Compliance Assessment and Reporting Tool PowerSC Tools for IBM i

Transcription

1 PowerSC Tools for IBM i Security Services Delivery Team DB2 for i Center of Excellence

2 Some organizations will be a target regardless of what they do, but most become a target because of what they do (or don t do) 2

3 IT Security Compliance Why? 3

4 IT Security Compliance Why? Really? Do I have to say it? 4

5 IT Security Compliance Why? Data Loss (Data Breach) Prevention Mitigate internal and external threats due to the costly and harmful impact to reputation and business when customer data is exposed and must be publicly reported due to compliance regulations Data Assurance and Integrity Prevent unauthorized access and changes to sensitive data by privileged and non privileged users Probably a number of reasons, but that isn t the point of this presentation. However, so no one walks away without something to contemplate, we offer the following for your consideration 5

6 IT Security Compliance Why? 6

7 IT Security Compliance Why? Source: 7

8 IT Security Compliance Why? Data is the key target for security breaches.. and Database Servers Are The Primary Source of Breached Data Because that s where the money is. - Willie Sutton WHY? Database servers contain your client s most valuable information Financial records Customer information Credit card and other account records Personally identifiable information Patient records High volumes of structured data Easy to access Source: 8

9 IT Security Compliance Why? What Data are the Criminals After? Source: s/rp_data-breach-investigations-report- 2012_en_xg.pdf 9

10 IT Security Compliance Who Should Care? Business and Information Owners must be assured that the information and brand reputation of the business is protected Chief Security Officer (CSO) as custodian of the business and information owners, must answer for risks present on the system and that they are being managed to an acceptable level Security Administrators must insure that access is implemented appropriately as designed Compliance Officer must insure that the IT operations comply to corporate rules and regulations as well as industry and government regulations Operations Managers must insure the correct policies/standards are in place and being followed Application Developers must insure applications are being designed and placed in production correctly with sufficient controls to prevent inappropriate access Everyone adherence to policy insures the continuity of the business 10

11 IT Security Compliance Inhibitors For many IBM i IT departments, security is performed by an individual with multiple responsibilities operations, administration, programming, etc. Security implementation how to is often not understood, is neglected or not monitored due to time constraints. Security setup inherited from the past - previous owners / application designers no longer are available Security policies/standards often do not exist. If they do, monitoring of compliance to the policy is not done or understood and deviation from the policies/standards across the enterprise is unknown. How do you measure security? What are Key Risk Indicators (KRI)? How do I prove due diligence to security monitoring? Gathering of security information is time consuming and scattered in multiple places on the system. The analysis of this data or monitoring of security changes is often dated by the time it is read. Is my data safe? Is my brand and/or reputation safe? 11

12 IT Security Compliance Measuring Security If you can t measure it, how can you improve or fix it? Provide evidence that risk is being managed according to enterprise defined risk thresholds empowering Senior Management to make informed risk management decisions on where best to allocate resource. REQUIREMENTS: Centralized view of Security Compliance status across the enterprise No access to remote machines required Maintain segregation of duties Provide management visibility, meaningful reports that drive action Customizable Control Tests Measurable Results Ability to define Key Risk Indicators (KRI s) Traceability back to Security Standards and Company Policies Dashboard Style Reporting Red, Yellow (Amber), Green (RAG) Metrics Clickable reports to drill down to the issue Trending to measure improvements (hopefully) over time 12

13 I just want to arrive in the morning, get a cup of coffee, and have a view of what systems are in compliance and which are not. 13

14 Provides quick and easy check of system for major security exposures Profile Analysis: Special Authorities / Inherited Privileges Group Profiles / Ambiguous Profiles Default Passwords / Password Expiration Inactive Accounts *PUBLICLY Authorized Profiles Privately Authorized Profiles Initial Programs, Menus, and Attention Programs Command Line Access Administration / Configuration: System Values / Audit Control Settings Invalid Signon attempts Work Management Analysis Service Tools (SST) Security DDM Password Requirements Registered Exit Points / Exit Programs Function Usage Library Analysis / *ALLOBJ Inheritance Network Settings: Network attributes / Time Server NetServer Configuration TCP/IP servers / Autostart values Digital Certificate Expiration SSH / SSL Configuration Listening ports / Network Encryption IP Datagram Forwarding IP Source Routing APPN Configuration (yes for many it is still there) Server Authentication Entries

