Securing Adabas & Natural Environments. Becky Albin Chief IT Architect

Transcription

1 Securing Adabas & Natural Environments Becky Albin Chief IT Architect

2 Find Your Inner Genius at ProcessWorld 2012! Get smarter about using IT to improve business performance Discover inspiring solutions to your pressing business challenges Open your mind to new approaches, new tools and new people Save the Date ProcessWorld 2012 Orlando, Florida October 15-17

3 "Moving Forward with Adabas 8" Duration 3.0 hours Audience: DBA's and Programmers. Speaker: Jim Poole (Verizon) Adabas 8 has been a whirlwind of changes where there is a fear that shops have overlooked the incredible range of new features and possibilities. With Adabas 8.2 alone, there were over 40 changes that provide opportunities for DBA and programmers alike. In this fast-paced technical presentation, many of the Adabas 8 changes are explained and how they impact the ways we do business. Enroute, recent benchmark performance studies were done on Adabas caching, changing some long-held paradigms. Those results are presented. Topics include: -Adabas Caching (what, when, why) -Date/Time System Fields -Spanned Records, prevent future risk -Logical removal of fields and descriptors -Improvements to PLOG and WORK -Event Log -A Panoply of other

4 Proposed Customer And SAG Topics for Process World 2012 Customer Presentations With SAG State of Delaware Modernization of Criminal Justice Info System Jody Colhouer of National Business Center - use of Adabas LOBs and EntireX Pam Schwartz of State of Virginia Dept. of Motor Vehicles - use of EntireX George Wolff of NYC DOITT & Nomura, Jim Chambers - Event Replicator Penn State University Data Masking for Adabas Alaska Department of Natural Resources Ada/Nat/BPM customer story Natural ziip Nomura Securities State of Virginia - ApplinX FSCJ Modernization story with ARIS Mashzone Bob Berg of American Family Insurance Adabas SQL Gateway Eric Wood Becky Albin Eric Wood Becky Albin Becky Albin TBD Patrick Gould Eric Wood Bob Jeffcott Tim Ward

5 Proposed Customer And SAG Topics for Process World 2012 Customer Presentations With SAG Travel BA Sys Natural for AJAX, ARIS Mashzone COBOL Modernization Story with ApplinX and/or EXX Adabas and Natural Roadmaps and Future Strategy Guido will follow up TBD SAG HQ

6 Agenda/Topics Securing Adabas ADASCR Adabas Data Encryption Adabas SAF Security RACF or CA-ACF2 or CA-Top Secret Securing Natural Natural Security Natural SAF Security RACF or CA-ACF2 or CA-Top Secret

7 Why Look At Enhancing Security??? Most intrusions are from Internal Employees/Users not hackers Many have not implemented any data security only application security Natural Security ONLY secures Natural New Rules/Regulations/Requirements HIPPA/SOX/BASIL/etc

8 Adabas Security ADASCR ADASCR provides access/update protection: Database File Field Value Access/update permission values ranging from 0 to 14 Stored in Adabas Security File (not external security product) Password must be passed within the application: ADDITIONS 3 of the Adabas Control Block Within the application Inserted via User Exit 1 of the Adabas nucleus

9 Adabas Security ADASCR //DDCARD DD * ADARUN PROGRAM=ADASCR,MODE=MULTI,DATABASE=199,SVC=236 //DDKARTE DD * ADASCR PROTECT FILE=1,ACC=1,UPD=10 * ADASCR INSERT PW=PRODPASS,FILE=1,ACC=1,UPD=1 ADASCR INSERT PW=USERDBA,FILE=1,ACC=14,UPD=14 ADASCR INSERT PW=TESTPASS,FILE=1,ACC=10,UPD=10 * ADASCR SBYVALUE PW=PRODPASS,FILE=1 ADASCR CRITACC='A=DC.',VALACC='A(NEW YORK)' ADASCR CRITUPD='A=DC.',VALUPD='A(NEW YORK)'

10 Adabas Security Encryption Initially set with ADACMP Adabas file level Must provide the encryption key at the time records are stored Key is also needed to read/decrypt Adabas data Encryption key is passed via ADDITIONS4 of the Adabas Control Block Encryption key is not stored don t loose it!!! Only encrypts DATA, not INDEX structures

11 Adabas Security Encryption Initially set with ADACMP ADACMP COMPRESS ADACMP FNDEF='01,AA,7,A,DE,FI' ADACMP FNDEF='01,AB,15,A,DE,MU,NU' ADACMP FNDEF='01,GA' ADACMP FNDEF='02,AC,15,A,NU' ADACMP FNDEF='02,AD,2,P,FI' ADACMP FNDEF='02,AE,5,P,NU' ADACMP FNDEF='02,AF,6,W' ADACMP FNDEF='01,DT,8,P,DT=E(DATETIME),TZ' ADACMP COLDE='7,Y1=AF' ADACMP SUBDE='BB=AA(1,4)' ADACMP SUPDE='CC=AA(1,4),AD(1,1)' ADACMP HYPDE='1,DD,4,A,MU=AB,AC,AD' ADACMP PHONDE='EE(AA)' ADACMP SUBFN='FF=AA(1,2)' ADACMP SUPFN='GG=AA(1,4),AD(1,1)' ADACMP CODE=abcdefgh Field AA Field AB Group GA Field AC Field AD Field AE Field AF Field DT Collation DE Subdescriptor BB Superdescriptor Hyperdescriptor Phonetic Desc Subfield FF Superfield GG Encryption

