Guardium Component Services

Central Manager controls the definition of users, roles, groups and datamart tables for all managed systems. The Central Manager exports the complete set of user, security role, group, and datamart tables definitions on a scheduled basis or on demand. The managed units update their internal databases on an hourly basis. As a result, there might be a delay of up to an hour between the time users, roles, permissions or datamart tables are added or modified on the Central manager and the time that the managed unit applies those updates.

On all processes that automatically generate aliases or groups, for example: import user groups from LDAP, group generation from queries, alias generation from queries, classifier, etc. if the same group or alias is automatically generated on more than one managed machine (managed by the same manager), then it might conflict with an existing group or alias, which will not be replaced.

The definitions of the Audit Process itself and all of its corresponding tasks are saved to the Central Manager and available to all managed units. However, Schedules, Results, and To-Do lists are saved on the local machine.  This means that the same Audit Process tasks can be run on all Managed Units, plus the Central Manager. But it can be run at different times on different machines, which can be useful if the Managed Units have different peak load periods. Each machine has its own set of results, which are based on the data that the machine has collected; and each machine has its own set of To-Do lists for all users. Audit Process definitions are exported from the Central Manager to the managed units as part of the user synchronization process (see Synchronizing Portal User Accounts). When audit process results have been produced, the results are available to users, but on managed units, there might be a delay of up to an hour before reports or monitors such as Outstanding Audit Process Reviews are updated.

Each query can get only database information from a single machine. Queries that require access information including both Central Manager definitions and Managed Unit data show no data, or missing data.

Policy definitions are saved on the Central Manager. However, when you install a policy on a Managed Unit, a local copy is made and saved on the Managed Unit. The reason for that is that the Managed Unit is needed to keep on monitoring the database activity and using the policy even when the Central Manager is not available for any reason.

Report definitions are saved on the Central Manager.

When regenerate portlet is called on a Central Manager, it also sends a management (https) request to all managed units to regenerate the portlet (with the report ID). When regenerate is called on a managed unit - if it is called from the screen (not the management request), then it should send a management request to the manager to refresh the portlet (this would also send it to all units). There is a persistence mechanism for management requests for the case a unit is down - see sections within this topic on registration and policy installation.

From the Central Manager, reports and audit processes can use data from a managed unit but not managed aggregators. The managed unit is selected as a run-time parameter, is referred to as a remote datasource, and presented as a filtered drop-down selection list containing only managed units. When an audit process references a remote datasource, that audit process can be run from the Central Manager only, so it will not appear in a list of audit processes that are displayed on a managed unit.

Like the Audit Process, the definition of the Security Assessment itself is saved to the Central Manager. But the results are saved on the local machine. This means that the same Security Assessment can be run on all Managed Units, plus the Central Manager.

Comments can be saved on either the local machine or the Central Manager, depending on what the comment is associated with. If the Comment is associated with a definition that resides on the Central Manager, then it is also saved on the Central Manager. If the Comment is associated with a Result on the local machine, OR something specific to a Managed Unit (like an Inspection Engine), the Comment is also saved on the local machine.

Schedules are always saved on the local machine, even when the definition is saved on the Central Manager.

When a server is configured as a Central Manager, you must be aware of the tasks that cannot be performed on that unit, but rather must be performed on other (non-Central Manager) units. Inspection engines cannot be defined on the Central Manager and can be created only on the Managed Units. But Inspection engines can be viewed from the Central Manager.

The PCI Data Security Standard consists of twelve basic requirements. Much of the requirements are focused on protecting physical infrastructure (for instance, Requirement 1: Install and maintain a firewall configuration to protect data) or implementing procedural best practices (for instance, Requirement 5: Use and regularly update anti-virus software). However, an extra emphasis is placed on real-time monitoring and tracking of access to cardholder data and continuous assessment of database security health status (for instance, Requirement 10: Track and monitor all access to network resources and cardholder data).

Users

System Configuration

Security Roles

Inspection Engines

Application Role Permissions

Alerter (configuration)

Queries

Anomaly Detection

Reports

Session Inference

Time Periods

IP-to-Hostname Aliasing

Alerts

System Backup

Security Assessments

Aggregation / Archiving

Audit Process Definitions

Custom Alerting

Privacy Sets

Custom Identification Procedures

Exported csv Output

Policies

Schedules

Groups

DB Auto-discovery Configurations

Aliases

Audit Process Results