Watchfire® WebXMTM 4.5 Service Pack 6 Readme


Overview

This document contains release notes for WebXM Server components. WebXM Server is composed of the Control Center; Content, Infrastructure and Interaction Agents; and the Agent and Alert Services. The release notes provide installation notes for the product and any issues that were discovered prior to its release.


What's New

  • AppScan Enterprise: Taking the enterprise features and scalability of WebXM and integrating it with the market-leading AppScan web application vulnerability scanning technology, AppScan Enterprise provides:
    • Centralized command of enterprise wide application scanning, reducing bottlenecks from current one-at-a-time approach
    • AppScan Integration to upload AppScan scan results into a central database for enterprise reporting and trending data to gauge improvements over time
    • Issue management features that enable security teams to prioritize issues and filter noise
    • Executive dashboard views and the ability to share reports throughout the organization
    • Access permission controls to restrict who has access to what - 80% of hacks occur from internal sources
    • Scanning improvements including multi-threaded scanning, JavaScript, and advanced login support
  • Banking Compliance: the Banking Compliance module is now productized in WebXM. This is a set of approximately 1 dozen reports that incorporate a myriad of banking regulations.
    • From advertising trigger terms to rate disclosures, from web linking relationships to customer identification programs, the Banking Compliance module analyzes web content and verifies that language and items on the website comply with federal consumer protection requirements including the Equal Credit Opportunity Act, the Truth in Lending Act and the Truth in Savings Act. The Banking Compliance module provides measurable information that compliance and legal professionals, internal auditors and On-Line Risk Management executives require to self-assess and self-correct their most intricate online regulatory problems.
  • The ability to select one or more multiple words from the Spelling Errors report and identify them as “acceptable dictionary words” directly from the report page.  This feature is available to users that have the Report Pack Administrator role.
  • Dashboards now have a default data maintenance period of 12 months.
  • Issues surrounding an Oracle-based upgrade from 4.0 to 4.5 have been addressed in WebXM 4.5 SP1
  • Siteminder Integrated authentication is no longer supported
  • Enhancements to Virtual Browser to address memory consumption issues
  • Extended property "WFCOnlyOnClick" will prevent VB from executing all mouse events, except for the onclick event, which MAY improve performance
  • Provides compatibility with AppScan 7.6 (7.6.883) security rules

Minimum System Requirements

System Hardware and O/S

  • Pentium 4 1.8 GHz (2.5 GHz recommended)
  • Windows 2000 SP4, Windows XP SP2, or Windows Server 2003 SP1
  • 1 Gig RAM (2GB RAM recommended)
  • 200 MB hard disk space (10 GB of free space on the system hosting the database, 80 GB of free space if security analysis is being done)

Additional Recommended Hardware Requirements

The following recommendations will increase WebXM performance and are highly recommended for larger sites:

  • Separate computers for Content Agents and Database Server
  • Control Center Server running on the same system as the Database Server. If the DB is running on a UNIX system the Control Center Server should run on a separate box and not on a machine that is running scans.
  • Configure Database Server as a server class machine, with dual processor, Pentium Class PIII-1 GHz, SCSI disk array configured as RAID(0).

Database

  • SQL Server 2005 SP1, SQL Server 2000 SP3 or higher, MSDE 2000 SP3 or higher (SQL Server 2000 Desktop Engine) or Oracle 9i Release 2 (9.2.0.1)
  • Note: Release 9.2.0.4 or higher of the Oracle OLE DB provider is required if a Oracle 9i Release 2 (9.2.0.4 or higher) database server is used
  • Note: MSDE 2000 is included on the WebXM installation CD.

Browser

  • Content Agent, Interaction Agent and Agent Service:
    Internet Explorer 6.0 SP1 or higher
  • Control Center used for administration, job creation and report creation and viewing:
    Internet Explorer 6.0 SP1 or higher
  • Control Center used exclusively for report view:
    Internet Explorer 6.0 SP1 or higher, Firefox 1.5 or higher

Additional Requirements

  • It is highly recommended that, prior to the installation of WebXM, all the latest Critical Updates from Microsoft for your operating system are installed.
  • To install the Control Center, the system must have IIS 5.0 or higher installed.
  • Flash User Input Pages require that Flash be installed. Click here to download now.
  • The soft copy of the user manual requires Adobe Acrobat Reader. Click here to download now.
  • On Windows Server 2003, please ensure that ASP and ASP.NET are installed.

