LJK/Security Reference Manual
Previous Contents Index

M.2.3 LJK/Security Document Naming for CA-2 and CA-7

There can be only one copy of the LJK/Security software installed on a particular running instance of the VMS operating system. There is a single name space for policy documents which must be shared by all those who have been authorized to run LJK/Security. Organization-specific naming conventions provide an easy way to distinguish between documents used for CA-7 Continuous Monitoring on a day-to-day basis and documents used for the annual CA-2 Security Assessment. For instance, in an organization where a team from the Office of the Inspector General conducts the annual CA-2 Security Assessment, files they create could all have names starting with a particular string of characters, like "OIG_". A different scheme might use "OIG_FY06_" one year and "OIG_FY07_" the next year.

M.2.4 What is a "System" ?

The basis of NIST reporting is on a per-system basis, and that definition of each system is something on which the CA-2 and CA-7 teams should be in agreement. A NIST system can be much larger than a single running copy of VMS, and even larger than a single running VMScluster. It may even mix VMS and non-VMS machines. It is important to agree on a definition of where boundaries of each NIST system start and end, and then stick to it.

Typically at least the VMS portion of any NIST system will be assessed from a single LJK/Security master node, but a single master node might be used for assessing the VMS portion of more than one NIST system. In the case of a single master node used to assess two NIST systems named Castor and Pollux, the policy file name prefixes on an LJK/Security master node might be OIG_FY06_CASTOR_ and OIG_FY06_POLLUX_ for the CA-2 Security Assessment team vs. CASTOR_ and POLLUX_ for the CA-7 Continuous Monitoring team.

M.2.5 Using CA-7 Exemptions for CA-2 Assessments

In setting limits within a policy for the Automatic Testing method, those conducting a separate CA-2 Security Assessment will want to create a policy from scratch, perhaps carrying in policy settings prepared in advance or used for CA-2 Security Assessment on some other system operated by the organization. Another option would be to take the default NIST 800-53 policy settings that ship with LJK/Security and just make particular changes for those controls where the policy of the organization mandates a different value in the policy from that shipped with LJK/Security. It would be a mistake to just make a wholesale copy of the policy used for CA-7 Continuous Monitoring, since that might not have been kept current with the organization's policy.

But the situation is different in the case of exemptions in the new policy. Exemptions are used in LJK/Security to indicate special cases where abnormal values are permitted based on management approval. For instance a typical limit says that no individuals should have privileges assigned to their VMS username. Then exemptions are entered for the VMS usernames of those assigned to system management duties, so that violation reports are not generated for those usernames authorized to have privilege. To recreate the exemptions appropriate to a system would be time consuming, so a better tactic is:

  1. Extract the exemptions (but not the limits) from the appropriate CA-7 policy (or policies) with a command like 


     
    $ LJK/Security SHOW POLICY ca7policyname - 
          /EXEMPTIONS /NOLIMITS /COMMAND_PROCEDURE - 
          /OUTPUT=REVIEW.TXT
    creating a command procedure for applying those exemptions to some other policy. Each line in the command procedure contains an entire command for establishing one exemption, so some of those lines will be quite long.

  2. Use a text editor to inspect each exemption in the resulting command procedure and decide whether it was properly granted. On lines where the exemption is not appropriate, comment out the line with an initial exclamation point (!). This has the same effect as deleting the line, but leaves a better record of what actions are taken. For an even better record, one can follow that exclamation point with brief text (on a single line) indicating the reason for the decision.
  3. Apply the resulting batch of exemptions to the CA-2 policy with a command like 


     
    $ @REVIEW.TXT ca2policyname
    where ca2policyname is the name of the policy created earlier with the current limits for the organization.

  4. Use the resulting policy for the Annual CA-2 Security Assessment.
Thus rather than taking a guess at what exemptions should be granted in an annual CA-2 Security Assessment, the team effectively considers nominations made by the CA-7 Continuous Monitoring team who evaluate security of the system all year long.

