DbProtect Upgrade Guide - Trustwave...An Upgrade Checklist is provided on page . 44 that you can print and use during the upgrade. 2.1 Upgrading from 6.4.2 or 6.4.3 to 6.4.4 . If you

Trustwave DbProtect Upgrade Guide

Version 6.4.9

.trustwave.com Updated October 9, 2007

DbProtect 6.4.9 Upgrade Guide - January 6, 2017

Copyright © 2017 Trustwave Holdings, Inc. All rights reserved. ii

Legal Notice

Copyright © 2017 Trustwave Holdings, Inc.

All rights reserved. This document is protected by copyright and any distribution, reproduction, copying, or decompilation is strictly prohibited without the prior written consent of Trustwave. No part of this document may be reproduced in any form or by any means without the prior written authorization of Trustwave. While every precaution has been taken in the preparation of this document, Trustwave assumes no responsibility for errors or omissions. This publication and features described herein are subject to change without notice.

While the authors have used their best efforts in preparing this document, they make no representation or warranties with respect to the accuracy or completeness of the contents of this document and specifically disclaim any implied warranties of merchantability or fitness for a particular purpose. No warranty may be created or extended by sales representatives or written sales materials. The advice and strategies contained herein may not be suitable for your situation. You should consult with a professional where appropriate. Neither the author nor Trustwave shall be liable for any loss of profit or any commercial damages, including but not limited to direct, indirect, special, incidental, consequential, or other damages.

The most current version of this document may be obtained by contacting:

Trustwave Technical Support: Phone: +1.800.363.1621 Email: [email protected]

Trademarks Trustwave and the Trustwave logo are trademarks of Trustwave. Such trademarks shall not be used, copied, or disseminated in any manner without the prior written permission of Trustwave.

Revision History Version Date Changes

1.0 June 30 2015 • Initial release of draft

2.0 July 24 2015 • Final release for version 6.4.6

2.1 May 15 2016 • Final release for version 6.4.7

2.11 June 27 2016 • Final release for version 6.4.8

2.2 January 5, 2017 • Initial release for version 6.4.9

mailto:[email protected]


Copyright © 2017 Trustwave Holdings, Inc. All rights reserved. iii

Formatting Conventions

This manual uses the following formatting conventions to denote specific information.

Formats and Symbols

Meaning

Blue Underline A blue underline indicates a link to a Web site or e-mail address.

Bold Bold text denotes UI control and names such as commands, menu items, tab and field names, button and checkbox names, window and dialog box names, and areas of windows or dialog boxes.

Code Text in Courier New 9 pt in blue indicates computer code or information at a command line.

Italics Italics denote the name of a published work, the current document, or another document, and are also used for text emphasis, to introduce a new term, and for path names.

[Square brackets]

Square brackets indicate a placeholder for values and expressions.

Notes, Tips, and Cautions

Note: This symbol indicates information that applies to the task at hand.

Tip: This symbol denotes a suggestion for a better or more productive way to use the product.

Caution: This symbol highlights a warning against using the software in an unintended manner.


Copyright © 2017 Trustwave Holdings, Inc. All rights reserved. iv

Table of Contents

Legal Notice ii

Trademarks ......................................................................................................................................... ii Revision History .................................................................................................................................. ii

Formatting Conventions iii

Notes, Tips, and Cautions ................................................................................................................... iii

List of Tables vi

1 Introduction 7

1.1 What’s new in DbProtect 6.4 ........................................................................................................ 7

2 Upgrade Scenarios 9

2.1 Upgrading from 6.4.2 or 6.4.3 to 6.4.4 .......................................................................................... 9 Prerequisites for Your Current Environment .................................................................. 10 2.1.1 System Requirements for DbProtect 6.4.4 .................................................................... 10 2.1.2 Scan Engine Compatibility ............................................................................................. 12 2.1.3 Pre-Upgrade Tasks ........................................................................................................ 13 2.1.4 Upgrade Steps ............................................................................................................... 13 2.1.5 Install and Runtime Privilege ......................................................................................... 14 2.1.6 Upgrading from 6.4.2 to 6.4.4 ........................................................................................ 14 2.1.72.1.7.1 Schema Component Setup ........................................................................... 16

2.1.7.2 SHATTER Knowledgebase Setup ................................................................. 17

2.1.7.3 Data Warehouse Setup ................................................................................. 18

2.1.7.4 Message Collector Setup .............................................................................. 20

2.1.7.5 Analytics Upgrade ......................................................................................... 21

DbProtect Scan Engine Upgrade steps ......................................................................... 23 2.1.8 Post Upgrade Tasks ...................................................................................................... 25 2.1.9