Installation Notes

  • On Windows Server 2003, the Internet Explorer Enhanced Security Configuration can cause several problems:
    • The links to install programs on the default installation page don't work.
    • Redirects don't always work, which can cause Jobs to produce incorrect results and causes links in the Interaction Tutorial to fail.
    • JavaScript Execute and Flash will not work.
  • To disable Internet Explorer Enhanced Security Configuration, go to Control Panel->Add or Remove Programs->Add/Remove Windows Components, Select Internet Explorer Enhanced Security Configuration, click Details..., and uncheck either For administrator groups or For all other user groups, as appropriate for the particular account (the designated Service Account on Agent computers).
  • If Norton Anti-Virus is running on the server when WebXM is being installed, it may display a "malicious script" warning on regread, regwrite, and filesystemobject operations during install. These operations are required for the install and the warning can be ignored to allow the successful installation of WebXM.
  • Ensure that the configuration wizard is run for all instances and on all servers when upgrading.
  • With the addition of the On-line Risk Management Dashboard, WebXM now has two dashboards that show the overall health of your website. My Watchfire contains the new On-line Risk Management Dashboard. The previous dashboard is still available and has been renamed My Watchfire Classic.
    • When upgrading from versions of WebXM earlier than 4.0, My Watchfire Classic is used as the default start page for all users. Individual user profiles and the default user profile may be modified in order to select a different starting dashboard.
    • For new installations of WebXM, My Watchfire is used as the starting dashboard for all users. To make My Watchfire Classic the default dashboard for all new users, a WebXM Administrator can modify the Default user profile to specify My Watchfire Classic as the starting dashboard before adding the users. The starting dashboard for specific users can also be modified this way.


Known Issues and Workarounds

All Server Modules

§         Significant scan improvements in AppScan Enterprise 4.5 SP1 have, in some cases, increased the length of a scan.

§         All historical data in the security reports will be lost in an upgrade from SecurityXM 4.0 SP5 to ASE 4.5. This is a result of new issue categories being added in AppScan Enterprise 4.5. These categories were introduced to match those of AppScan 6.0. These new categories also align with current WASC threat classifications. Additionally, the way issues are being counted has changed in ASE 4.5, as each variant is no longer counted individually. This means the aggregate number of issues in ASE 4.5 would drop significantly from what would have been reflected in SecurityXM 4.0. Only the reports will be lost, and not the job set properties. The job can be re-run. You will need to specify IP ranges for the scan.

    • It should be noted the job setup/properties will remain intact and only the report data will be lost. This means the user can re-run the job with the existing configuration to get up-to-date security reports.

§         If a word already exists in the dictionary in upper case form and, through the Spelling Errors reports, you attempt to add the lower case version of the word an error will occur.  The lower-case version of the word can still be added to dictionary manually.  Lower-case words in the dictionary will find the upper or lower case version of the word on the website acceptable.  If a word is in upper case in the dictionary only upper-case versions of that word will pass.

§         For existing SecurityXM customers upgrading to WebXM 4.5 on Windows Server 2003, any attempt to import an AppScan Results File greater than 20 meg in size will result in a file not found error. The workaround is documented in the Help files on the import scan page.

§         If an account other than ASPNET has been configured to host ASP.NET, that account needs to be granted certain privileges in Local Security Settings.

    • On Windows 2000, the "Act as part of the operating system" privilege.
    • On Windows 2000 SP4 or later, and on Windows Server 2003, the "Impersonate a Client after Authentication" privilege.

§         A user must run IE in the account that is running the Watchfire WebXM Agent Service at least once for the execute JavaScript or InteractionXM scripts to function. Both of these features use components of the IE browser. If the browser has not been run, the "run once" (e.g. setting up the connection settings that IE prompts the user for on the first run of the browser) items will prevent scripts from being run.

§         If Service Pack 4 is applied to a Windows 2000 installation, the Configuration Wizard will need to be re-run to apply these needed privileges to the (default) ASPNET account.

§         Priority 3 (Checkpoint 10.5 - Separate Adjacent links with more than whitespace) will be falsely flagged as an error if ".</strong>" appears between two links. This flag will not occur if the code is changed to "</strong>." (i.e. placing the "." after the strong tag).

§         A Content Scan will not differentiate domains based on port number. For example, if the scan job properties start a scan at http://www.somesite.com:8080/index.htm, all links within the http://www.somesite.com/ domain will be treated as internal.

