ProLiant Essentials Vulnerability and Patch Management Pack Planning Guide

ManualsBrandsHP ManualsSoftwareHP Vulnerability and Patch Management Flexible Server License

HP ProLiant Essentials Vulnerability and Patch Management

Pack Planning Guide

Product overview ................................................................................................................................. 3

Vulnerability scanning components..................................................................................................... 3

Vulnerability fix and patch components............................................................................................... 3

Checklist............................................................................................................................................. 4

Pre-installation planning .................................................................................................................... 4

Installing the Vulnerability and Patch Management Pack ....................................................................... 5

Configuration .................................................................................................................................. 5

Scanning ........................................................................................................................................ 7

Patching.......................................................................................................................................... 8

Reporting ........................................................................................................................................ 9

Notification ..................................................................................................................................... 9

Adding a new target system.............................................................................................................. 9

Pre-installation planning...................................................................................................................... 11

Vulnerability and Patch Management Pack architecture ...................................................................... 11

Using an SSL certificate with IIS ....................................................................................................... 13

Preparing the target environment for Vulnerability and Patch Management Pack access ......................... 14

Using the Vulnerability and Patch Management Pack with other ProLiant Essentials products ................... 14

Installing the Vulnerability and Patch Management Pack......................................................................... 15

Installation tips............................................................................................................................... 15

Installing the VPM Acquisition Utility (optional)................................................................................... 15

Configuring the Vulnerability and Patch Management Pack .................................................................... 15

Acquiring patch updates................................................................................................................. 15

Vulnerability scanning ........................................................................................................................ 16

Scanning virtual machines............................................................................................................... 16

Scanning client systems................................................................................................................... 16

Maintaining vulnerability scan results ............................................................................................... 16

Summary of content (19 pages)