2.2 Upgrading from 6.4.4 to 6.4.9 ..................................................................................................... 26 Prerequisites for your Current Environment .................................................................. 26 2.2.1 System Requirements for DbProtect 6.4.9 .................................................................... 26 2.2.2 Pre-Upgrade Tasks ........................................................................................................ 27 2.2.3 Upgrade Steps ............................................................................................................... 28 2.2.4 Install and Runtime Privilege ......................................................................................... 28 2.2.5 Upgrading from 6.4.4 to 6.4.9 ........................................................................................ 29 2.2.62.2.6.1 Schema Component Setup ........................................................................... 32

2.2.6.2 SHATTER Knowledgebase Setup ................................................................. 34

2.2.6.3 Data Warehouse Setup ................................................................................. 35


Copyright © 2017 Trustwave Holdings, Inc. All rights reserved. v

2.2.6.4 Message Collector Setup .............................................................................. 37

Upgrading from 6.4.4 to 6.4.9, Part 2 ............................................................................ 37 2.2.72.2.7.1 Analytics Upgrade ......................................................................................... 38

DbProtect Scan Engine Upgrade steps ......................................................................... 41 2.2.8 Post Upgrade Tasks ...................................................................................................... 43 2.2.9

3 Upgrade Checklist 44

About Trustwave 45


Copyright © 2017 Trustwave Holdings, Inc. All rights reserved. vi

List of Tables

Table 1: Prerequisites for DbProtect 6.4.2 .............................................................................................. 10 Table 2: System Requirements for DbProtect 6.4.4 ............................................................................... 10 Table 3: Scan Engine Compatibility ........................................................................................................ 12 Table 4: Prerequisites for DbProtect 6.4.4 .............................................................................................. 26 Table 5: System Requirements for DbProtect 6.4.9 ............................................................................... 26


Introduction Copyright © 2017 Trustwave Holdings, Inc. All rights reserved. 7

1 Introduction

DbProtect is a database security and compliance solution that helps organizations control their database security processes in a smart and streamlined way. Designed to scale from small to medium sized business to large enterprises, DbProtect boosts operational efficiency and streamlines key database security activities, while enabling organizations to achieve database security, minimize risk, and achieve regulatory compliance.

DbProtect is comprised of three feature modules:

• Vulnerability Management: capability to locate, examine, and report on database security vulnerabilities and misconfigurations in any database.

• Rights Management: capability to examine and report on an organization’s database user and object privileges, ownership, and access controls.

• Activity Monitoring: capability to track, identifies, and alert on all database activities, suspicious behavior, and threats.

This guide provides instructions on upgrading DbProtect from earlier versions to version 6.4.9. For more information about the various features and how to use DbProtect, refer to the DbProtect Getting Started Guide.

DbProtect 6.4.9 includes a rollup of all patches released through the support portal for users of previous versions of DbProtect.

1.1 What’s new in DbProtect 6.4 The DbProtect 6.4 product series introduces a new look and feel, and a new workflow that simplifies running scans, viewing results, and generating reports.

DbProtect users can easily access and share the security information specifically needed to do their jobs, without exposing data they are not authorized to see — all without running multiple scans on the same assets.

A more granular set of role-based access controls and a new organizational management system help organizations break down the communication silos among information security teams, database groups, and other stakeholders.

Other improvements include:

• Redesigned User Interface Enhances User Experience

• Correlation Engine Detects Toxic Combinations

• Optimized Operational Model Enhances Efficiency

• Streamlined Administration Simplifies Management

• Scan Setup Wizard Speeds Deployment

• New Job Management Improves Operations


Introduction Copyright © 2017 Trustwave Holdings, Inc. All rights reserved. 8

• Redesigned Asset and Credential Management Simplifies Administration

• Enhanced User and Organization Management Streamlines Deployment

• Role Based Access Controls Offer Separation of Duties


Upgrade Scenarios Copyright © 2017 Trustwave Holdings, Inc. All rights reserved. 9

2 Upgrade Scenarios

The following table describes the typical production deployment specifications for various upgrade scenarios. The supported upgrade scenarios are:

• Version 6.4.2 or 6.4.3 to 6.4.9 (you must upgrade to 6.4.4 before upgrading to 6.4.9)

• See “Upgrading from 6.4.2 to 6.4.4” below.

• Version 6.4.4 to 6.4.9

• See “Upgrading from 6.4.4 to 6.4.9” on page 26 for information on upgrading from 6.4.4 to 6.4.9

• Version 6.4.5 or above to 6.4.9

• Follow the steps for upgrading from 6.4.4 to 6.4.9

If you are using a version of DbProtect that is older than 6.4.2, you must upgrade to version 6.4.2 before following any of the above scenarios. To upgrade from a version that is older than 6.4.2, contact [email protected].

