IBM Guardium V10.0 Software Appliance Technical Requirements

• Hardware offering – fully configured physical appliance provided by IBM.
• Software offering – software images deployed on customer hardware either directly or as virtual appliances.

Product overview

IBM® Security Guardium® is a unified, cross-platform solution that both protects databases in real time and automates the entire compliance auditing process. The solution supports all major database platforms, enterprise applications, and operating systems (UNIX, Linux, Windows, and z/OS).

IBM Security Guardium can be deployed in a variety of operational modes:

• Collector – In Database Activity Monitoring or Vulnerability Assessment, the collectors monitor and analyze database activity to provide continuous fine-grained auditing and reporting, real-time policy-based alerting and database access controls.
• Central Manager/Aggregator –The Central Manager is a single point of management for the entire IBM InfoSphere Guardium deployment. With the Central Manager, customers can define enterprise-wide policies, alerts, queries and reports, install patches, push configuration and perform a variety of other administrative tasks from a single console. In addition, data from multiple collectors can be aggregated to the Aggregation Server to provide holistic views and generate enterprise-level reports.

The following hardware requirements are necessary for the IBM Security Guardium solution to work properly. Unless specified otherwise, the requirements are for both the physical installation and the virtual installation.

Installation on Physical Appliances

The IBM Guardium solution works only on x86 Intel-based or AMD-based platforms (for example, x86_64). Only platforms and hardware that are officially supported by RedHat Linux 6.5 (64-bit) are expected to work properly (See links to RedHat Support documentation, listed at end of this document). However, not all officially supported platforms are guaranteed. Platforms that require additional drivers or specialized post-install configuration are not supported at this time (see note below).

Note: If a customer has an appliance they know will require additional configuration beyond the standard RedHat 6.5 (64-bit) installation, then that customer should install RedHat 6.5 (64-bit) and record all the installation time choices and any post-install configuration steps. Send this information to Guardium Technical Services for analysis and, based on the analysis, they may be able to provide a software update to support this platform.

Deviations from the specifications in this document may result in failure to install the solution, in such cases, the appliance might not be accessible over the network and IBM Guardium Technical Support engineers will not be able to assist in troubleshooting and remediation.

Appendix A lists examples of platforms that were tested and approved by IBM.

Installation on Virtual Appliances

While IBM Guardium can be installed on any VMware product, the VMware ESX server is the recommended platform for a virtual solution. Only VMware is supported by Guardium as the platform for a virtual solution.

Notes:

2. When using the virtual solution, Database Activity Monitoring must be done via S-TAP agents. Over-the-network inspection through SPAN port or Tap device is not supported for the virtual offering.

3. VMware introduces additional complexity. The overall performance and utilization of your Guardium virtual appliance may vary based on VMware configuration, resource allocation, and/or sizing planning.

Recommended Resources per software/virtual appliance

Important: The installation of the software appliance will wipe the disk, repartition and reformat the disk, and install the InfoSphere Guardium solution as a newly installed operating system.

Refer to the Appliance Installation Guide for step-by-step instructions on configuration and installation. The separate Appliance Installation Guide also provides information on how to customize the partitioning on the appliance and how to install on a remote drive (SAN). Installation on a SAN is supported; installation on a NAS is not supported.

Guardium support for 10G network cards

The 10G network cards must be supported by the appropriate version of RedHat Enterprise Linux (RHEL) (RedHat 6.5 for Guardium v10x series).

Sizing Recommendations

Standard Appliance Specification

There are four configurations of the IBM m3550 M4 shipped by IBM:

· Collector x2000 64-bit

· Aggregator x2000 64-bit

· Collector x3000 64-bit

· Aggregator x3000 64-bit

Note: In general, hardware specifications and configuration should follow manufacturers' best-practices to optimize performance. For example on the topic of memory configuration, make sure that the DIMMs are both balanced and matched, otherwise you will not take advantage of the full capacity of the appliance.

Collector x2000 64-bit

Aggregator x2000 64-bit

Collector x3000 64-bit

Aggregator x3000 64-bit

For complete information on the IBM x3550 m4 appliance, including physical and environmental information, see:

http://www.redbooks.ibm.com/abstracts/tips0851.html#physical or

http://www.redbooks.ibm.com/abstracts/tips0851.html

Sizing: Number of collectors for DAM

The collectors analyze database traffic in real-time. To guarantee full coverage, there must be enough capacity to handle the traffic without buffering or delay.

Use the table below to define the number of collectors needed for your environment. The table lists the number of database PVUs or VUs that can be handled by a single collector for each of the audit modes.

For more Information on PVU and VU metrics:

- http://www-01.ibm.com/software/lotus/passportadvantage/pvu_licensing_for_customers.html

- http://www-03.ibm.com/systems/z/resources/swprice/zipla/vue.html

Sizing notes:

- For virtual solutions, add at least 50% more collectors

This is due to known limitations of VMware with parallel processing. Adding hardware to the host or the virtual appliance is not as efficient as adding resources to a physical server.

- For Data-Level Access Control (S-GATE), add at least 50% more collectors to guarantee minimal latency

- When using servers with a different hardware configuration than the standard one, the sizing metrics should be adjusted to reflect the difference in performance between this configuration and the standard appliance as listed in the previous table.

- Based on resource allocation and performance on your VMware ESX, you may need further configuration changes or additional appliances.

Sizing: Number of collectors for Vulnerability Assessment Solution

The Vulnerability Assessment solution scans the databases in scope one by one. This solution does not analyze database traffic and does not require as many resources as Database Activity Monitoring.

Use this sizing metric: One collector for every 255 database instances

Sizing: Number of Aggregators

Use this sizing metric: 1 aggregator for every 8 collectors.

Appendix A: Certified Hardware, Detailed Specifications

The table below lists examples of platforms for IBM Guardium tested by IBM and approved as suitable for running the Guardium solution. Some platforms listed here are no longer offered, but give a sense of what types of configurations have worked in the past. It is impossible to test all possible platforms.

The choice of hardware may impact the total throughput of how many PVUs a collector can handle. The standard configuration is an IBM x3550 M4.

When selecting one of the listed systems, make sure the CPU, RAM, Cores, Disk Size and other configuration requirements are used (see the Recommended Resources table earlier in this document).

Hardware changes rapidly, for example, quad-core to eight-core. The InfoSphere Guardium application is fairly tolerant of the kind of changes seen in hardware platforms over the past few years.

This list is continually updated and subject to change.

For more information, go to the following online resources:

IBM Security Guardium home page: http://www.ibm.com/software/data/guardium/

Technical Support home page: http://www.ibm.com/support/entry/portal/Overview/Software/Information_Management/InfoSphere_Guardium

The "Deployment Guide for IBM Guardium" was released in Dec. 2013 and is now available for the general public at the IBM Redbooks link below.

http://www.redbooks.ibm.com/Redbooks.nsf/RedpieceAbstracts/sg248129.html

RedHat hardware compatibility, http:/www.redhat.com/rhel/compatibility/hardware/

RedHat Enterprise Linux (RHEL) Release notes/ Technical notes

https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/5/html/5.9_Release_Notes/

https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/5/html-single/5.9_Technical_Notes/

2015 August

IBM Guardium Version 10.0 Licensed Materials - Property of IBM. © Copyright IBM Corp. 2015. U.S. Government Users Restricted Rights - Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

IBM, the IBM logo, and ibm.com® are trademarks or registered trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at “Copyright and trademark information” (www.ibm.com/legal/copytrade.shtml)