15 High Level Architecture Remote systems Data Mart system DAILY DB2 for i Reporting Data Mart T01045P R02126P HISTORY DAILY SUMMARY TABLE Created by Quick Security Check Collection Tool (One for every LPAR) ETL Process to Load Data Mart on Central System AGFRCA AGAC3EE AGRRWA AG6RYHA AGR22PQ AGDGSF AGVYHA AGVFSS AGVGRE AGVUY2 AGMPR2 AGVR2B AGVR3B AGACBEE AGACP2R AGRQAU1 AGGSBB AGGDMB AGMAR2 AGAC3EA AG6TTHA AGRSAPQ AGHISF 3P 0 9P 0 14A 12A 3P 0 5P 2 2A 2A 2A 10A 8A 50A DSFTCA DSRTBB DSRTTB DSMNTI DSVB1B DSVB2B DSYT1LO DSYT1LR DSRRWA DS6TYHA DSTIIPQ DSDRTF DSVBHA DSVBSS DSVBPE DSVBYI DSMNTI DSVR2B DSVR3B DSYT2WL DSYTWLT DSRRYUQ T00032P 3P 0 50A 12A 3P 0 2A 3A 5P A 12A 6A T05001P FPPTWLT FPLLPUQ FPFTCA FPLTTB FPTNTP FPYB1B FPTNTP FPYL2B FPYLPB 12A 6A 1P 0 2 1P 0 2 DFFTCA DFRTBB DFRTTB DFMNTI DFTG1B DFTG2B DFTG3B DFTG4B DFMNEE DFMNEF DFRERP DFWELF DFWILF DFWILR DFWILS DFWILT DFQI1W DFQ2IW DFTRES DFYT1LL DFYT1LO DFYT1LR DFRRWA DF6TYHA DFTIIPQ DFDRTF DFDRTG DFDRTH DFTPPL DFTINM DFTIR2 DFTIGL DFTTDT DFTTED DFHHIJ DFHHIK DFTYHI DFTYIA DFTYKN DFTTWK DFTGHA DFTGSS DFTGPE DFTGYI T01046P 3P P 2 11P 2 11P 2 11P 2 11P 2 11P 2 11P 2 3A 10A 4 12A 12A 1P 0 1P 0 3P 0 30A 12A 4P 2 4P 2 5P 2 2A 3A 5P 2 KSFTCA KSGSBB KSGDMB KSMARI KSYT3LA KSYT3LE KSRRWA KS6TYHA KSTIIPQ KSDGSF KSVYHA KSVFSS KSVGTE KSVUYI KSMPTI KSVR2B KSVR3B KSYTBEL KSYTPIT KSRQAU1 3P 0 50A 9P 0 2A 2A 3P 0 5P 2 2A 2A 2A 10A 10A T03140P TLFTCA TLRTBB TLRTTB TLTNT3 TLKB1B TLKB2B TLTNT3 TLKR2B TLKR3B TLPT2WL TLPTWLT TLRRPUQ 3P A 12A 6A DB2 Web Query Meta Data DB2 Web Query Dashboards/Reports 15

