Desk Operators

This section lists the groups currently assigned help desk operator privileges for the Security Analytics Engine Administration web site. The following field and buttons appear in this section:

Groups:

•

Search for Text - In this field enter the name or partial name of a group. Leaving the field blank searches for all groups.

•

Search - Click this button to display the search results on the Authorize Help Desk Groups dialog which is then used for adding groups.

•

- Click this button to remove a group from the list.

Individual Accounts:

•

Search for Text - In this field enter the name or partial name of an account. Leaving the field blank searches for all accounts.

•

Search - Click this button to display the search results on the Authorize Help Desk Accounts dialog which is then used for adding accounts.

•

- Click this button to remove an account from the list.

Authorize Administrator Groups dialog

This dialog appears when the Search button is clicked in the Group section of the Authorized Security Analytics Engine Administrators section.

Available Groups

This table lists the results of the search.

Use this button to move selected items from the Available Groups table to the Authorized Groups table.

Use this button to move selected items from the Authorized Groups table to the Available Groups table.

Authorized Groups

This table lists the groups selected as authorized administrator groups.

Click this button to save your selections and close the dialog.

Click this button to close the dialog without saving your selections.

Authorize Administrator Accounts dialog

This dialog appears when the Search button is clicked in the Individual Account section of the Authorized Security Analytics Engine Administrators section.