Microsoft SQL Server 2005 as a backend is no longer supported from version 6.4.6.

An Upgrade Checklist is provided on page 44 that you can print and use during the upgrade.

2.1 Upgrading from 6.4.2 or 6.4.3 to 6.4.4 If you have DbProtect version 6.4.2 or 6.4.3, you must upgrade to version 6.4.4 before upgrading to version 6.4.9.

mailto:[email protected]



Prerequisites for Your Current Environment 2.1.1The following must be in place for your 6.4.2 environment before you upgrade to 6.4.4.

Table 1: Prerequisites for DbProtect 6.4.2

Assumption Description

A working 6.4.2 environment exists DbProtect 6.4.2 is working correctly and can be accessed.

You are using at least Microsoft Windows Server 2003 SP2

You have access to a DbProtect SuperAdmin user.

The Host Admin user you used to install 6.4.2 is still available (you must upgrade with the same user that was used to install version 6.4.2).

You plan to either upgrade DbProtect with this user, or you are able to log in with this user during the upgrade process.

A sysadmin account exists. You have access to a sysadmin account on the DbProtect backend database. This can be either the user used to install DbProtect, or a SQL login.

You plan on upgrading 6.4.2 in place and retain as much data as possible.

You plan on leaving your Windows Service user and SQL Server authentication and credentials the same.

System Requirements for DbProtect 6.4.4 2.1.2Before upgrading to 6.4.4, ensure that your system meets the requirements.

Table 2: System Requirements for DbProtect 6.4.4

Specification Details

Memory 12-128 GB

Processor x64 Processor 2.0 GHz+ 2-8+ cores

Disk 30 GB for application

250+ GB for temp/output

NOTE: Our benchmarking has shown that disks (whether physical or virtual) having sequential read and write speeds in excess of 100 MB/s yield acceptable performance. This is true for disks on the application server and for the SQL repository.




Operating System One of the following:

• Windows Server 2003 SP2 • Windows Server 2008 • Windows Server 2008 R2 • Windows Server 2012 64-bit Standard Editions or higher

Minimum Windows requirement update: Microsoft Windows Server 2003 SP2

SQL Server Repository Considerations One of the following:

• SQL Server 2005 • SQL Server 2008 • SQL Server 2008 R2 • SQL Server 2012 64-bit Standard Editions or higher

The repository should be installed on a separate host from the application server, typically in a high-performance SQL farm, and actively managed by DBA operations teams.

Note: For UAT environments that want to estimate production level responsiveness, even if a production SQL farm is not used, the I/O responsiveness of the underlying disk and the SQL Server memory/processor configuration should be comparable since they play a key role in performance.

Scan Engines Two or more scan engines, with one or more deployed on independent hosts.

Virtual Environments It is essential for optimal system performance that virtual environment resources not be oversubscribed. On heavily used virtualization hosts, placing the DbProtect and repository VMs in resource groups with reserved resources will yield the best product experience.



Scan Engine Compatibility 2.1.3The following table describes the compatibility of various Scan Engines with supported DbProtect releases. Ensure that your Scan Engine is compatible with the version of DbProtect you are upgrading to.

• FC=Fully Compatible. Can register and will be supported after upgrade.

• PC=Partially Compatible. Will work after the upgrade but will not register as new.

• NS=Not Supported.

Table 3: Scan Engine Compatibility

6.4.4/SE Proxy 2.8

6.4.5/SE Proxy 2.9

6.4.6/SE Proxy 2.10

6.4.6/SE Proxy 2.12

6.4.7/SE Proxy 3.0

6.4.8/SE Proxy 3.0

6.4.9/SE Proxy 3.2

Scan Engine 2.1

NS NS NS NS NS NS NS

Scan Engine 2.2


Scan Engine 2.4


Scan Engine 2.7


Scan Engine 2.8

FC NS NS NS NS NS NS

Scan Engine 2.9

FC FC NS NS NS NS NS

Scan Engine 2.10

NS FC FC NS NS NS NS

Scan Engine 2.11

NS FC (if on SHATTER KB 4.50 or higher)

FC NS NS NS NS

Scan Engine 2.12

NS NS NS FC NS NS NS

Scan Engine 3.0

NS NS NS NS FC FC FC

Scan Engine 3.2

NS NS NS NS FC FC FC



Pre-Upgrade Tasks 2.1.41. Confirm the hardware and Operating System specifications on the system that has the Console

installed.

2. Verify backups were taken of the OS. If working with a Virtual Appliance, ensure that you take a snapshot or backup of the appliances prior to upgrading.