16 Data Mart Tables DB2 for i Reporting Data Mart T01045P R02126P AGFRCA AGAC3EE AGRRWA AG6RYHA AGR22PQ AGDGSF AGVYHA AGVFSS AGVGRE AGVUY2 AGMPR2 AGVR2B AGVR3B AGACBEE AGACP2R AGRQAU1 AGGSBB AGGDMB AGMAR2 AGAC3EA AG6TTHA AGRSAPQ AGHISF 3P 0 9P 0 14A 12A 3P 0 5P 2 2A 2A 2A 10A 8A 50A DSFTCA DSRTBB DSRTTB DSMNTI DSVB1B DSVB2B DSYT1LO DSYT1LR DSRRWA DS6TYHA DSTIIPQ DSDRTF DSVBHA DSVBSS DSVBPE DSVBYI DSMNTI DSVR2B DSVR3B DSYT2WL DSYTWLT DSRRYUQ T00032P 3P 0 50A 12A 3P 0 2A 3A 5P A 12A 6A T05001P FPPTWLT FPLLPUQ FPFTCA FPLTTB FPTNTP FPYB1B FPTNTP FPYL2B FPYLPB 12A 6A 1P 0 2 1P 0 2 DFFTCA DFRTBB DFRTTB DFMNTI DFTG1B DFTG2B DFTG3B DFTG4B DFMNEE DFMNEF DFRERP DFWELF DFWILF DFWILR DFWILS DFWILT DFQI1W DFQ2IW DFTRES DFYT1LL DFYT1LO DFYT1LR DFRRWA DF6TYHA DFTIIPQ DFDRTF DFDRTG DFDRTH DFTPPL DFTINM DFTIR2 DFTIGL DFTTDT DFTTED DFHHIJ DFHHIK DFTYHI DFTYIA DFTYKN DFTTWK DFTGHA DFTGSS DFTGPE DFTGYI T01046P 3P P 2 11P 2 11P 2 11P 2 11P 2 11P 2 11P 2 3A 10A 4 12A 12A 1P 0 1P 0 3P 0 30A 12A 4P 2 4P 2 5P 2 2A 3A 5P 2 KSFTCA KSGSBB KSGDMB KSMARI KSYT3LA KSYT3LE KSRRWA KS6TYHA KSTIIPQ KSDGSF KSVYHA KSVFSS KSVGTE KSVUYI KSMPTI KSVR2B KSVR3B KSYTBEL KSYTPIT KSRQAU1 3P 0 50A 9P 0 2A 2A 3P 0 5P 2 2A 2A 2A 10A 10A T03140P TLFTCA TLRTBB TLRTTB TLTNT3 TLKB1B TLKB2B TLTNT3 TLKR2B TLKR3B TLPT2WL TLPTWLT TLRRPUQ 3P A 12A 6A ETL Log System Info Policy Grading Info How current is the data I am viewing? How do I wish to filter on and view the data? How is Green, Amber, and Red defined? Logging of success or failure of scheduled ETL processes with remote systems System descriptive information such as location, usage, VRM level, etc. User defined thresholds for aggregate security attribute grading. Security Collection Details Detailed history of system security grading - Best Practice - Policy - Policy Exception

17 Data Mart Views ETL Log System Info Policy Grading Info Security Collection Details DB2 Views Views over all the base data mart tables, PLUS: The last ETL entries for each remote system Summary grading information for the last successful collection for each remote system Detailed grading information for the last successful collection for each remote system History of all ETL entries for each remote system Summary grading information for each remote system for all collected history Detailed grading information for each remote system for all collected history

18 DB2 Web Query Reports How current is the information? - Which systems have not reported in the last two weeks? - How old is the data for System x? - What problems are preventing successful data collection from System y? - How long has there been a problem with collection of information from System z? What is summary view of the last collected status for my enterprise? - Based on IBM Best Practices? - Based on my company s policies? - Based on (expiring) exceptions granted to company policy? - Based on some System value or attribute? - System Name - Location (hierarchy) - Version/Release level - System Usage (development, test, QA, production, etc.) - Ownership, Administration responsibility - Priority - Other? What systems and areas need attention and speedy resolution? - What are the details for each system in the enterprise? - How is success measured? Adherence to company policy or policy exceptions, IBM Best Practice? - Which system attributes are being tracked and graded? - What is the Priority of each item? High, Medium, and Low Prioritization - What is the grade for each item? Green, Amber or Red grading

19 Regional Review (Drill down to overall grading and details)

20 Overall System Status (by Age, Policy Type and various system criteria)

21 System Attribute Details (By Age, Policy Type and System Name) COLLECTION_DETAILS_LAST

22 Last Reported Event Log (Status by Age, System, Region, Data Center, System Name)

23 Event Log Report Shows status of most recent attempt to collect security data for each system - Can be filtered by Region, Data Center, and System Name Current Event Log Status by System - Active Report

24 Delinquency Reports Systems that have not successfully reported in the over xx days - Can be filtered by Region, Data Center, and System Name Delinquency Report Based on Event Log

25 Enterprise Dashboard - Summary of Overall System Status of all systems in the enterprise by various system attributes. - Information is based on last successful collection for each system.