§         When running an Infrastructure Scan Job, inaccurate results will be obtained if the number of threads exceeds the capacity of the scanning machine. The default number of threads has been set to 100, and the recommended platform is P3 1GHz or better. However, other environmental factors may come into play. If you are experienced connection timeouts, pinned CPU, or database errors, try reducing the number of threads in the job options.

§         When using WebXM e-mail alerts, ensure that WebXM is updated if the destination e-mail account is deleted. WebXM cannot detect that the account no longer exists and will keep trying to e-mail to the invalid address. One method to alert the administrator to this issue is to edit the "from" address in the Windows Registry on the server where the Alert Service is installed. For example [HKEY_LOCAL_MACHINE\SOFTWARE\Watchfire\WebXM\Alert Service] "SmtpMsgFromRouteAddress"="alerter@watchfire.com".

§         Uninstalling a Watchfire product from a system where multiple Watchfire products have been installed may remove files required by the remaining Watchfire product installations. If a Watchfire product is uninstalled, it is recommended that you repair the remaining Watchfire product installations as follows: run Control Panel, select Add/Remove Programs, select each remaining Watchfire product in turn, press Change and then select Repair.

§         Note that the most recent IE browser for Apple Macintosh computers is 5.22. IE Version 5.5 or greater is required for full Control Center functionality.

§         If the installation is cancelled, a large file will be left in the "C:\Program Files\Watchfire\Installations" folder. The file has the file extension .msi and can be deleted providing the related WebXM component is not installed on the system (this will happen in the case where the installation was being done for an upgrade).

§         In the Administration Center (in the WebXM Control Center), the status of jobs and servers is not automatically updated. Select the Refresh button to ensure the latest database data is being displayed. Some changes to various administrative settings may require a new browser session. These issues may arise when jobs, agents, or servers are unexpectedly shut down or removed. For example, if a server is not uninstalled properly, it will continue to appear in the Administration Center, even though it is no longer available. However, no jobs will be assigned to the unavailable server.

§         Changing the font size settings in a browser may cause some minor display issues in the Control Center. Refreshing the display may correct these issues.

§         Changing job options and then regenerating reports prior to a new scan may cause reports to display invalid data. For example, disabling reports listed in the "Report Types" or enabling grouping by metatag will not take effect or provide meaningful results until the job is rerun.

§         Redirects can cause misleading results in the Broken Links report. Links that are actually redirected to invalid URLs will not be reported as broken links. For instance, if page A contains a redirect to Page B, which in turn is redirected to Page C, the Broken Links report will not list page A if page C is an invalid URL. It will report it as a broken link if Page B is an invalid URL.

§         When configuring Orphan Analysis, verification of duplicates is case-sensitive, regardless of the job setting for case-sensitivity. For instance, www.sample.com and www.SAMPLE.com will not be reported as duplicates.

§         Some report options are automatically changed if an invalid entry is made. For example, if an integer value is expected, any decimal values will be truncated automatically. The value will be stored in the database in its modified form. The resulting value will be shown the next time the properties are viewed.

§         Using an Ampersand ("&") in a webspace name can cause corrupt query strings. The problem will only occur when the Webspace is entered and then the Personalize function is selected.

§         The MSDE installer does not set the database service to automatically start. It is recommended that after MSDE is installed the SQLSERVERAGENT be set, in the Services Panel, to automatically start. If the WebXM Configuration Wizard is run and the MSDE service is not running, the Configuration Wizard will report that it cannot find the service.

§         When viewing reports, IIS may automatically cache ASP templates and script engines. This can use large amounts of memory on the server. This can be controlled using IIS settings.

§         The last updated time for jobs will be updated for cancelled jobs. The report pack update time will show the old date until the report is viewed. At that time the date will be updated to match the last run time from the job.

§         Deleted jobs are not immediately deleted from the dashboard. The next time a job that is still displayed on the dashboard is run the dashboard will be updated. This also applies to jobs that are deleted due to a module being removed.

§         The link limit for link limited scans will be exceeded for resumed scans. If a job is suspended, the link count is restarted at zero when the suspended job is resumed.

§         Pages with frames can cause pages to be reported as not having a privacy statement when a website user will actually see a privacy statement when viewing the complete page. This occurs because the page being reported does not actually contain the privacy link, but one of the surrounding frames does.

§         The Privacy Statement Links report only reports on html pages. For this reason the Number of Pages Scanned on the Job Properties report (accessed from View the Job Properties link in reports) may be different from the number reported by the Privacy Statement Links report. The Job Properties report shows a count of all parseable page types.

Copyright © 1996-2008 Watchfire, an IBM Company. All rights reserved.