3. Verify that a backup of the Databases was taken.

4. Confirm you are using the same user that ran the original install, or have access to that user.

5. Execute the 6.4.4 verification script.

6. Execute system help check scripts and check for free space on the database host. Free some log file space if necessary.

7. Check for 30 GB plus free disk space on the host and drive where the Console is being installed.

8. Verify you have an admin user that has sysadmin rights on the database for schema change commands.

9. Check whether or not you have URR data – this will require extensive transaction log space during the upgrade.

10. Download the DbProtect Suite and DbProtect Scan Engine Installer files.

11. Download Analytics Content and SHATTER Knowledgebase updates if available for the version you are upgrading to. After the install is complete, you can then specifically upgrade the Analytics Content and SHATTER Knowledgebase to ensure that you have the latest monthly update.

Upgrade Steps 2.1.51. Verify that your server meets the minimum system requirements in regard to RAM, disk space and

backend database. DbProtect Suite 6.4.4 will run a system verifier. If any requirements are not met, you will not be able to continue with the upgrade. See Table 2 for the system requirements.

2. Verify that you will be able to upgrade all your Scan Engines following the DbProtect Suite 6.4.4 upgrade.

3. Make a full backup or copy of all of the DbProtect backend databases - AppDetective, DbPAnalytics, DbPStaging, and DbPDataWarehouse.

4. Prepare to back up your DbProtect 6.4.2 licenses, policies, filters, credential profiles, asset lists and custom dictionaries just in case problems occur during the upgrade.

5. Make a backup of your License files from the C:\Program Files (x86)\DbProtect\Licenses directory.

6. Export your custom Vulnerability Management Policies and exceptions. For further information please review the following Knowledge Base article on our customer portal: https://www3.trustwave.com/support/kb/KnowledgebaseArticle18079.aspx.

7. Export your custom Activity Monitoring Policies and filters. For further information see the aforementioned Knowledge Base article.

8. Log out of DbProtect and close your browser.

9. Stop any local Scan Engines or local Sensors you might have running on the DbProtect server.

10. Run the DbProtect Suite 6.4.4 installer to start the upgrade. This takes you through a series of interactive installation wizards which will upgrade the various DbProtect components on your server.

https://www3.trustwave.com/support/kb/KnowledgebaseArticle18079.aspx



If you are installing on a Windows 2008 server, you must use the right-click option to ‘install as administrator’ to elevate privileges to the highest level.

Install and Runtime Privilege 2.1.6The DbProtect Services can be run either as LocalSystem or a specific Domain user.

The services can only be run as a LocalSystem when the DbProtect backend repository is running on the same machine as the DbProtect Console or when a SQL Server Authenticated User is used to communicate with the backend repository.

If you choose to run services as a specific Domain/Windows user, ensure that it has the “Logon as a service” privilege.

The selected user must be allowed to connect to the Active Directory domain (for such operations as checking user credentials during logon to the DbProtect Console) and must have access to the DbProtect backend databases when using Windows Integrated Authentication.

During the upgrade the Database account should also have sysadmin rights on the SQL Server Instance.

Upgrading from 6.4.2 to 6.4.4 2.1.71. Right click on the Executable file and select Run as administrator. The DbProtect Suite 6.4.4

installer opens, with all components selected that need to be installed.

2. Check the I have read and accept the license agreement check box and click Install. After some components are installed, the DbProtect Enterprise Service Host Setup Wizard displays.



3. Click Next to begin the wizard.

4. On the Service Log On Credentials page, select Run service as LocalSystem or Run Service as (and enter the account and user).

5. Test the credentials (only if Run service as is selected) and click Next.



The DbProtect Enterprise Services Host Service can be run as LocalSystem only when the backend database is on the same machine as the Console OR when a SQL Server Authenticated User is used to communicate with the remote backend at runtime (see next steps for details). If this condition is not in place, a Domain/Windows Account can be used to run this Service.

6. Click Next.

7. On the Ready to install DbProtect Enterprise Services Host page, click Install.

2.1.7.1 Schema Component Setup

1. Click the Finish button to exit the Setup wizard. The DbProtect Schema Component Setup wizard displays.

2. Click Next to start the DbProtect Schema Component Setup. The Database Run Time Credentials page displays.



Ensure that the Database runtime account is ‘dbo’ for all four DbProtect databases.

3. Select Windows Authentication or SQL Authentication and click Test Connection.

If you select SQL Authentication, you must also enter a Login and Password.