PAGE 1
HP ProLiant Essentials Vulnerability and Patch Management Pack Planning Guide Product overview ................................................................................................................................. 3 Vulnerability scanning components..................................................................................................... 3 Vulnerability fix and patch components............................................................................................... 3 Checklist..
PAGE 2
Patching ........................................................................................................................................... 17 Deploying patches ......................................................................................................................... 17 Patching virtual machines................................................................................................................ 17 Patching client systems.....................................................
PAGE 3
Product overview Malicious software security threats are becoming more frequent, more sophisticated, and more costly to businesses, draining billions of dollars in productivity, revenue, and corporate credibility each year. The vast majority of attacks, including automated worms, are performed against known vulnerabilities for which a patch or fix is widely known.
PAGE 4
Checklist See the following checklist to install and use the Vulnerability and Patch Management Pack. Additional information about the procedures in this checklist is included later in this document, in the HP ProLiant Essentials Vulnerability and Patch Management Pack User Guide, and in the HP Systems Insight Manager Installation and User Guide. Be sure to have this documentation available when completing the procedures in this checklist.
PAGE 5
9. Optionally, sign up for e-mail notifications of vulnerability definition updates or Vulnerability and Patch Management Pack updates at http://www.hp.com/go/swupdate. 10. Determine the appropriate time and frequency to perform scans and deploy patches, and the number of systems to include in each scan based on your needs. See the “Vulnerability scanning” and “Patching” sections in this guide for information. Installing the Vulnerability and Patch Management Pack 1.
PAGE 6
4. Verify that operating system and hardware information for target systems is displayed correctly in HP SIM. If this information is not displayed correctly, verify that the HP Management Agents are installed and configured correctly, and then perform another discovery. Alternately, the operating system and hardware information can be manually updated in HP SIM. 5. Configure your Vulnerability and Patch Management Pack settings. See the “Installation and configuration” chapter in the user guide. 6.
PAGE 7
Scanning 1. Determine what types of Vulnerability and Patch Management Pack provided scans you will use to scan licensed target systems in your environment. See the “Vulnerability and Patch Management Pack provided scan definitions” appendix in the user guide for information about provided scans. 2. Optionally, use the provided scans to create new scan definitions customized for your particular needs. See the “Vulnerability scanning” chapter in the user guide for instructions.
PAGE 8
Patching 1. Determine which patches to install by reviewing the scan results. o Determine criticality of the patches to decide if patches must be deployed promptly or if deployment can wait for the next available maintenance window. o Vulnerability scans might indicate the need for a particular patch when a superseding patch has already been applied. The indicated patch will be ignored during patch deployment and listed as “not applicable” in the patch completion event.
PAGE 9
Reporting View consolidated reports showing patch installation status for all systems managed by the Vulnerability and Patch Management Pack. You can view reports by systems or patches. A search filter is also available to view the status of a particular patch on a particular system. o To view patch reports by patch, select Diagnose>Vulnerability and Patch Management>View Patch Installation Status>View by Patch.
PAGE 10
5. Ensure that the VPM Patch Agent is installed on the target system before patching. The VPM Patch Agent is automatically installed when a system is licensed. Agent installation can be verified by viewing the HP SIM events list or the services running on the target system. 6. If Red Hat patches will be applied, verify the Red Hat library, compat-libstdc++, is installed on the Red Hat target systems.
PAGE 11
Pre-installation planning Vulnerability and Patch Management Pack architecture Determine the appropriate Vulnerability and Patch Management Pack infrastructure for your server environment. Shared configuration Installing HP SIM and the Vulnerability and Patch Management Pack on a single server greatly simplifies the security configuration by keeping all components on a single host, eliminating any system requests and responses over the open network.
PAGE 12
If you do not have the server capacity to operate and maintain both the HP SIM and Vulnerability and Patch Management Pack applications on a single server or if it is necessary for the VPM server to be located in the demilitarized zone (DMZ) so it has Internet accessibility, you can split these applications by migrating to a distributed server configuration.
PAGE 13
Figure 4. A distributed configuration across three systems with the VPM Acquisition Utility As in a single-node configuration, the optional VPM Acquisition Utility can be installed and configured on a separate system. The utility connects to the selected vendor website and downloads patch information and patch files. This information can then be imported to the VPM server in the Vulnerability and Patch Management Pack database.
PAGE 14
Preparing the target environment for Vulnerability and Patch Management Pack access HP ProLiant target servers To set up HP ProLiant target servers for Vulnerability and Patch Management Pack access: 1. Install the HP Server Management Agents from the latest HP ProLiant Support Pack available at http://h18023.www1.hp.com/support/files/server/us/index.html. 2. On a Windows server: – Verify that a valid SNMP read community string exists. – Install and configure WMI for HP SIM WBEM/WMI Mapper access. 3.
PAGE 15
Installing the Vulnerability and Patch Management Pack Installation tips • Because of the lack of throughput, HP recommends not installing the Vulnerability and Patch Management Pack on a virtual machine guest.
PAGE 16
Vulnerability scanning Scanning virtual machines Virtual machines can be scanned and patched using the Vulnerability and Patch Management Pack. However, extra time might be required, and there is no coordination when the virtual hosts and virtual machines are patched and rebooted, when necessary. HP recommends monitoring your virtual environment when applying patches.
PAGE 17
Patching Deploying patches • When a patch deployment is selected for a group of systems, such as a patch deployment based on a vulnerability scan, the patch might not be applicable for all systems included in the scan. Also, some patches selected might be missing components or updates in the VPM patch repository. These patches are applied as applicable, but a failure message is logged for targets for which the patch is not applicable or incomplete.
PAGE 18
Setting up notifications HP SIM enables you to configure e-mail or pager notifications to alert designated users when specified events occur in HP SIM. Understand the notification methods. You will receive much more detailed information if you receive e-mail notifications rather than pager notifications. All Vulnerability and Patch Management Pack events are listed in detail in the “Vulnerability and Patch Management Pack event” appendix in the user guide.
PAGE 19
For more information For more information about the Vulnerability and Patch Management Pack, see: • http://www.hp.