Getting started with Cloud Security Watcher

Available in VPC

If you have checked the support environment and requirements for Cloud Security Watcher and familiarized yourself with the preparations and glossary, you are ready to start using Cloud Security Watcher. The first thing to do now is to request subscription for the Cloud Security Watcher service. You can request subscription to Cloud Security Watcher and manage your subscription in NAVER Cloud Platform's console.

Request subscription

The following describes how to request a subscription to Cloud Security Watcher:

1. Access the NAVER Cloud Platform console.
2. From the Platform menu, click and select VPC.
3. Click Services > Security > Cloud Security Watcher.
4. Click the [Request subscription] button.
5. Read the Terms and Conditions, agree to them, and then click the [Confirm] button.

Create Cloud Security Watcher

The following describes how to create Cloud Security Watcher.

1. Click the Services > Security > Cloud Security Watcher menu in NAVER Cloud Platform console one by one in order.
2. Click the Dashboard menu.
3. Click the [+ Create CSW] button.
4. Enter the group information to be created in accordance with the conditions.
   
   • Group name: basic unit that can be checked on the dashboard. Can check assets included in the group
   • Administrator ID: dashboard administrator’s ID
   • Administrator name: dashboard administrator’s name
   • Email: email information that is used to issue a temporary password or find the password
   • Manager access IP: the main public IP that allows connection to Cloud Security Watcher dashboard
5. Click the [Create CSW] button when you've entered all the information.
6. Check the email sent to the registered email.
   

Group details screen

The Cloud Security Watcher group details consist of the following:

Set admin account

An admin account is required to access the Cloud Security Watcher manager and use features such as user account registration and use connected accounts. The initial setup of the admin account is as follows.

1. Check the temporary password issued to the email registered when creating the Cloud Security Watcher group.
   
2. From the NAVER Cloud Platform console's Platform menu, click and select VPC.
3. Click Services > Security > Cloud Security Watcher.
4. Click the Dashboard menu.
5. Click the [Access dashboard] button to connect to the manager.
   
6. Enter the necessary information to log in.
   
   • ID: admin ID registered when creating the Cloud Security Watcher group
   • PASSWORD: temporary password issued to the email when creating the Cloud Security Watcher group
7. Change the password.
8. Log in with the changed password.

User account registration

The following describes how to register a user account that can access the Cloud Security Watcher manager.

1. From the NAVER Cloud Platform console's Platform menu, click and select VPC.
2. Click Services > Security > Cloud Security Watcher.
3. Click the Dashboard menu.
4. Click the [Access dashboard] button to connect to the manager.
5. Log in with the admin account.
6. Click the Settings > Basic settings menus, in that order.
7. Click the [Activate user] tab menu.
8. Click the [Add] button.
   
9. When the Add user pop-up window appears, enter the information for the user account.
   
10. Click the [Save] button.
11. Select a group for the user under the menu [Group] and click the [Grant permission] button.
    
12. Grant permission and click [Save] button.
    

Set access IP

The following describes how to configure access IP for user accounts that are trying to accessing Cloud Security Watcher manager.

1. Log in to the Cloud Security Watcher manager as an admin.
2. Click the tap menu Setting > Basic settings > [Activated user].
3. Click [Edit] of the user account for which the public IP will be set.
   
4. Click on the add button under Public IP Setting on User edit page in order to add a public IP.
   
5. Click the [Save] button.

Use connected accounts

Cloud Security Watcher manager provides API-based and agent-based multi-cloud environment management and auditing. In order to use the API method, you need to add a connected account. How to add a connected account is as follows.

1. From the NAVER Cloud Platform console's Platform menu, click and select VPC.
2. Click Services > Security > Cloud Security Watcher.
3. Click the Dashboard menu.
4. Click the [Access dashboard] button to connect to the manager.
5. Log in with the admin account.
6. Click the Settings > Basic settings menus, in that order.
7. Click the [Group] tab menu.
8. Select the group to add the connected account to.
9. Click the [+ Add] button in the Connected account menu.
   
10. Register the cloud account information to connect.

How to connect NAVER Cloud Platform accounts

• Accounts connected to Cloud Security Watcher are sub accounts created in Sub Account, an account management service of NAVER Cloud Platform.
• Cloud Security Watcher supports NAVER Cloud Platform private account connection.
• For account connection, specific permission (NCP_ADMINISTRATOR) is required.

The following describes how to create a sub account and assign permissions.

1. Access the NAVER Cloud Platform console.

2. Click the Services > Management & Governance > Sub Account > Sub Accounts menu, in that order.

3. Click the [Create sub account] button.

4. Enter the sub account information.

5. In the Sub Accounts menu, click the login ID of the created sub account.

6. Click the [Add] button.

7. Select and add the NCP_ADMINISTRATOR policy from System Managed policies.
   

8. Click the [Access Key] tab menu.

9. In Sub account details > Policy, click the [Add] button to generate an API authentication key.
   

10. Proceed through items 1 to 9 of use connected accounts.

11. Set the cloud item to NCP.

12. Enter your account and API authentication key information (Access Key ID, Secret Access Key).
    

    Note

    LoginAlias is automatically registered after validation, so no separate input is required.

13. Click the [Account validation] button.

14. Once the validation is complete, click the [Save] button.

How to connect Multi Cloud accounts

Connecting the AWS of the Cloud Security Watcher and the Azure cloud account allows you to manage multi cloud asset. Check [Help] on connection by cloud, provided in the Add a connected account and add a connected account.

