Integrating beSECURE

This guide provides information on integrating Genian ZTNA and beSECURE, a vulnerability management system.

Overview

beSECURE's vulnerability inspection function can be leveraged by Genian ZTNA to inspect new nodes accessing a managed network, and apply Genian ZTNA tags to vulnerable nodes so that they can be blocked and remediated.

Process

1. Genian ZTNA detects new node

2. Genian ZTNA identifies target for vulnerability assessment

3. Genian ZTNA sends request to beSECURE for vulnerability assessment

4. beSECURE performs vulnerability assessment

5. If a vulnerability is found, beSECURE sends an alert to Genian ZTNA

6. Genian ZTNA applies a tag to the vulnerable node

7. Genian ZTNA takes enforcement action against the node

Pre-Requisites

Generating Genian API Key for beSECURE

1. In the Genian ZTNA Web Console, Navigate to Management > User and use the Tasks menu to create a new "superAdmin" account, or use an existing account.

2. In the General section of the User configuration, use the Generate API Key button, then click update.

Prepare Networking

Verify that the Genian ZTNA Policy Server and the beSECURE server can communicate using HTTP TCP/80 and HTTPS TCP/443. Ensure that the session can be initiated in bi-directionlly.

(The connection port information of Genian ZTNA is in System> Service Management> Connection Port in the UI .)

Prepare Genian ZTNA Tag

Create a tag to be assigned to vulnerable nodes under Preferences > Tag, or use an existing tag.

Configuring beSECURE

Create a Contact ID

1. Go to DevOps> Admin> Accounts> Contacts and click the + button to create. The Contact Name and Contact Email have no functional impact on the integrations function.

   Item	Value	Info
   Contact Name	Genian-API	Required input
   Contact Email	contact@genians.com	Email to receive report
   Contact Phone	010-1001-1001	Phone number for Contact ID

2. Click create

Create a Account ID

1. Go to Admin> Accounts> List and click the + button to create.

   Item	Value	Info
   User Name	Genian-API
   Password Status	Never Expires
   Password
   2FA		Disable 2FA
   Security Profile	Default
   Account Profile	Scanning User
   Language	English	Select Desired Language
   Timezone	America/New York	Select desired Timezone
   Contact	Genian API	Select Contact ID created in previous step

2. Click create, and the Account Details screen necessary for the next step should appear.

Create an API Key

This API key will be used by Genian ZTNA to request a vulnerability scan.

1. Click the API Key tab and go to API Generator.

2. Check if the API Key has been properly generated. (If the API Key does not exist, click the blank to automatically generate it.)

Create an Organization

This will create a management group for the vulnerability info requested by Genian ZTNA.

1. Go to Admin> Organizations > List and click the + button to create.

   Item	Value	Info
   Organization Name	Genians
   Parent Name		Optional value
   Logo		Optional value
   Scan Range Modification	Only with Scanner Ownership
   Scan Range Overlapping	Allowed
   Results	Show in Summary

2. Go to the Reporting tab and select the Contact ID (Genian-API) you created earlier.

3. Click create.

Set Up Management Group Authority

1. Go to the Permission tab in Organization Details.

2. Move the following to the right side "Assigned" section

   • Owned By: Genian API

   • Association(s): Genian API

3. click Modfify

Assigning the Scanner

1. Go to Admin> Deployment> LSS, select the scanner to be used, and check the ID of the vulnerability scanner. In our example, it is 6ECA855F. (At this time, note that the scanner must be connected to the target network.)

2. Grant permission to use the scanner.

3. Select Genian API – Genian-API from Available on the left and change it to Assigned.

4. Go to Admin > Accounts > Contacts and select the newly created Contact ID.

5. Go to Owned By in Contact Details and change Genian API-Genian-API to Assigned.

6. After writing as above, click Modify and proceed to the next step.

Set Genian ZTNA Target Server

1. Go to DevOps> More> Server> Integration

2. Click on the Genians logo to set up.

   Item	Value	Info
   URL	https://[Policy-Server IP]:8443	Enter policy Server IP with port 8443, or the URL of your Policy server
   API Key	c6233cfd-a1a8-4ce3-XXXX-61fa87951b38	Enter the API Key generated for your Genian ZTNA superUser account
   Tag Name	beSECURE_Tag	Enter the name of the tag you wish to assign to vulnerable nodes

Configuring Genian ZTNA

Configure Log Filter

To identify nodes that must be scanned and alert beSECURE, a log filter must be created. In this example we will create a filter to identify newly detected nodes that were recognized by a network sensor.

1. Select the Log tab, and click the filter search bar.

2. Enter "New Node detected. BY='SENSOR'" in the Description field.

3. Click Save to the right of the search bar, and configure options on the next screen.

4. Check off the Webhook option, and configure it as shown below:

   Item	Value	Info
   Method	POST
   URL	https:{beSECURE IP}/json.cgi	beSECURE IP
   CHARSET	UTF-8	Optional value
   POST data	See example below	Set contents to be sent to beSECURE, refer to #comment lines for where to find value in beSECURE
   Content-Type	Application/x-www-form-urlencoded

   # POST data inputs
   # apikey is the api key for accessing beSECURE
   apikey=8DF7011F-F05C-3810-XXXX-A6C84B198A1A&
   primary=admin&
   secondary=networks&
   action=quickadd&
   network_range={_IP}&
   network_name=New node {_IP} {_DATETIME}&
   # Organization ID is "network parent".
   network_parent=E9FABA8E&
   # Scanner ID is "network scanner".
   network_scanner=6ECA855F&
   quickadd_webscan=no&
   # Contact ID is "contact".
   contact=00B26938&
   network_routine=immediately
   

Create Grouping and Enforcement Settings

Under Policy > Group:

1. Click Tasks > Create to create a new Node Group.

2. Under General enter an ID and Description and set the Status to Enabled.

3. Under Condition, click Add to add the previously created “beSECURE” tag.

4. Click Save.

Under Policy > Enforcement Policy:

1. Click Tasks > Create to create a new Enforcement Policy.

2. Follow the wizard and select the previously created “beSECURE-vulnerability-detected” Node Group.

3. Select the desired Permissions, enable Captive Portal and enter a message to be displayed to the end user.

4. Click Save.

With all configurations now in place, the Genians Network Sensor must be switched from Monitoring to Enforcement mode to facilitate the Layer 2 quarantine of non-compliant nodes on the network. Navigate to System > Sensor > Edit Sensor Settings and set the Sensor Operating Mode to Enforcement then click Update at the bottom of the page.

Testing and Validation

1. Introduce a machine that contains a vulnerability known to beSECURE into a network segment This machine should be detected as a new node by Genian ZTNA, and trigger the log filter POST alert. (If the node is already known to Genian ZTNA, remove the node from the list using Tasks > Node and Device > Remove Node)

2. beSECURE will conduct a vulnerability assesment of the node.

3. The test node should have Tag assigned once the alert is received from beSECURE.

4. The node will then be Layer 2 quarantined in real-time by Genian ZTNA, and will be prevented from accessing any resources that are prohibited by the Enforcement Policy configured.