Depending on the organization's policy some manual reporting of inappropriate exemptions found in step 2 above might be in order.

In the following sections, we discuss various considerations for proposed exemptions, depending on the LJK/Security facility in which the exemptions are located. The examples are based on limits specified in the POLICY_NIST_SP_800_53*.COM file provided in directory LJK$SECURITY_EXAMPLES. Your own organization's limits may be different.

M.2.5.1 Example of an Exemption Based on Node

For LJK/Security test (VMS,ANNOUNCE,CONTAINS)2 the value specified in the limit is the system use notification to be displayed to authorized users on login. This means a violation will be reported for any Node where this notification is not provided. An exemption might be present allowing a particular Node to skip this message if it is exclusively for public use. Questions that might be asked about such an exemption include:

M.2.5.2 Example of an Exemption Based on Node/Filename pair

For LJK/Security test (DISK, FILEPROT, ABSOLUTHI)3 the value specified in the limit is (SYSTEM:RWED,OWNER:RWED,GROUP:RE,WORLD), meaning a violation will be reported for each file which has a more permissive protection mask.

For LJK/Security test (DISK, FILEPROT,PERCENTHI)4 and selector READ, the limit specified has a value of 10 meaning a violation will be reported for each file to which more than 10 percent of users have read access.

Often exemptions will be used for those two tests with respective values of (SYSTEM:RWED, OWNER:RWED,GROUP:RE,WORLD:RE) and 100 percent for a VMS system-wide login command procedure, since that must be executed on behalf of each user at login. Questions that might be asked about such exemptions include:

M.2.5.3 Example of an Exemption Based on Node/Terminal pair

For LJK/Security test (TERM, TYPEAHEAD, PROHIBITED)5 the value specified in the limit is True, meaning a violation will be reported for each terminal over which logins are allowed by VMS. A typical policy will include exemptions for each terminal over which logins are allowed by site rules. Questions that might be asked about such an exemption include:

M.2.5.4 Example of an Exemption Based on Node/Username pair

For LJK/Security test (UAF, PRIVLEVEL, ABSOLUTHI)6 the value specified in the limit is Category-Normal, meaning a violation will be reported for each username that has privileges at a higher level. A typical policy will include an exemption allowing username SYSTEM to have privileges at the level Category-All. Separate exemptions would be present for individuals assigned to system management duties.

Questions that might be asked about such an exemption include:

Note

2 (VMS,ANNOUNCE,CONTAINS) is the LJK/Security notation for the test of text which must be present in the message that is displayed to all users before login.

3 (DISK, FILEPROT, ABSOLUTHI) is the LJK/Security notation for the test that no file has an overly permissive protection mask.

4 (DISK, FILEPROT,PERCENTHI) is the LJK/Security notation for the test that no file can be accessed in the selector-specified mode by more than a certain percentage of the usernames on the system, regardless of whether access is granted by protection mask or access control list.

5 (TERM, TYPEAHEAD, PROHIBITED) is the LJK/Security notation for the test that asynchronous logins cannot be done from terminal lines.

6 (UAF, PRIVLEVEL, ABSOLUTHI) is the LJK/Security notation for the test that no username has privileges above a particular level (typically called "category" in the VMS documentation).

Appendix N
Quick Start Guide to PCI DSS Security Assessments

This appendix offers guidance for use of LJK/Security in complying with the Payment Card Industry Data Security Standard (PCI DSS).

N.1 An Easy Start for PCI DSS Assessments

If you are new to LJK/Security the vast array of capabilities can seem daunting. To get some quick results, use the following steps.

