Quarantine and block malicious database users using IBM Guardium with Ansible

IBM Security Guardium is a comprehensive data security software suite within IBM's Security portfolio designed to protect sensitive data across both on-premises and cloud environments. The flagship product of IBM Security Guardium, Guardium Data Protection (GDP), enables organizations to discover, secure, and monitor sensitive data and activities, as well as remediate potential data violations.

Ansible, a powerful automation tool from Red Hat, simplifies system configuration by automating the management of multiple servers and application deployments. Ansible playbooks, which are structured units of scripts, define the tasks required for these processes.

Integrating Ansible scripts with IBM Guardium offers several advantages, primarily focused on automation, consistency, and efficiency in managing Guardium deployments and configurations. Through REST API commands, Ansible scripts can quarantine and block database users who exhibit suspicious activity. Users can initially be quarantined during an investigation, and if suspicious activity is confirmed, they can then be blocked. This tutorial demonstrates how to use Guardium REST API with Ansible scripts to quarantine and block users engaged in suspicious activities.

Prerequisites

• IBM Security Guardium collector (version 11.5, or later) with an RDBMS system (such as MS SQL Server, MySQL, or Oracle). This tutorial uses MS SQL 16.0.1000.6 for demonstration.
• Ansible installed and configured on your control machine (version 2.9, or later recommended) and set up to communicate with Guardium and database servers.
• Basic understanding of Ansible playbooks, modules, and inventories.

Estimated time

This tutorial should take approximately 20 minutes to complete.

Use case

IBM Guardium Data Protection offers robust features for monitoring database activity. In this tutorial, an MS SQL Server database will be monitored using Guardium Data Protection.

Imagine a scenario where a database user exhibits suspicious behaviour, requiring a swift security response. By monitoring the Policy Violation/Incident Management report available in Guardium, you can quickly take action.

The Ansible playbook used in this tutorial is designed to quarantine the suspicious database user until the investigation is completed. If the user is confirmed to be engaged in malicious activity, the playbook will block the user immediately.

In this tutorial, two database users, unauth01 and unauth03, are created in the MS SQL system. These users have admin privileges, allowing them to perform any action on the database. The process will be carried out in two steps:

1. Quarantine: The first step is to quarantine the database user for a specific timeframe while the investigation is conducted. This will be done by invoking the following API command:

   create_quarantine_until = x minute (e.g., 5 minutes)

2. Block: Once the investigation is completed, if the user is found to be performing malicious activities, a data security policy will be triggered to terminate the user's session. This step involves invoking the following API calls:

   • Create policy: A basic Security Policy will be created. For this tutorial, the policy name is Quarantine and Blocking the Malicious User.
   • Create rule: A rule will be defined with parameters such as database commands and the database users on which the action needs to be taken. For this tutorial, the database command is SELECT, and the database users are unauth01 and unauth03.
   • Create action: The rule action will be defined as STAP-TERMINATE.

Steps

The major steps involved in this configuration are:

• Install Ansible: Ensure Ansible is installed on the system where you plan to run the automation scripts. Ansible can be installed on Linux, macOS, or Windows Subsystem for Linux (WSL).

• Set up Ansible Control Node: Configure a machine to act as the Ansible control node. This machine should have network access to both the Guardium appliance, and any other systems involved in the automation workflow.

• Create Ansible Playbooks : Develop Ansible playbooks that define the tasks to be executed for quarantining or blocking users in Guardium. Playbooks are written in YAML format and typically include tasks such as:

  1. We have used the Guardium cli to register the Ansible server. Here, we have used the random string as client_id. For more information, see Creating the connection between Ansible machine and Guardium.

  2. We have used the inbuilt Policy Violations/ Incident Management to track the user activity. An alert will be created in the report for the malicious users. Once the Report is generated in Guardium, it will be shared with Ansible server for scanning the malicious users through API call.

     Policy Violations/Incident Management report is available in Guardium UI, use search bar for navigation.

     If the malicious users are present in the Policy Violation report, it will be quarantined immediately and post investigation, if the activity is found as malicious activity, user will be blocked immediately.

  3. Triggering actions to quarantine or block users based on predefined conditions or thresholds.

Test and validate playbooks

• Run the Ansible script in a controlled environment to ensure it interacts correctly with Guardium.

• Confirm that the script accurately identifies users to quarantine or block based on the defined criteria.

• Ensure that the actions triggered by the scripts in Guardium produce the expected results without any unintended consequences.

  Main YAML code: You can check the code at the following GitHub repository.

Deploy and monitor

• Once testing is complete and all configurations are verified, deploy the Ansible playbooks to your production environment.

• Continuously monitor the execution of Ansible tasks to ensure they operate as expected and continue to function correctly over time.

Summary

By following this tutorial, you can automate responses to security incidents involving database users in IBM Guardium using Ansible. This automation enhances operational efficiency, ensures consistency, and improves responsiveness to potential security threats.