You can't optimize what you can't automate and audit. JJ Garcia Public Sector ITOM Solution Architect March 8, 2018

Transcription

1 You can't optimize what you can't automate and audit JJ Garcia Public Sector ITOM Solution Architect March 8, 2018

2 2 Dr. Brown now understands IT compliance Automation

3 IT Operations Management Products S E R V I C E M A N A G E M E N T A U T O M A T I O N H Y B R I D C L O U D M A N A G E M E N T O P E R A T I O N S B R I D G E D A T A C E N T E R A U T O M A T I O N N E T W O R K O P E R A T I O N S M A N A G E M E N T D A T A P R O T E C T I O N I T O M P L AT F O R M

4 Organizational maturity and evolution Patching example Silo Specialists Checklist Coordination Virtual Teams Service Oriented Teams We need to patch OS Instances We need to independently patch OS Instances, DB Instances and MW Instances We need to coordinate large-scale patching across OS, DB and MW platforms We need to enable self-service patching that leverages enterprise processes across OS, DB, and MW (1) Server Automation Data Center Automation Data Center Automation + Server Automation DB & MW Automation (2) Operations Orchestration + Hybrid Cloud Management Operations Orchestration Process Architect* Orchestration Developer* Domain Content Manager* Cross-Domain Content Manager* Increasing Level of Process Orchestration * New Organizational Roles 4

5 Modern compliance is ongoing, integrated, all in one place FROM the old way Random checks Silos Scripting, spreadsheets Manual, error-prone, inconsistent processes TO modern compliance Ongoing checks and remediation, across all systems Compliance in one place, single-view compliance reporting Out-of-the-box benchmarks, compliant templates, remediation actions Enterprise-ready automated, closed-loop, consistent 5

6 DCA Deployment Options Classic and new DCA container deployment option Containerized DCA can be deployed stand-alone or integrated with SA or Puppet. When DCA is not integrated, it performs agentless operations on resources. DCA licensing grants entitlement to both classic install products and the new containerized DCA. 6

7 Access Orchestration Provisioning Patching Compliance Shared Services New Container Deployment Foundation accelerates time-tovalue with easy installation and horizontal scale-out Container Deployment Foundation REST APIs, Bots Microservices Pre-integrated containers, unified license model, and shared services Easy to install, maintain, and patch with zero downtime upgrades Container Orchestration Linux Container Platform Managed Container Environment Physical Virtual Cloud Container Auto-scaling, HA/DR, self-healing, and secure Flexible Deployment Options 7

8 Micro Focus Data Center Automation Automated provisioning, patching, and compliance for enterprise-scale deployments Provisioning Patching Compliance Ongoing, integrated regulatory and patching compliance - Single-view risk dashboards, closed-loop remediation, and exception management Orchestration - Market leading out-of-the-box compliance content and remediation actions Heterogeneous Scalable - Dynamic patching for vendor recommended patches Bare metal, virtual, OS Databases, middleware Container platforms Multivendor provisioning at scale - Container platform provisioning Container Deployment Foundation Physical Virtual Cloud Container Open-API orchestrator for seamless data center integration 8

9 Regulatory Compliance

10 Get market-leading out-of-the-box compliance content benchmarks, templates, remediation actions Benchmarks Compliant templates Remediation actions Regulatory Security 10

11 Regulatory compliance content CIS compliance benchmarks FISMA compliance checks HIPAA compliance checks PCI compliance benchmarks SOX compliance benchmarks

12 Editing Compliance Checks Key Capabilities Edit each rule to set the right value to measure against for regulatory compliance checks as well as corporate compliance checks 12

13 Create an organizational audit policy We can set policies for local security settings or registry or IIS settings or others. 13

14 Policies

15 Create Dynamic Patch Policies with SLO Heterogeneous provisioning and patching at scale Add a Policy, Define SLO for measurement and remediation frequency. Non compliance actions, e.g. no remediation, remediate now, or remediate in Window Patch policies are created with customized Service Level Objectives for both scan and remediation actions. Non compliance actions are configured: no action, remediate within maintenance window, remediate immediately. notifications can also be configured. Resource Groups are subscribed to patch policies. Scan and/or remediation windows are created for the resource group. Policy based automated patching with SLOs and maintenance schedules. Subscribe a resource group to a policy 15

16 Policy Author defines benchmarks and SLO Integrated compliance and closed-loop remediation Author compliance policies Set Service Level Objectives Add or remove individual benchmarks Multiple remediation options: Define Service Level Objectives (SLO) and remediate during a defined maintenance schedule Remediate manually Remediate immediately after a failed scan Send alerts when noncompliance is detected Choose policy level noncompliance actions. Remediate: No action In maintenance window Immediately Policy contains benchmarks for any combination of OS, DB, and MW. Policy is attached to resource groups, SLO is defined 16

17 1 Attach Create a Resource Group Resource Group owner attaches policies to resource groups Integrated compliance and closed-loop remediation 2 resource(s) to the resource group. Attach policies to resource groups consisting of any combination of OS, DB, and MW. Create and attach parent resource groups Subscribe a resource group to one or more policies View resource group compliance status summary 3 Subscribe the resource Group to Policies Scan and remediate at scale. Attach policies to resource groups to scan 1 or 15k resources. 17