N.1.1 Setting Up the Environment

  1. Have the VMS system manager install LJK/Security as described in Section 2.2, Installation on the Master Node.
  2. Have the person who grants privilegesissue the commands 


    $ SET DEFAULT SYS$SYSTEM
$ MCR AUTHORIZE GRANT/IDENTIFIER LJK$SECURITY_ALL <your-user-name>

  3. Log into a fresh session with your user name (this is required)

N.1.2 Running Your First Assessments
  1. Create a policy that describes PCI DSS controls 


    $ LJK/SECURITY CREATE POLICY MY_PCIDSS_POLICY
$ @LJK$SECURITY_EXAMPLES:POLICY_PCI_MERCHANT.COM MY_PCIDSS_POLICY

    Note
    If you are not a touch typist, you can open this document on screen and copy and paste many of the commands as you need them.
  2. Use the DIRECTORY command to look at the list of policy modifications for particular VMS versions 


    $ DIRECTORY LJK$SECURITY_EXAMPLES:POLICY_VMS_SHA1_*.COM;
$ DIRECTORY LJK$SECURITY_EXAMPLES:POLICY_VMS_SIMPLE_*.COM;
    The names of those command procedures indication the version of VMS to which each one applies.
    The SIMPLE command procedures will provide the fastest initial test. Depending on your organization's rules, you may be required to switch to SHA-1 later.

  3. Customize your policy for your version of VMS by invoking the chosen command procedure 


    $ @LJK$SECURITY_EXAMPLES:POLICY_VMS_SIMPLE_AXP_07_3_2.COM MY_PCIDSS_POLICY

    You can Copy and Paste portions of that command line, but be sure to specify the proper command procedure name for your version of VMS.

  4. Start LJK/Security in subsystem mode for easier typing 


    $ LJK/SECURITY/NOSMG/INTERFACE=CHARACTER_CELL

    You may want to create a DCL symbol in your LOGIN.COM file if you are going to use command mode on a regular basis.

  5. Create an assessment 


    LJKS> CREATE ASSESSMENT MY_PCIDSS_ASSESSMENT
LJKS> MODIFY ASSESSMENT MY_PCIDSS_ASSESSMENT/NODE=<this-node>/POLICY=MY_PCIDSS_POLICY

  6. Run the assessment omitting resource-intensive facilities 


    LJKS> RUN MY_PCIDSS_ASSESSMENT /METHODS=QUICK

  7. Take a break
  8. Come back and check results 


    LJKS> REPORT MY_PCIDSS_ASSESSMENT/STATUS_ONLY

  9. When that indicates the assessment has completed, extract a summary and a detailed report 


    LJKS> REPORT MY_PCIDSS_ASSESSMENT/SUMMARY=COMMENTS/OUTPUT=PCIDSS_SUMMARY.TXT
LJKS> REPORT MY_PCIDSS_ASSESSMENT/OUTPUT=PCIDSS_DETAILS.TXT

  10. Start a full assessment running while you study the results of the quick assessment 


    LJKS> RUN MY_PCIDSS_ASSESSMENT

  11. Exit from LJK/Security subsystem mode 


    LJKS> [Ctrl/Z]

The files you created will list as violations some conditions that are actually acceptable under the organization's policy. Thus you will eventually want to set up exemptions for known acceptable deviations from the general rules.

You can specify which conditions are actually acceptable by customizing your policy. Then subsequent assessment runs will produce a proper "management by exception" report.

N.1.3 Choosing a User Interface

To customize your policy will take more interaction and be an ongoing activity as personnel and requirements change. You might want to use a different user interface. You have your choice of three
  1. Window
    Described in Section 3.3.3, Adding an Exemption
  2. Menu
    Described in Section 4.2.3, Adding an Exemption
  3. Command
    Described in MODIFY POLICY within Chapter 5, Command Interface
You can freely intermix use of the various user interfaces, perhaps depending on what type of connection you have to the system at a given time.

N.1.4 Adding Exemptions for Acceptable Deviations

Use your choice of interface to add exemptions to your policy as follows

Of course you could have added those exemptions before trying to run the assessment, but most people prefer to see some output first to understand that they want to add exemptions where authorized.

Previous Next Contents Index