4. Click Next.

5. Click Install to begin the installation.

2.1.7.2 SHATTER Knowledgebase Setup

1. Click Finish to exit the DbProtect Schema Component Setup wizard. The Trustwave SHATTER Knowledgebase Setup Wizard displays.



2. Click Next to start the SHATTER knowledgebase Setup.

3. Click Install to start the installation.

2.1.7.3 Data Warehouse Setup

1. Click on Finish to exit the Setup Wizard. The DbProtect Data Warehouse Setup wizard displays.

2. Click Next. The Database Creation Credentials page displays.



3. Select either Windows Authentication or SQL Authentication to create the database. If you select SQL Authentication, you must provide a Login and Password.

4. Click Test Connection and then click Next. The Database Run Time Credentials page displays.

Ensure that the Database runtime account is ‘dbo’ for all four DbProtect databases.




6. Click Test Connection and then click Next.

7. Click Install to install the Data Warehouse.

2.1.7.4 Message Collector Setup

1. Click Finish to exit the DbProtect Data Warehouse Setup wizard. The DbProtect Message Collector Setup Wizard displays.

2. Click Next. The Server Log On Credentials page displays.



3. On the Service Log On Credentials page, select Run service as LocalSystem or Run Service as (and enter the account and password).

4. If you select Run service as, click Test Credentials.

5. Click Next.

6. Click Install to begin the installation of the DbProtect Message Collector.

2.1.7.5 Analytics Upgrade

1. Click Finish to exit the setup wizard. The DbProtect Analytics Upgrade window displays.

2. Click Next. The Cognos 10 Service Log On Credentials page displays.



3. Select Run service as LocalSystem or Run Service as (and enter the account and password). The Cognos Service can be run as LocalSystem if the backend database is installed on the same machine as the DbProtect Console OR if the Run Time User Account (specified in the next step) is a SQL Server Authenticated user.

4. Click Test Credentials (if you selected Run service as).

5. Click Next. The Content Store Run Time User Credentials page displays.

The account that is used in the above step needs to be a ‘dbo’ for all four backend databases.



6. Select either Windows Authentication or SQL Authentication to create the database.

If you select SQL Authentication, you must provide a Login and Password. A SQL Server Authenticated account has to be used if the backend is installed on a different machine than the DbProtect Console and the Cognos Service is being run as LocalSystem.

7. Click Test SQL Connection (only if you select SQL Authentication).

8. Click Next.


10. Click Finish to exit the DbProtect Analytics Upgrade. The DbProtect Analytics Content Setup Wizard displays.

11. Click Next to start the wizard.

12. Click Finish to exit the DbProtect Analytics Content Setup Wizard.

13. Click OK when you see the “successfully installed” prompt.

DbProtect Scan Engine Upgrade steps 2.1.8You must perform these upgrade steps on every host where a Scan Engine is installed.

1. Right click on the Scan engine executable and select Run as administrator. The Trustwave Scan Engine installer displays.



2. Check the I have read and accepted the license agreement box and click Install. The Trustwave Scan Engine Host Upgrade Information page displays.



3. Click Next to begin the setup wizard. The Service Log On Credentials page displays.

4. Provide the service log on credentials. The Service can either be run as LocalSystem or using Domain/Windows account.

5. If you select Run Service as, you must enter an Account and Password. The Domain/Windows Account must have ‘Log On as Service’ rights.

6. Click on Test Credentials (if you selected Run Service as) and click Next.

7. On the Port Selection page, enter a port number or accept the default (20001) by clicking Test Port and then clicking Next.

8. Click Install to begin the Scan Engine host Installation.

9. Click Finish to close the Wizard.

10. Click Close to exit out of the installer.

Post Upgrade Tasks 2.1.91. Log in to DbProtect.

2. Check that organizations and assets are visible.

3. Restart any Scan Engines and Sensors that were stopped prior to the upgrade.

4. Force ETL (extraction, transformation, loading of data into the Data Warehouse).

5. Check that you can access the dashboards and the report library.

6. Run the system diagnostic tool.

7. Create and run test job.

8. Export your 6.4.2 check result data.

9. Install any downloaded monthly updates to the Analytics Content and the SHATTER Knowledgebase.



10. Run a report on the data.

11. Set up your jobs.

2.2 Upgrading from 6.4.4 to 6.4.9 If you are currently using DbProtect 6.4.4 (or you have upgraded from 6.4.2 to 6.4.4), you can upgrade to version 6.4.9.

Prerequisites for your Current Environment 2.2.1The following must be in place for your 6.4.4 environment before you upgrade to 6.4.9.

Table 4: Prerequisites for DbProtect 6.4.4

Assumption Description

A working 6.4.4 environment exists DbProtect 6.4.4 is working correctly and can be accessed.

