Document Outline

• Front cover
• Contents
• Notices
  • Trademarks
• Preface
  • The team that wrote this redbook
  • Become a published author
  • Comments welcome
• Summary of changes
  • January 2007, Second Edition
• Part 1 Architecture and design
• Chapter 1. Business context
  • 1.1 The security compliance and remediation concept
  • 1.2 Why we need this
  • 1.3 Does this concept help our mobile users
  • 1.4 Corporate security policy defined
  • 1.5 Business driver for corporate security compliance
  • 1.6 Achievable benefits for being compliant
  • 1.7 Conclusion
• Chapter 2. Architecting the solution
  • 2.1 Solution architectures, design, and methodologies
    • 2.1.1 Architecture overview
    • 2.1.2 Architectural terminology
  • 2.2 Definition of a Network Admission Control project
    • 2.2.1 Phased rollout approach
  • 2.3 Design process
    • 2.3.1 Security compliance management business process
    • 2.3.2 Security policy life cycle management
    • 2.3.3 Solution objectives
    • 2.3.4 Network design discussion
  • 2.4 Implementation flow
  • 2.5 Scalability and high availability
  • 2.6 Conclusion
• Chapter 3. Component structure
  • 3.1 Logical components
    • 3.1.1 Network Admission Control
    • 3.1.2 Compliance
    • 3.1.3 Remediation
  • 3.2 Physical components
    • 3.2.1 Network client
    • 3.2.2 Network access infrastructure
    • 3.2.3 IBM Integrated Security Solution for Cisco Networks servers
  • 3.3 Solution data and communication flow
    • 3.3.1 Secure communication
  • 3.4 Component placement
    • 3.4.1 Security zones
    • 3.4.2 Policy enforcement points
  • 3.5 Conclusion
• Part 2 Customer environment
• Chapter 4. Armando Banking Brothers Corporation
  • 4.1 Company profile
  • 4.2 Current IT architecture
    • 4.2.1 Network infrastructure
    • 4.2.2 IBM Integrated Security Solution for Cisco Networks lab
    • 4.2.3 Application security infrastructure
    • 4.2.4 Middleware and application infrastructure
  • 4.3 Corporate business vision and objectives
    • 4.3.1 Project layout and implementation phases
  • 4.4 Conclusion
• Chapter 5. Solution design
  • 5.1 Business requirements
  • 5.2 Functional requirements
    • 5.2.1 Security compliance requirements
    • 5.2.2 Network access control requirements
    • 5.2.3 Remediation requirements
    • 5.2.4 Solution functional requirements
  • 5.3 Implementation architecture
    • 5.3.1 Logical components
    • 5.3.2 Physical components
  • 5.4 Conclusion
• Chapter 6. Compliance subsystem implementation
  • 6.1 Tivoli Security Compliance Manager setup
    • 6.1.1 Installation of DB2 database server
    • 6.1.2 Installation of Tivoli Security Compliance Manager server
  • 6.2 Configuration of the compliance policies
    • 6.2.1 Posture collectors
    • 6.2.2 Policy collector
    • 6.2.3 Installation of posture collectors
    • 6.2.4 Customization of compliance policies
    • 6.2.5 Assigning the policy to the clients
  • 6.3 Deploying the client software
    • 6.3.1 Cisco Trust Agent
    • 6.3.2 IBM Tivoli Security Compliance Manager client
  • 6.4 Conclusion
• Chapter 7. Network enforcement subsystem implementation
  • 7.1 Configuring NAC Framework components
    • 7.1.1 Configuring the Cisco Secure ACS for NAC L2 802.1x
    • 7.1.2 Configuring the Cisco Secure ACS for NAC L2/L3 IP
    • 7.1.3 Deployment of the network infrastructure
  • 7.2 Configuring NAC Appliance components
    • 7.2.1 Installing CCA Agent
    • 7.2.2 Configuring a CCA OOB VG server
    • 7.2.3 Deployment of the network infrastructure
  • 7.3 Conclusion
• Chapter 8. Remediation subsystem implementation
  • 8.1 Automated remediation enablement
  • 8.2 Remediation server software setup
    • 8.2.1 Prerequisites
    • 8.2.2 Tivoli Configuration Manager
    • 8.2.3 Configuration of the remediation server
    • 8.2.4 Installation of the Software Package Utilities
  • 8.3 Creating remediation instructions for the users
    • 8.3.1 Locating HTML
    • 8.3.2 Variables and variable tags
    • 8.3.3 Debug attributes
    • 8.3.4 Creating HTML pages for ABBC policy
  • 8.4 Building the remediation workflows
    • 8.4.1 Modification of the remediation packages
  • 8.5 Conclusion
• Part 3 Appendixes
• Appendix A. Hints and tips
  • Deployment overview
  • Top-level sequence of events
  • Security Compliance Manager and NAC compliance subsystem
  • Cisco NAC sequence of events
  • Fault isolation
  • Security Compliance Manager server and client
    • Communication port usage
  • Tools and tricks
    • Cisco NAC
    • Tools and tricks for the client
    • NAC Appliance details
    • NAC Appliance integration
    • Conclusion
• Appendix B. Network Admission Control
  • Executive summary
  • The benefit of NAC
  • Dramatically improve network security
  • NAC implementation options
    • The NAC Appliance
    • NAC Framework solution
    • Investment protection
  • Planning, designing, and deploying an effective NAC solution
  • The next steps
  • NAC technology
    • NAC Appliance components
    • NAC Framework components
• Appendix C. Additional material
  • Locating the Web material
  • Using the Web material
    • How to use the Web material
• Related publications
  • IBM Redbooks
  • Other publications
  • Online resources
  • How to get IBM Redbooks
  • Help from IBM
• Index
• Back cover