Manage asset

When you register a connected account in the Cloud Security Watcher manager, the cloud assets of the connected account are retrieved using the API method. Depending on your preferences, you can exclude specific assets or re-import them.

Set up asset exclusion

To exclude specific assets from the imported assets:

1. Log in to the Cloud Security Watcher manager as an admin.
2. Select Settings > Basic settings > Group.
3. Select the appropriate group from Group status.
4. Click on the relevant connected account.
5. In the account details, click the [Assets] button.
6. Select the assets to exclude.
7. Click the [Exclude asset] button.
8. Select the unmanaged assets of the relevant group from Group status.
9. You can check the list of excluded assets.
   

Reset managed assets

The following describes how to re-import excluded assets:

1. Log in to the Cloud Security Watcher manager as an admin.
2. Select Settings > Basic settings > Group.
3. Select the unmanaged assets of the relevant group from Group status.
4. Select the assets to re-import.
5. Click the [Move managed assets] button.
   

Manage subgroup

You can use the Cloud Security Watcher manager to create a subgroup within a group and add assets to perform the management of grouped assets.

Create subgroup

Take the following steps to create a subgroup.

1. Log in to the Cloud Security Watcher manager as an admin.
2. Select Settings > Basic settings > Group.
3. Select the appropriate group from Group status.
4. Click the [+ Create subgroup] button.
   
5. Specify Group name and Group description.
6. Click the [Save] button.
   
7. You can view the subgroup you've created under Group status.

Add or delete subgroup assets

Take the following steps to add or delete assets in a subgroup.

1. Log in to the Cloud Security Watcher manager as an admin.
2. Select Settings > Basic settings > Group.
3. Select a subgroup to add assets to under Group status.
4. Click the [+ Add asset] button.
   
5. Select an asset to add.
   
6. If you click the Region/Resource Group area in the connected account, you can see the added assets.
   
7. If you want to delete an asset, select an asset to delete from the asset information of the Asset tab and click the [Delete] button to delete it.
   

Delete subgroup

Take the following steps to delete a subgroup.

1. Log in to the Cloud Security Watcher manager as an admin.
2. Select Settings > Basic settings > Group.
3. Select a subgroup to delete from Group status.
4. Click the Region/Resource Group area in the connected account.
5. Delete all assets from the asset information of the Asset tab.
6. Make sure no data exists in the connected account.
   
7. Click the [Delete] button in Group status.
8. Make sure the subgroup is successfully deleted.

Install agent

Cloud Security Watcher also supports an agent method for more precise data collection and analysis. In the case of the agent method, the server resource information can be collected by the manager by installing the agent on the server.

• The agent specifications provided by Cloud Security Watcher can be found in Prerequisites for using Cloud Security Watcher.
• Set the communication permission rules for TCP ports 443 and 8086 in the ACG console outbound rule settings menu on the server where you want to install the agent to allow Manager to collect host information.

Windows version

1. Access the Cloud Security Watcher manager.
2. Click the [i] button located at the upper right corner of the Manager.
   
3. Download the agent that meets the supported specifications.
4. Unzip the downloaded file.
5. Run the CSWHost-install.exe installation file.
6. Go to Start > Run > services.msc and check if there is a list of agents.

Linux version

1. Access the Cloud Security Watcher manager.

2. Click the [i] button located at the upper right corner of the Manager.
   

3. Download the agent that meets the supported specifications.

4. Run Terminal and go to the location where the downloaded file is located.

5. Enter the following command to copy the agent installation files to the /tmp directory.

   # cp CSW-<version_name>.tar.gz /tmp
   

6. Go to the tmp directory.

7. Enter the following command to unzip the installation file.

   # tar –zxvf CSW-<version_name>.tar.gz
   

8. Go to the CSW-<version_name> directory.

9. Run the following command to install.

   # ./install.sh
   

10. AstAgentMon Service Start : press the [Enter] key to end the installation after entering Y in the [Y] input box.

11. Enter the following command to check the service status.

    # ps –ef | grep Ast
    

Delete agent

To delete the agent provided by Cloud Security Watcher:

Windows version

1. Download the same file you downloaded for agent installation.
2. Unzip the downloaded file.
3. Run the CSWHost_Uninstall.exe installation file.
4. Check whether the service has been deleted from the list of services.

Linux version

1. Download the same file you downloaded for agent installation.
2. Run Terminal and go to the location where the downloaded file is located.
3. Enter the following command to copy the agent deletion files to the /tmp directory.

   # cp CSW-<version_name>.tar.gz /tmp
   

4. Go to the tmp directory.
5. Enter the following command to unzip the installation file.

   # tar –zxvf CSW-<version_name>.tar.gz
   

6. Go to the CSW-<version_name> directory.
7. Run the following command to uninstall the agent.

   # ./uninstall.sh
   

8. Put Y in all Y/N questions.
9. Ensure that the processes and directories have been deleted.

   # ps –ef | grep Ast
   

Cancel subscription

You can cancel the subscription to Cloud Security Watcher from NAVER Cloud Platform console. You can cancel the subscription at any time, but please take note of the billing standard when canceling. The following describes how to cancel your subscription.

1. From the NAVER Cloud Platform console's Platform menu, click and select VPC.
2. Click Services > Security > Cloud Security Watcher.
3. Click the Dashboard menu.
4. Click the [Delete CSW] button.
   
5. Enter the Group information.
   
6. Click the [Delete] button.
7. Click the Subscription menu.
8. Click the [Product in use] button, and then click [Cancel subscription].
9. Check the notification in the confirmation pop-up window and click the [Confirm] button.