You are using at least Microsoft Windows Server 2008 (for upgrade in place).

You are using at least Microsoft SQLServer 2008.

You have access to a DbProtect SuperAdmin user.

The Host Admin user you used to install 6.4.4 is still available.

You plan to either upgrade DbProtect with this user, or you are able to log in with this user during the upgrade process.

A sysadmin account exists. You have access to a sysadmin account on the DbProtect backend database. This can be either the user used to install DbProtect, or a SQL login.

You plan on upgrading 6.4.4 in place and retain as much data as possible.

You plan on leaving your Windows Service user and SQL Server authentication and credentials the same.

System Requirements for DbProtect 6.4.9 2.2.2Before upgrading to 6.4.9, ensure that your system meets the requirements.

Table 5: System Requirements for DbProtect 6.4.9


Memory 12-128 GB

Processor x64 Processor 2.0 GHz+ 2-8+ cores

Disk 30 GB for application




250+ GB for temp/output

NOTE: Our benchmarking has shown that disks (whether physical or virtual) having sequential read and write speeds in excess of 100 MB/s yield acceptable performance. This is true for disks on the application server and for the SQL repository.

Operating System One of the following (all 64-bit):

• Windows Server 2008 SP2 • Windows Server 2008 R2 SP1 • Windows Server 2012

Note: Service pack requirements are updated to support .NET Framework 4.6

SQL Server Repository Considerations One of the following:

• SQL Server 2008 • SQL Server 2008 R2 • SQL Server 2012 64-bit Standard Editions or higher

The repository should be installed on a separate host from the application server, typically in a high-performance SQL farm, and actively managed by DBA operations teams.

Note: For UAT environments that want to estimate production level responsiveness, even if a production SQL farm is not used, the I/O responsiveness of the underlying disk and the SQL Server memory/processor configuration should be comparable since they play a key role in performance.

Pre-Upgrade Tasks 2.2.31. Confirm the hardware and Operating System specifications on the system that has the Console

installed.

2. Verify backups were taken of the OS. If working with a Virtual Appliance, ensure that you take a snapshot or backup of the appliances prior to upgrading.

3. Verify that a backup of the Databases was taken.

4. Confirm you are using the same user that ran the original install, or have access to that user.

5. Execute the 6.4.9 verification script.

6. Execute system help check scripts and check for free space on the database host. Free some log file space if necessary.

7. Check for 30 GB plus free disk space on the host and drive where the Console is being installed.

8. Verify you have an admin user that has sysadmin rights on the database for schema change commands.

9. Check whether or not you have URR data – this will require extensive transaction log space during the upgrade.



10. Download the DbProtect Suite and DbProtect Scan Engine Installer files.

11. Download Analytics Content and Knowledgebase updates if available. After the install is complete, you can then specifically upgrade the Analytics Content and SHATTER Knowledgebase to ensure that you have the latest monthly update.

Upgrade Steps 2.2.41. Verify that your server meets the minimum system requirements in regard to RAM, disk space and

backend database. DbProtect Suite 6.4.9 will run a system verifier. If any requirements are not met, you will not be able to continue with the upgrade. See Table 5 for the system requirements.

2. Verify that you will be able to upgrade all your Scan Engines following the DbProtect Suite 6.4.9 upgrade.

3. Make a full backup or copy of all of the DbProtect backend databases - AppDetective, DbPAnalytics, DbPStaging , and DbPDataWarehouse.

4. Prepare to back up your DbProtect 6.4.4 licenses, policies, filters, credential profiles, asset lists and custom dictionaries just in case problems occur during the upgrade.

5. Make a backup of your License files from the C:\Program Files (x86)\DbProtect\Licenses directory.

6. Export your custom Vulnerability Management Policies and exceptions. For further information please review the following Knowledge Base article on our customer portal: https://www3.trustwave.com/support/kb/KnowledgebaseArticle18079.aspx.

7. Export your custom Activity Monitoring Policies and filters. For further information see the aforementioned Knowledge Base article.

8. Log out of DbProtect and close your browser.

9. Stop any local Scan Engines or local Sensors you might have running on the DbProtect server.

10. Run the DbProtect Suite 6.4.9 installer (Part 1 of 2) to start the upgrade. This takes you through a series of interactive installation wizards which will upgrade the various DbProtect components on your server.

If you are installing on a Windows 2008 server, you must use the right-click option to ‘install as administrator’ to elevate privileges to the highest level.

Install and Runtime Privilege 2.2.5The DbProtect Services can be run either as LocalSystem or a specific Domain user.

The services can only be run as a LocalSystem when the DbProtect backend repository is running on the same machine as the DbProtect Console or when a SQL Server Authenticated User is used to communicate with the backend repository.