18 Resource group maintenance windows and policy exceptions Integrated compliance and closed-loop remediation Define maintenance schedules Create exceptions for resources Set recurring maintenance audit and remediation schedules and define SLOs Set policy exceptions for specific resources in the group such as non-applicable development environments. Track the date and creator of exceptions. Add or remove individual benchmarks from the exceptions Service Level Objective (SLO)s and maintenance schedules are defined to perform ongoing audit and remediation. 18 *Jobs may be run ad-hoc

19 View compliance state in a single dashboard Single-view compliance state across server OS, databases, middleware; resources classified by risk, drill down for details Top 5 failed requirements Based on the highest number of resources where requirement has failed; drill down to display list of resources Compliance by benchmark View compliance by benchmark, pick from dropdown box PCI, CIS, HIPAA, and many more Time to remediate See how long it took to remediate, drill down to display resource and benchmark 19

20 Resource level compliance reports Integrated compliance and closed-loop remediation Resource Compliance Summary Detailed reports on compliance status by benchmark types, policies, and benchmarks in a dashboard view. When non-compliance is detected but the resource is within Resource Service Level Objectives (RSLO) a yellow indicator color is shown. Non-compliance outside of RSLO is indicated in red. Example: Non compliant rules within RSLO. Quickly get detailed compliance status information for a resource. Use the filter choices to get the information you need. 20

21 Patching

22 Vendor recommended patches - dynamic patching OOTB patch bundles Implicit list of patches based on vendor recommendations 22 DCA scans resources to determine which patch bundles to apply. When patch remediation is performed, necessary patches are applied

23 Patching Reports and Dashboards Heterogeneous patching at scale View the results of a patch policy measurement job View patch policy compliance status dashboard at the resource level Reports and dashboards can be found in multiple locations throughout DCA. Get summary and detailed information at the patch policy, resource, resource group, and global levels. Drill into interactive dashboards to reveal more detailed information Drill in to the resource level dashboard for more detailed information on the individual patches that are needed Quickly identify patch vulnerabilities with interactive dashboards and reports 23

24 See patch vulnerabilities in one risk-centric dashboard Latest threats Immediate feedback on exposure to emerging threats Vulnerability exposure Aggregate view of risk, classified by severity, supports drill-down Key risks Tracks key risk events spanning all platforms. Risk dashboard uses National Vulnerability Database (NVD) to identify vulnerabilities Aggregate risk breakout Identifies level of risk by resource Vulnerability age Shows latent vulnerabilities. Old vulnerabilities not yet mitigated are easier exploits 24

25 Infrastructure and Orchestration

26 Orchestrate data center processes Industry s leading open API orchestrator for seamless data center integration OOTB orchestration flow library Orchestrate Processes for 3 rd party tools Invoke other Vendor s APIs Open API, invoke OO from anything This sample section of a DCA Orchestration flow connects to a resource and performs a compliance scan Run orchestration flows from the UI or invoke them using organizational portals or custom scripts via the API Orchestrate any provision, patch, and compliance process on server, database, and middleware. 26

27 Agent and Agentless mixed mode operation New suite container deployment option Import existing resources without an agent to manage in an agentless manner Select a CSV file containing resource definitions Full documentation is available by clicking here. Existing SA resources are visible in DCA using agent based operation DCA can perform operations on existing Server Automation (SA) and Puppet managed resources. All SA resource groups are imported from DCA. DCA may also communicate directly with agentless resources using OO flows. Agentless resources are added in DCA by importing resource definition files. Perform DCA operations with SA and Puppet managed resources, or any resource without an agent. 27

28 Lifecycle management across multi-vendor OS, databases, and middleware for any size or complexity For any combination of servers, OS, databases, middleware OOTB, customizable OS build plans, provisioning workflows, and deployment templates Comprehensive database and middleware automation Scalability across >100,000 servers 3 of the top 5 US banks use DCA database automation. 2 of the top 5 banks in Europe do so as well DCA now automates container platform provisioning 28 Logos are representative, not an exhaustive list

29 DCA on CDF is built on Open REST APIs New suite container deployment option Example: Use a custom script to invoke the API and deploy a compliant resource All DCA functions are accessible via a rich set of RESTful APIs. DCA Suite provides powerful RESTful APIs to allow for optional headless operation of any DCA function. Success: Deployed resource now appears in DCA Extensive API documentation Integrate any DCA functionality into your existing applications or scripts in a headless manner using the REST APIs 29 Click here for API Documentation

30 What differentiates DCA Regulatory and patch compliance in one place Open-API orchestration engine Database and middleware automation Multivendor support Across infrastructure, OOTB compliance content, closed-loop remediation, single-view dashboard Seamless integration to connect processes across the data center From discovery to provisioning, patching to compliance, updates to upgrades Broad technology coverage across OS and application vendors 30

