HP Adaptive Infrastructure Solution Security for BladeSystem Matrix

CommandView EVA software maintains an audit log of user actions and events that change the state
of the system. Events are written to the CommandView audit log and the Windows Application Event
Log. The CommandView audit log consists of a flat file on the CommandView server, which is
protected by Windows file access permissions.
Accountability and auditing
Safety deposit boxes in a bank are highly protected. Anyone can walk into a bank building.
However, safety deposit boxes are located in the bank vault and are protected by several security
mechanisms. A person must show some form of identity and have a key to the particular box they
wish to access. In addition to these security measures, the bank also requires an audit trail of access
to the safety deposit boxes. The person accessing the safety deposit box must sign a log book and a
camera records the time and an image of the person entering and leaving the vault.
Maintaining a secure computing environment requires proper audit trail configuration and ongoing
monitoring of audit trails. Knowledge that an audit trail capable of maintaining accountability is
being maintained might provide some degree of deterrence. However, unlike previous security
controls discussed in this paper, audit is not generally considered a preventative mechanism. Rather,
audit is an after the fact record of what has transpired. It is used to detect potential security issues or
anomalous behavior that might be a security issue. Audit trail analysis allows the auditor to determine
the extent of damage from a security issue and can be used as an aid in further damage control. You
can also use the information in audit trails to ensure and demonstrate regulatory compliance.
Computing environments are dynamic and must be continuously monitored. The audit trail records
many types of events including configuration changes and privileged actions. The audit trail also
indicates the time that the event occurred and the person or program that initiated the event.
HP SIM auditing
The dynamic nature of virtualization makes auditing in the BladeSystem Matrix solution especially
important. Any configuration changes can impact security. As described for other security functions,
HP SIM also plays a significant role for auditing. HP SIM provides an audit facility that logs entries for
tasks performed by all HP Systems Insight Manager users on all systems. This includes executed tasks,
authorization modifications, user login and logout. The information is stored in the Audit Log file on
the Central Management Server (CMS).
Both the Insight Dynamics – VSE and Insight Orchestration components utilize the HP SIM audit facility
to log tasks associated with the configuration and management of logical servers.
24