If you choose to run services as a specific Domain/Windows user, ensure that it has the “Logon as a service” privilege.

The selected user must be allowed to connect to the Active Directory domain (for such operations as checking user credentials during logon to the DbProtect Console) and must have access to the DbProtect backend databases when using Windows Integrated Authentication.

During the upgrade the Database account should also have ‘sysadmin’ rights on the SQL Server Instance.

https://www3.trustwave.com/support/kb/KnowledgebaseArticle18079.aspx



Upgrading from 6.4.4 to 6.4.9 2.2.6

The DbProtect 6.4.9 installation is divided into two executable files. Be sure to run Part 1 and allow all items in this part to finish, and restart the computer if required, before you run Part 2.

1. Right click on the Part 1 of 2 Executable file and select Run as administrator. The DbProtect Suite 6.4.9 installer Part 1 of 2 opens, with all components selected that need to be installed.



2. Check the I have read and accept the license agreement check box and click Install. The System Verifier and prerequisite installations run.

Note: The .NET Framework 4.6 installation may require a system restart. After restart, the installer runs automatically.

3. The DbProtect Enterprise Service Host Setup Wizard displays.

4. Click Next to begin the wizard.

5. On the Service Logon Credentials page, select Run service as LocalSystem or Run Service as local or domain user (and enter the account and password).



6. Test the credentials (only if Run service as local or domain user is selected) and click Next.

Note: The DbProtect Enterprise Services Host Service can be run as LocalSystem only when the backend database is on the same machine as the Console OR when a SQL Server Authenticated User is used to communicate with the remote backend at runtime (see next steps for details). If this condition is not in place, a Domain/Windows Account can be used to run this Service.

7. On the Ready to install DbProtect Enterprise Services Host page, click Install.

8. Click the Finish button to exit the Setup wizard.

9. If prompted to close the DbProtect Scan Engine Proxy, select Automatically close applications and attempt to restart them after setup is complete. Older versions are removed. The 6.4.9 database schema is installed.



2.2.6.1 Schema Component Setup

1. The DbProtect Schema Component Setup wizard displays.

2. Click Next to start the DbProtect Schema Component Setup. The Database Runtime Credentials page displays.

The Database runtime account has to be ‘dbo’ for all four DbProtect databases.



3. Select Windows Authentication or SQL Authentication and click Test Connection.

If you select SQL Authentication, you must also enter a Login and Password.

4. Click Next.


6. Click Finish to exit the DbProtect Schema Component Setup wizard. The Trustwave SHATTER Knowledgebase Setup Wizard displays.



2.2.6.2 SHATTER Knowledgebase Setup

1. Click Next to start the SHATTER knowledgebase Setup. A page displays indicating that Lotus Notes and Domino Server are no longer supported.

2. Select the I understand that Lotus Notes and Domino Server asset types have been de-supported. I agree to proceed with this upgrade check box.

3. Click Next.

4. Click Install to start the installation.



2.2.6.3 Data Warehouse Setup

1. Click on Finish to exit the Setup Wizard. The DbProtect Data Warehouse Setup wizard displays.

2. Click Next. The Database Creation Credentials page displays.

3. Select either Windows Authentication or SQL Authentication to create the database. If you select SQL Authentication, you must provide a Login and Password. The database account for this step requires sysadmin rights.

4. Click Test Connection and then click Next. The Database Runtime Credentials page displays.



The Database runtime account has to be ‘dbo’ for all four DbProtect databases.



7. Click Install to install the Data Warehouse.

8. Click Finish to exit the DbProtect Data Warehouse Setup wizard. The DbProtect Message Collector Setup Wizard displays.



2.2.6.4 Message Collector Setup

1. Click Next. The Server Logon Credentials page displays.

2. On the Service Logon Credentials page, select Run service as LocalSystem or Run Service as local or domain user (and enter the account and password).

3. If you select Run service as local or domain user, click Test Credentials.

4. Click Next.

5. Click Install to begin the installation of the DbProtect Message Collector.

6. Click Finish to exit the setup wizard.

This completes part 1 of the DbProtect installer.

Upgrading from 6.4.4 to 6.4.9, Part 2 2.2.7Right click on the Part 2 of 2 Executable file and select Run as administrator. The DbProtect Suite 6.4.9 installer Part 2 of 2 opens, with all components selected that need to be installed.



2.2.7.1 Analytics Upgrade

1. Check the I have read and accept the license agreement check box and then click Install. The DbProtect Analytics Upgrade window displays.