31 Learn more about DCA Visit the DCA website Read the ITOM blog Micro Focus ITOM blog Follow us on Micro Focus Software LinkedIn 31

32 Questions?

33 Thank You.

34 Extras

35 Accelerate time-to-value with containerized deployment option Container Deployment Foundation is a modern IT Ops platform Modern UX, REST APIs, Bots Operations Orchestration Discovery and Configuration Management Collect Once Store Once with Vertica Business Value Dashboards & Reporting Micro Focus Solution Specific Content and Services Third Party Content and Services Admin, CICD, Single Sign-On, License Management Container Deployment Foundation P H Y S I C A L V I R T U A L C L O U D C O N TA I N E R Easy to install, maintain, patch with zero downtime upgrades Auto-scaling, self-healing, and secure Flexible deployment options 35

36 Container Deployment Foundation UI New DCA Container Deployment option CDF is an easy to install container platform used to deploy all ITOM containerized products. Easily add more worker nodes and multiple masters to increase DCA job capacity View important real-time cluster resource statistics Manage workload namespaces and labels View active services by namespace View log files and debug pods CDF handles all provisioning and management of the underlying container infrastructure required to deploy containerized DCA. 36

37 ChatOps -- Collaboration between systems and teams using Slack Start compliance audit and remediation jobs from the slack channel DCA RBAC Authentication to ensure user has permissions to issue requested command ChatOps connects the Slack collaboration tool to DCA using HuBot Enterprise. Perform compliance audit and remediation jobs using a Slack channel. Obtain compliance status reports and monitor resources for changes in compliance. Predictive command recognition, identifies and corrects command typos Execute and monitor compliance status, audit, and remediation jobs using Slack. Authenticate user roles with DCA RBAC. 37

38 Puppet Integration for OS, DB, MW Integrated compliance and closed-loop remediation Discover and import Puppet managed resources: Credentials are provided for the Puppet master. DCA connects to the Puppet master to discover and take inventory of Puppet managed nodes. These resources are imported into DCA. Credentials for each node are obtained from the Puppet master. Puppet Master DCA : Puppet node discovery DCA Configure the Puppet Master integration Ensure SLOs of Puppet managed servers with Policy based compliance audit and remediation of OS, DB, and MW. Examine compliance status, score summary, and other details in DCA dashboard graphs and drilldown reports Leverage DCA s enterprise-ready features: role-based access control, integrated audit exception management, and high-availability Puppet Manages nodes Puppet Managed Node Puppet Managed Node Discover resources on Puppet managed servers DCA can discover and import Puppet managed nodes to audit and remediate regulatory compliance and patching across OS, DB, and MW on imported nodes. 38

39 Puppet Integration; compliance and patching Integrated compliance and closed-loop remediation 1 DCA UI 8 9 Managed Srv w/ Puppet Agent 2 Automation Manager 3 4 OO 5 6 OO Flow 7 Puppet Master Compliance/Patch result data in PuppetDB Job Manager Credential Manager 12 Data posted to DCA All DCA scheduled jobs are issued to the Puppet master using a Puppet module called mcollective. Mcollective broadcasts the message to an intermediate messaging server. The puppet agent retrieves these instructions and performs the actions required to complete the requested job on the Puppet node. After DCA completes the Puppet node discovery, resources are imported into DCA. DCA performs regulatory compliance and patching on the Puppet managed nodes. 39

40 Role Based Access Control Integrated compliance and closed-loop remediation Role Based Access Control User groups are mapped to different roles to enforce access control Roles are associated to one or more permission sets, resource types, and resource groups Ships with five roles and seven permission sets outof-the-box Create custom roles and associate permission sets with roles RBAC allows you to grant permissions to roles. Users are assigned roles based on job function. 40

41 1 2 Deploy 3 Infrastructure Container server farm provisioning Heterogeneous provisioning and patching at scale Deploy Docker-based Kubernetes master node using the OOTB template Docker-based Kubernetes worker node(s) using OOTB templates, associate to a desired master is ready for deployment of modern container workloads Deploy the infrastructure required for modern container workloads using pre-built templates Once a master is provisioned, create the desired amount of worker nodes using OOTB templates. Together the master and worker nodes become a scalable cluster ready to accept containerized applications and services. 41 OOTB templates to deploy Dockerbased Kubernetes clusters. Deploy container infrastructure with OOTB deployment templates. Deploy and configure Docker-based Kubernetes clusters.

42 Detailed and Summary compliance audit reports Integrated compliance and closed-loop remediation Single benchmarks Show me the compliance status of each benchmark on this resource Individual benchmark compliance status Various detailed and summary reports are available in PDF format including: Compliance job history Compliance status by policy/benchmark Compliance by resource Service Level Objective conformance Show me compliance statistics for each policy Number of resources in each compliance state Prove compliance with customized reports. Each report can be filtered to show the results you need. 42

43 Provision modern workloads with out-of-the-box container platform deployment templates Standardize, orchestrate, and manage customized deployments of Docker-based Kubernetes clusters OOTB, customizable Docker-based Kubernetes deployment templates Remove the complexity of configuring container infrastructure No need to have container experts 43