Pre-Con Ed: CA ACF2 and CA Top Secret – Part 1: What’s New in the Enterprise Security Managers

World®’16

CAACF2andCATopSecret– Part1:What’sNewintheEnterpriseSecurityManagers

JohnPinkowski- ProductOwner

MFX39EA

MAINFRAMEANDWORKLOADAUTOMATION

2 ©2016CA.ALLRIGHTSRESERVED.@CAWORLD#CAWORLD

ForInformationalPurposesOnlyTermsofthisPresentation

©2016CA.Allrightsreserved.Alltrademarksreferencedhereinbelongtotheirrespectivecompanies.Thepresentationprovided atCAWorld2016isintendedforinformationpurposesonlyanddoesnotformanytypeofwarranty.Someofthespecificslideswith customerreferencesrelatetocustomer'sspecificuseandexperienceofCAproductsandsolutionssoactualresultsmayvary.

CertaininformationinthispresentationmayoutlineCA’sgeneralproductdirection.Thispresentationshallnotserveto(i) affecttherightsand/orobligationsofCAoritslicenseesunderanyexistingorfuturelicenseagreementorservicesagreementrelatingtoanyCAsoftwareproduct;or(ii)amendanyproductdocumentationorspecificationsforanyCAsoftwareproduct.Thispresentationisbasedon currentinformationandresourceallocationsasofNovember1,2016,andissubjecttochangeorwithdrawalbyCAatanytimewithout notice.Thedevelopment,releaseandtimingofanyfeaturesorfunctionalitydescribedinthispresentationremainatCA’ssolediscretion.

Notwithstandinganythinginthispresentationtothecontrary,uponthegeneralavailabilityofanyfutureCAproductrelease referencedinthispresentation,CAmaymakesuchreleaseavailabletonewlicenseesintheformofaregularlyscheduledmajorproductrelease.SuchreleasemaybemadeavailabletolicenseesoftheproductwhoareactivesubscriberstoCAmaintenanceandsupport,onawhen andif-availablebasis.Theinformationinthispresentationisnotdeemedtobeincorporatedintoanycontract.


Abstract

Businesssuccessintheapplicationeconomydependsonareliableandcost-effectivesecurityinfrastructure.ThissessionwillcoverthelatestenhancementsintheExternalSecurityManagers(ESMs)CATopSecret®andCAACF2™—rangingfromrole-basedaccesscontroltouser-orientedarchitecture—tohelpeaseyourmainframesecurityadministrationandsimplifyyourcomplianceandaudittasks.

JohnPinkowski

CATechnologies


Agenda

EOSDATES

THEOLD

THENEW

1

2

3


SecurityandComplianceManagingSecurity,DataAccessandCompliance

CADataProtection

3rd partyDLPSolution

3rd partyDLPSolution

SIEMCAComplianceEventManager

IBMRACF

CATopSecret

CAACF2

CACleanup

CAAdvancedAuthenticationMainframe

CADataContentDiscovery

CAAuditor

SecuremainframeassetsCaptureeventsaffectingcomplianceandpolicyDiscoversensitivedata

ExtendcomplianceeventdatatoanalyticssolutionsEnablesecuredatainmotionacrosstheenterprise

SecurityAdministrator

BigDataAnalystAuditor

Planned

Available

Non-CAProduct


EOSDates


CATopSecretandCAACF2EOS!

§ …notificationthatwearediscontinuingsupportforCATopSecretVersion14.0,

includingServicePacksbeginningDecember31,2016andVersion15.0beginning

December31,2017.ThiswillallowourDevelopmentorganizationtomore

effectivelyfocusitsresourcesandaddvaluetothenextreleaseofCATopSecret

forz/OS.


CATopSecretandCAACF2EOS!HelpfulLinks

§ http://www.ca.com/us/services-support/ca-support/ca-support-online/product-

content/status/support-life-cycle/indexes/ca-top-secret-product-family-release-

and-support-lifecycle-dates.html

§ http://www.ca.com/us/services-support/ca-support/ca-support-online/product-

content/status/support-life-cycle/indexes/ca-acf2-product-family-release-and-

support-lifecycle-dates.html


CATopSecretandCAACF2EOS!