2. Click Next. The Reporting Engine Service Logon Credentials page displays.

3. On the Reporting Engine Service Logon Credentials page, select Run service as LocalSystem or Run Service as local or domain user (and enter the account and password).

4. If you select Run service as local or domain user, click Test Credentials.

5. Click Next. The Content Store Runtime User Credentials page displays.





8. Click Install to begin the installation of DbProtect Analytics Content. The DbProtect Analytics Content Setup Wizard displays.

9. Click Next to start the wizard.

10. Click Finish to exit the DbProtect Analytics Content Setup Wizard.



11. Click OK when you see the “successfully installed” prompt.



DbProtect Scan Engine Upgrade steps 2.2.8You must perform these upgrade steps on every host where a Scan Engine is installed.

Before starting, note the Operating System service pack requirements for .NET Framework 4.6 (see Table 5).

1. Right click on the Scan engine executable and select Run as administrator. The Trustwave Scan Engine installer displays.

2. Check the I have read and accepted the license agreement box and click Install. Prerequisites are installed if necessary.

Note: The .NET Framework 4.6 installation may require a system restart.



3. After prerequisites have been installed, the Trustwave Scan Engine Host Upgrade Information page displays.

4. Click Next to begin the setup wizard. The Service Log On Credentials page displays.

5. Provide the service log on credentials. The Service can either be run as LocalSystem or using Domain/Windows account.

6. If you select Run Service as, you must enter an account and password. The Domain/Windows Account must have ‘Log On as Service’ rights.



7. Click on Test Credentials (if you selected Run Service as).

8. Click Next.

9. On the Port Selection page, enter a port number or accept the default (20001) by clicking Test Port and then clicking Next.

10. Click Install to begin the Scan Engine host Installation.

11. Click Finish to close the Wizard.

12. Click Close to exit out of the installer.

Post Upgrade Tasks 2.2.9

Note: As a result of security enhancements in DbProtect 6.4.9, you must re-register all Sensors.

1. Log in to DbProtect.

2. Check that organizations and assets are visible.

3. Make a note of the Alias of each Sensor, and then un-register all Sensors. You may need to forcibly unregister.

4. On each Sensor host, un-register the Sensor (using ..\Sensor\util\force_unregister).

5. From the Console, register each Sensor using the same Alias used previously.

6. Restart any Scan Engines and Sensors that were stopped prior to the upgrade.

7. Force ETL (extraction, transformation, loading of data into the Data Warehouse).

8. Check that you can access the dashboards and the report library.

9. Run the system diagnostic tool.

10. Create and run test job.

11. Export your 6.4.4 check result data.

12. Run a report on the data.

13. Set up your jobs.

14. Install any downloaded monthly updates to the Analytics Content and the SHATTER Knowledgebase.


Upgrade Checklist Copyright © 2017 Trustwave Holdings, Inc. All rights reserved. 44

3 Upgrade Checklist

Use the list below to track your progress during each upgrade procedure.

Pre-Upgrade Tasks

Confirm hardware specs on system that has the Console installed are adequate for the installation of the new version

Confirm Operating System version and Service Pack is adequate for the installation (note service packs required have been updated to support .NET 4.6)

Confirm SQL Server version is adequate for the installation

Verify backups were taken of OS

Verify backup was taken of Databases

Confirm you are using the same user that ran the original install or have access to it

Execute verification script

Execute system help check scripts and check for free space on the database host & free log file space

Check for 30 GB + free disk space on the host and drive where console is being installed

Verify you have an admin user that has sysadmin on the database for schema change commands

Check whether or not you have URR data – this will require extensive transaction log space during the upgrade

Download the DbProtect Suite and DbProtect Scan Engine Installer files

Download Analytics Content and Knowledgebase updates

Export credentials

Upgrade Tasks

Uninstall System Verifier (Only required if not installing with original 6.4.2 install user)

Execute DbProtect Suite Installer

Execute Scan Engine Installer


About Trustwave

Trustwave helps businesses fight cybercrime, protect data and reduce security risk. With cloud and managed security services, integrated technologies and a team of security experts, ethical hackers and researchers, Trustwave enables businesses to transform the way they manage their information security and compliance programs. More than three million businesses are enrolled in the Trustwave TrustKeeper® cloud platform, through which Trustwave delivers automated, efficient and cost-effective threat, vulnerability and compliance management. Trustwave is headquartered in Chicago, with customers in 96 countries. For more information about Trustwave, visit https://www.trustwave.com.

https://www.trustwave.com/

Documents

DbProtect Upgrade Guide - Trustwave...An Upgrade Checklist is provided on page . 44 that you can print and use during the upgrade. 2.1 Upgrading from 6.4.2 or 6.4.3 to 6.4.4 . If you