HP-UX 11i security-based regulatory compliance

Many regulations: We understand that depending on the nature of your business, you may be required to conform to many different regulations, many of which place requirements on your IT Security. Many regulations are country or region specific (such as Sarbanes-Oxley/USA, and 11MEDIS-DC/Japan, SB-1386/USA-California) though their reach may extend to businesses operating in other regions depending on the particulars of the regulations). 

Many regulations are industry-specific (such as HIPAA for Health Care, NERC for utilities, etc). As a result, a business with customers in different locations or operating out of multiple locations and multiple industries can easily be required to conform to many different regulations at the same time, and be subject to many different auditors and audit procedures. We at HP understand and are here to help.

Most regulations have several elements in common, and compliance efforts may be eased by planning and maintaining your compliance efforts around these common elements, customizing where necessary.  Compliance requires people, process/policy, and tools. 

Several regulatory requirements are primarily human activities, and not computer activities, such as policies and processes related to:

• Business continuity planning
• Physical and environmental security
• Operations training

For those compliance requirements, HP’s security governance solutions provide guidance and consulting services to assist you.

For those compliance requirements which have a significant computer/automation component, such as:

• Operational Enforcement
• Operational Audit and Incident Response

HP and HP-UX 11i provide a rich portfolio of supporting technology (listed below) to ease your compliance burden

HP-UX 11i offers several tools and technologies to help establish and maintain system-access policies once they are created.  Especially relevant are numerous identity management products including:

• Identity Management Integration (IdMI)
• Select Access for IdMI
• Role-based Access Control
• AAA Server
• Red Hat Directory Server
• LDAP-UX Client
• Kerberos Server
• Kerberos Client Services & PAM Kerberos
• Perl-LDAP, sudo, OpenSAML and other open source in HP-UX 11i Internet Express
• Intrusion Detection via Host IDS

Protections are enforced on HP-UX 11i via:

• Secure Protocols
  o Secure Shell
  o IPSec
  o Secure Management Protocols such as WBEM over SSL

• Security Properties
  o Security containment
  o Encrypted volume and file system

• Hardening/configuration
  o Bastille

Security-configuration levels are maintained on HP-UX 11i via:

• Hardened configuration Bastille assessment/drift reporting
• Security bulletin currency with Software Assistant

HP-UX 11i offers many tools and capabilities which provide evidence of working or failed access controls, and policy artifacts to satisfy auditors.  Some of these products include:

• Logging and audit trails from many individual applications
• HP-UX auditing and logging facility
• Select Audit
• Consolidated Logging (Distributive Systems Administration Utilities, syslog)
• OpenView Compliance Manager
• Compliance Log Warehouse