TheOld


CAACF2r16Enhancement

Need:Ineedtohaveastatusforauserthatremovestheabilitytoaccessasystem,yetnotallowthatusersIDtobereused

Solution:AnuserthenewRETIREstatusforauser.Theuserwilllosetheabilitytologon/accessasystem.Furtherelevatedprivilegesarerequiredtoun-RETIREanuser.

Benefit:- CentralRepositorytoNotAllowingtheRe-UseofID- CompliancewithIRSPub1075


CATopSecretr16Enhancement

Need:Aspartofourauditreview,movingthefacilityinformationtothesecurityfilewouldbeagreatbenefit.

Solution:ActiveFACTOR(YES|NO)tostorethefacilitymatrixinformationonthesecurityfile.

Benefit:- Facilitydefinitionsprotectedfromview- EasiertoadministerandmaintainmultipleLPARcomplexes- SizeoftheTSSPARMSFILEgreatlyreduced



Need:IhaveimplementedarolebasesecurityarchitectureandneedtheabilitytoprovideaLogonIDaccessreportby role

Solution:RolesupportfortheLogonIDAccessreport.AbilitytocontrolthecreationofthereportusingthenewROLEinputparameter.Providingareportsectionforeachroleshowingwhichrulelinesgrantorpreventaccess

Benefit:- Improvedcompliancereportingbyroles- Improvedperformancebenefits



Need:ThereisaneedtogivemoregranularityoveradminscanassignaUID(0)

Solution:FornonMSCAadminsanadditionalauthorizationchecktoCASECAUT(TSSCMD.ADMIN.UID0)isissued.TheadminmusthaveACID(MAINTAIN)authorityandcheckisonlyissuedwhenUID(0)ispresentwithinaTSSADDorREPLACEcommandstring

Benefit:- FurtherrestrictswhocanassignauthorizationforUID(0)- Satisfiescompliancerequirements


CAACF2/CATopSecretr16Enhancement

Need:WehaveanewPCIrequirementtoensurewelimitthedatabeingmadevisibleduringmessageprocessing.Thisdetailedsysteminformationmaybeusedtocreatedenialofserviceinterruptions,orcausesecuritytofailwhenusedbyhackers

Solution:TheACF2MSGOPTSrecordallowstheadministratortocontrolwhichsignonmessageswillbeconvertedtoasinglegenericmessageACF01125LogonCredentialsInvalid.TheTopSecretcontroloptionGENSMSGallowstheadministratortocontroltheissuingofthegenericmessageTSS7099ESignonCredentialsInvalid

Benefit:- PCI6.5.5compliance- Limitedsecurityinformationshared



Need:IwasaskedbyourauditorwhatistheencryptionstrengthsofthepasswordsontheCAACF2andareweatthestrongest

Solution:ActivateAES256-bitencryptionforCAACF2passwordsandpasswordhistory

Benefit:Makesbruteforcepassworddecryptionofpasswordshardertoattain



Need:MystorageteamisaskingifthereareanystorageimprovementsinCAACF2.Moreworkloadsaremovingtothemainframeandwewanttobeinpositiontoscale.

Solution:UpgradetoCAACF2r16.Outoftheboxrulesetswillbemovedtointo64-bitCSA.

Benefit:Potentiallya70-90%savingsinCSAutilizationbelowthebar(ResultsMayVary)



Need:OurauditorswouldlikeustostopusingtheCICSBypassprocessinginourCTSregions

Solution:ExploitthenewCICSfacilitysubfunctionBYPLIST.YoucanstarttoworkwithyourauditorsimplementingBYPLIST(AUDIT)totracktheusageofbypasswithintheregion.OncetheseaccessesareadministrateditisasimpleswitchtoBYPLIST(NO)tonotallowtheuseofbypassinthefuture.

Benefit:- CompletecontrolofCTSresourcesfromCATopSecretpermissions- Improvedauditabilityoftheseresources


TheNew



Need:Iwasaskedbyourauditorifwecanuseourtokenstosignontothemainframe!

Solution:EnterpriseWideAdvancedAuthentication:IntroducingAdvancedAuthenticationMainframeSession:MFX42E

Benefit:Education!



Need:WearelookingtoexploitPasswordPhraseinourenvironmentandwouldliketoensureupperandlowercasecharactersarefollowingcompliancerequirements.

Solution:NewoptionswereintroducedviaPTFRO92400toenablethecontrolofforcingatleaseoneupperorlowercasecharacterinCAACF2.EquivalentsupportisbeingbuiltinCATopSecretifyouareinterestedpleasecontactus!

