Cisco Security Agent (CSA) is a host-based intrusion prevention system that enforces security policies on various hosts. It was originally called StormWatch and was later acquired by Cisco in 2003. CSA monitors hosts for unusual activity and restricts access and applications based on centralized rules. It provides advantages like monitoring, centralized management, firewall capabilities, application control and file protection. CSA agents communicate with a central management console to log events and receive updated policies.

1. Cisco Security Agent
Eric Vanderburg
May 3, 2006
Eric Vanderburg – Cisco Security Agent

2. Cisco Security Agent (CSA)
• Host based Intrusion prevention system
• Enforces policies on hosts based on specific
rules
• Version 5.1 is the newest
• Called StormWatch in 1999. Purchased by
Cisco in 2003.
• A license is required for the management
console and for all agents
– purchased in bundles from 10-10,000 or individually
– Licenses reside on the Management Console
machine
• Spans a variety of platforms
Eric Vanderburg – Cisco Security Agent

3. Supported Hosts
Server Agent
Desktop Agent
• Windows Server 2003
• Windows 2000 Server
• Windows NT 4 Server
(SP6)
• Solaris 8 SPARC
architecture (64-bit)
• Solaris 9 SPARC
architecture (64-bit)
• Red Hat Enterprise Linux
3.0 ES and AS
• Windows NT 4
Workstation (SP6)
• Windows 2000 Pro
• Windows XP Pro
• Windows XP Tablet
Edition
• Red Hat Enterprise Linux
3.0 WS
Eric Vanderburg – Cisco Security Agent

4. System Requirements
• Windows
– Pentium 200MHz
– 128MB RAM
– 25MB free hard drive space
• Solaris
– UltraSPARC 400 MHz
– 256MB RAM
– 25MB free hard drive space
• Linux
– 500 MHz or faster x86 processor (32-bit only)
– 256MB RAM
– 25MB free hard drive space
• No support available yet for Macintosh
Eric Vanderburg – Cisco Security Agent

5. Advantages
•
•
•
•
•
•
Monitoring
Central reaction
Distributed Firewall
Application Control
File Protection
Restrict by Posture
Eric Vanderburg – Cisco Security Agent

6. Monitoring
• Monitors the following to see whether or
not actions should be allowed:
– OS kernel usage
– Resources
– Registry entries (Windows)
– COM object access
– Inbound and outbound network connections
Eric Vanderburg – Cisco Security Agent

7. Interceptors
• Track actions and compare against the
rules database for appropriate response
– Network Traffic interceptor - Use for SYN
flood and port scan protection.
– Network Applications interceptor - Limit or
allow individual applications to access the
network via specific protocols and networks
addressing parameters.
– File interceptor - Limit an application's ability
to read and write to specific files and
directories.
Eric Vanderburg – Cisco Security Agent

8. Central reaction
• Agents report to a single
management console
• Events are logged to the
management console so
that new rules can be
dynamically created.
– If the management
console is unavailable,
they are stored until
connection is restored
Eric Vanderburg – Cisco Security Agent

9. Distributed firewall
• Control which applications can act as a
server to remote clients and vice versa
• Learning mode: builds a list of allowed
applications based on usage
– Only adds to the policy. Does not override the
central policy from the management console
• Disables the Windows firewall when
installed
Eric Vanderburg – Cisco Security Agent

10. Application control
• Restrict access to certain programs
– Restrict by user or system account
• Restrict the actions applications can take
Eric Vanderburg – Cisco Security Agent

11. File protection
• Files can be flagged as not available to
any network connection
• Can stop files from being deleted,
modified, or created
Eric Vanderburg – Cisco Security Agent

12. Trust
• Hosts must be trusted before they will be
allowed network access.
• Given a posture of quarantined until
trusted
• Trusted hosts
– Virus free & updated
– Accessing from an appropriate medium
– Adhering to policies
– MAC and IP address are on an approved list
Eric Vanderburg – Cisco Security Agent

13. Management Console
•
•
•
•
Agent Configuration
Policy Configuration
Centralized reporting
Similar interface to other Cisco
management tools
• Alerts can be integrated with alerts from
other Cisco security products via the Cisco
Security Monitoring, Analysis, and
Response System
Eric Vanderburg – Cisco Security Agent

14. Management Console
• Access via web browser (IE and Firefox
only) using 128-bit SSL, port 443
• URL: http://<management center system
hostname>.<domain>
Eric Vanderburg – Cisco Security Agent

15. Database
• Local Database - MSDE (Microsoft Database Engine) is
used for setups less than 500 agents and under 2GB
(packaged with install)
• Remote Database - SQL Server is used for setups with
more than 500 agents
Eric Vanderburg – Cisco Security Agent

16. Agent
• Installed per host
– Admin rights
– Through software deployment solution
• Messages - shows denied actions since last
reboot
• User Query Responses - stored answers (Yes,
No, Terminate)
• System Security - Slide bar for off, low, med,
high settings & resume from install mode
• Untrusted apps - selected by user after prompt
Eric Vanderburg – Cisco Security Agent

17. Agent
• Local Firewall Settings
– Learning Mode
– Enable / Disable
– Firewall permissions
•
•
•
•
Email network permission
HTTP network permission
Network client permission
Network server permission
• File Protection
• Solaris agent is not a
GUI app. The CLI
utility csactl is used.
• No queries either
Eric Vanderburg – Cisco Security Agent

18. Communication
• PC to MC: SSL TCP 1741 & 1742
• MC to PC: SSL TCP 443 & 5401
– Signed with MC Certificate
• Updates retrieved through pull model at
specified interval (default 10 minutes)
• Push method: Hints
Eric Vanderburg – Cisco Security Agent

19. Cisco Security Agent
• Locally enforced, centrally managed
• Multiple vendors supported
• Settings can run in test mode before
implementation
• Safeguard nodes, files, attack avenues,
and stop virus propagation.
Eric Vanderburg – Cisco Security Agent

20. Questions?
• Contact info: evanderburg@gmail.com
• Blog: http://spaces.msn.com/professornova
Eric Vanderburg – Cisco Security Agent