26 System Dashboard Key System and data collection information - Status of last collection attempt Success or Fail - Key System attributes VRM, Location, etc. - Overall and detailed system grading based upon last successful collection.

27 Application to Provide Customization

28 Application to Provide Customization Dashboard Threshold

29 Application to Provide Scoring

30 Application to Provide Scoring Customer Policy

31 Application to Provide Scoring Customer Policy

32 Application to Provide Scoring Customer Defined

33 APPENDIX

34 Standard vs. Enterprise Feature Automated individual LPAR reporting Standard Enterprise Enterprise LPAR dashboard / reporting Best Practice Scoring Customer Policy / Exception Scoring User Defined Items Scoring Policy definition, scoring training and customization Web Query training, ETL customization

35 Prerequisites Central Server IBM i operating system version 7.1 or above Option 1 - Extended Base Support Option 2 - Online Information Option 3 - Extended Base Directory Support Option 12 - Host Servers Option 13 - System Openness Includes Option 14- GDDM Option 26 - DB2 Symmetric Multiprocessing (OPTIONAL) Option 29 - Integrated Server Support Option 30 - QSHELL Option 31 - Domain Name System Option 33 - PASE Option 34 - Digital Certificate Manager Option 39 - International Components for Unicode 5733WQE - DB2 Web Query Express v2.1 (Standard edition preferred WQS) Minimum 1 core license (for *Base and Option 1) 2 Licensed users (Option 4) see Notes page One Workbench License (Option 5) 35

36 Prerequisites Central Server (continued) - Enterprise Component Pre-requisite program products: 5770DG1 - IBM HTTP Server for i 5761JV1 - IBM Developer Kit for Java (*BASE and options 8 through 13) 5770NAE - IBM Network Authentication Enablement for i 5733SC1 - IBM Portable Utilities for i (*BASE and OpenSSH, OpenSSL, zlib) 5770TC1 - IBM TCP/IP Connectivity Utilities for i Pre-requisite PTFs (as of January 8th, 2014): 36 SF99710 Level or later Cumulative PTF Package SF99709 Level 100 or later Group HIPER SF99708 Level 30 or later Security Group SF99707 Level 7 or later Technology Refresh SF99701 Level 26 or later DB2 Group SF99647 Level 6 or later DB2 Web Query Hot Fix SF99572 Level 15 or later Java Group SF99368 Level 24 or later HTTP Group SF99367 Level 8 or later TCPIP Group

37 Prerequisites Remote Systems IBM i operating system version 5.4 or above - Remote Agent 37

38 For more information Terry Ford, Team Leader Security Services Delivery Doug Mack, Business Programs Manager DB2 for i Center of Excellence [email protected] Mark Even Opportunity Manager [email protected] Mike Gordon Opportunity Manager [email protected] 38

39 IBM Systems Lab Services and Training Our Mission and Profile Support the IBM Systems Agenda and accelerate the adoption of new products and solutions Maximize performance of our clients existing IBM systems Deliver technical training, conferences, and other services tailored to meet client needs Team with IBM Service Providers to optimize the deployment of IBM solutions (GTS, GBS, SWG Lab Services and our IBM Business Partners) Our Competitive Advantage Mainframe Systems Power Systems System x & Bladecenter System Storage Leverage relationships with the IBM development labs to build deep technical skills and exploit the expertise of our developers Combined expertise of Lab Services and the Training for Systems team Skills can be deployed worldwide to assure client requests can be met IT Infrastructure Optimization Data Center Services Successful Worldwide History 18 years in Americas 10 years in Europe/Middle East/Africa 6 years in Asia Pacific 39 Training Services [email protected]

40 IBM Systems Lab Services and Training Leverage the skills and expertise of IBM's technical consultants to implement projects that achieve faster business value 40 Ensure a smooth upgrade Improve your availability Design for efficient virtualization Reduce management complexity Assess your system security Optimize database performance Modernize applications for ipad Deliver training classes & conferences How to contact us us at [email protected] Follow us Learn more ibm.com/systems/services/labservices