EMC® VNX® Series Security Configuration Guide for VNX

VNX and RSA Envision

To make VNX storage systems even more secure, they also leverage the continuous collecting, monitoring, and analyzing capabilities of RSA enVision. RSA enVision performs the following functions:

• Collects logs - Collects event log data from over 130 event sources - from firewalls to databases. RSA enVision can also collect data from custom, proprietary sources using standard transports such as Syslog, OBDC, SNMP, SFTP, OPSEC, or WMI.
• Securely stores logs - Compresses and encrypts log data so that it can be stored for later analysis, while maintaining log confidentiality and integrity.
• Analyzes logs - Analyzes data in real time to check for anomalous behavior that requires an immediate alert and response. The RSA enVision proprietary logs are also optimized for later reporting and forensic analysis. Built-in reports and alerts allow administrators and auditors quick and easy access to log data that is easy to understand.

RSA enVision collects and analyzes administrative events logged by VNX storage systems, and creates logs of this information that it stores on the VNX storage system. This gives auditors easy access to scheduled and unscheduled reports about administrative events that occurred on VNX storage systems; the auditor does not have to access the actual device itself or have knowledge of VNX administrative applications. Specific use cases include:

• Providing an audit trail for making copies of data
• Alerting and reporting when replication services malfunction
• Creating reports on daily device configuration changes
• Creating alerts and reports about user actions
• Creating alerts about disks that are removed