Benefit:- Greatercontroloverphraseedits- Additionalcomplianceregulationadherence



Need:WeareexploitingtheCAACF2andCATopSecretinformationinwaysthatthetraditionalprintercarriagecontrolcharactersareahindrance.

Solution:TheteamshavedevelopedsolutionsforreportsACFRPTRV,ACFRPTSLandTSSUTILfortherespectiveproducts.Ifyouareinterestedinanyofthesereports,pleaseletusknow.

Benefit:Improvedsortingofdatafromreports



Need:CurrentlyweareusingtheCASECAUTresourcetocontroladministratorsaccesstothecertificateprocess.Weareinterestedinhavingmoregranularcontroloverthisprocess.

Solution:CAACF2nowhassupportforadditionalGranularCertificateAdministration.YoumaynowuseRDATALIBclassrulestocontrolaccesstothespecificcertificateandkeyringcommands.TheexistingCASECAUTrulessimplyallowedaccesstousethecertificatecommandsbutgaveaccesstoallcertificatesownedbyanotheruserorbySITECERTorCERTAUTH.PTF:RO89501

Benefits:Thegranularadministrationallowsyoutocreaterulestoprovideaccesstoaspecificuserscertificateorasub-setofthem



Need:WehaveexploitedtheuseofexitsinCATopSecret.Aspartofserviceabilitywewouldlikethedatasetthattheexitisbeingloadedfromdisplayed.

Solution:JoinoursprintreviewsforCATopSecret.ThisideahasbeenincludedinourcurrentPI(ProgramIncrement).Aninitializationmessagewillbeaddedtoprovideexitinformation.

Benefits:Easeofsupportability



Need:WeareusingtheACFESAGEoutputtohelpconvertinstallationstoaRBACimplementation.Wearelookingtoexploitmoreoftheruntimeinformationinthisprocessandwouldlikeadditionaldatatobeavailableintheunload.

Solution:CAACF2ACFESAGEreportnowincludesadditionalactivesysteminformation:Rundate/time,databasenames,exitinformation,classmapdefinitions,andsomeoptioninformation.PTF:RO92424.

Benefits:AdditionaldatapointsforRBACconversions



Need:ForauditpurposeswewouldliketoseemoreenvironmentalinformationavailableintheTSSCFILErun.

Solution:JoinoursprintreviewsforCATopSecret.ThisideahasbeenincludedinourcurrentPI(ProgramIncrement).AdditionalinformationisscheduledtobeaddedtoTSSCFILE:CreationDate,LPARofTSSCFILErun,andSecurityfilenames.

Benefits:Additionaldatapointsforaudittrail



Need:WewouldlikeCATopSecrettohaveadditionadministrativeeditsaroundDFLTGRPprocessing.

Solution:JoinoursprintreviewsforCATopSecret.ThisideahasbeenincludedinourcurrentPI(ProgramIncrement).AdditionaleditstovalidatetheGROUP,andthatitisassignedtothetargetACID’sGROUPlistandthataGIDisassignedtoit.

Benefits:- Easeofadministration- EnsuresvalidusableUnixSystemServicescredentialareassigned


Questions?


RecommendedSessions

SESSION# TITLE DATE/TIME

MFX39EBPre-ConEd:CAACF2andCATopSecret– Part2:AdvancedSecurityControls 11/14/2016at10:00am

MFX42EEnterpriseWideAdvancedAuthentication:IntroducingAdvancedAuthenticationMainframe 11/14/2016at3:00pm

MFT175S GapsinYourDefense:HackingtheMainframe 11/17/2016at3:00pm


MustSeeDemos

Real-TimeDataSecurity&Compliance

CADataContentDiscoveryMainframeTheatre

MainframeSecuritySmartBar

CATopSecretMainframeTheatre

Real-TimeDataSecurity&Compliance

CAComplianceEventManagerMainframeTheatre

MainframeSecuritySmartBar

CAACF2MainframeTheatre


Thankyou.

Stayconnectedatcommunities.ca.com

Pre-Con Ed: CA ACF2 and CA Top Secret – Part 1: What’s New in the Enterprise Security Managers

Technology

Transcript of Pre-Con Ed: CA ACF2 and CA Top Secret – Part 1: What’s New in the Enterprise Security Managers