12 Adabas SAF Security What is SAF? System Authorization Facility z/os standard, accepted by auditors Enables plug in security when implementing RACF or CA-ACF2 or CA-Top Secret Implements mainframe registry users, permissions, system/user defined entities Why not just use ADASCR No tie back to specific user

13 Adabas SAF Security ADASAF Functionality Secure database nucleus, files and commands (RESOURCES) Adabas Utilities Adabas Operator Commands Cross-level checking (where from, Prod/Dev/Test, etc ) Protection of Transaction Data (optional) Adabas Passwords and Cipher Codes

14 Adabas SAF Security ADASAF Functionality Protection of Adabas Online System Protection of Adabas Stored Procedures Adabas Online Systems Remote User Protection Adabas SQL Gateway Protection Adabas Cluster Services and Parallel Services Clips for Natural, EntireX, Entire Net-Work

15 Adabas SAF Security Adabas resources User permissions for Adabas files Access/Update where from in addition to who John is permitted to access file 3 from test systems Test Operator commands restricted DUQ allowed but not STOPU do not check commands such as RC Production

16 Adabas SAF Security Secure resources Utility execution protected user1 may run ADAREP but not ADAINV Operator commands restricted DUQ allowed but not STOPU Remote user control (WCP) Use WCP LINK name Use WCP NODE name Only in conjunction with WAF Initiate a pop-up window on the PC

17 Adabas SAF Security Cipher and passwords ADASCR Cipher codes & Passwords held in RACF (INSTDATA) inserted at the target database no longer need to carry cipher/password on the wire hard-code cipher/password in the application Test Production

18 Adabas SAF Security Customization Parameter module - SAFCFG set global options ABS Adabas Basic Services DDSAF set options specific to an individual nucleus Not all option can be set Overwrite values defined in the parameter module

19 Adabas SAF Security Parameters - example NA2PPRM GWSTYP=1, SECURITY SYSTEM X NWCLASS=ADAXLV, CROSS-LEVEL CLASS X DBCLASS=ADASEC, DATABASE CLASS X DELIM=Y, ENTITY NAME FORMAT X FAILMODE=W, WARNING MODE X GWMSGL=1, TRACE VIOLATIONS X MAXFILES=32, MAX CACHED FILES PER USER X MAXPCC=10, MAX PASSWORDS/CIPHERS X PASSWORD=N, AUTOMATIC PASSWORDS X CIPHER=N, AUTOMATIC CIPHERS X ETDATA=N, ET DATA PROTECTION X ADASCR=N, ADASCR COMPATIBILITY X XLEVEL=2, CROSS-LEVEL CHECKING X GROUP=N, USE GROUP INSTEAD OF USER X DBNCU=10 MAX CACHED DB CHECKS PER USER END

20 Adabas SAF Security On-line administration Natural application SYSAAF Integrated with SYSAOS Features Reset a user or all users Performance information from internal permissions cache Restart AAF inside Adabas reload code (bring in a fix 24*7)

21 Adabas SAF Security Architecture

22 Adabas SAF Security Architecture User Session Administrator Router SAF Gateway Extension Adabas with SAF Extension Adabas with SAF Extension SAF Configuration File RACF CA-ACF2 CA-Top Secret

23 Data Masking for Adabas

24 Close a Gap Provide what s required Hide what s not necessary Provide high quality test data Test Application Data Masking Masked Copy of Production Enhance Use Adabas Tools to create Rules Run-time parameter Data Mapping Production Application Meta-data Production Protect sensitive production data

25 Natural Security

26 Natural Security and SAF Security Controls and checks the access to a Natural environment Protects Natural environment against unauthorized access and improper use Many objects supported: User, User Types, Groups Applications, Libraries Data access (DDM s / Files) Utilities Secures remote development environments (Natural for Windows/NaturalONE) Natural Security Group User Type Libraries Data Access External Security Systems Operating System User Utilities Applications Natural SAF Security RACF, ACF2 TopSecret

27 Natural SAF Facility

28 NSF426 Overview Natural SAF Security based on Natural Security no SAF hooks in Natural or Natural Utilities all is controlled by Natural Security Nucleus NSC Nucleus calls SAF Server or NSC Server dependent if Natural SAF is installed/switched on Natural SAF Security Using central SAF Server Avoid of APF authorization

29 NSF426 Architecture SAF Server External Security System SAF Administration SYSSEC Application NSC Administration NSF Clip Natural NSC Layer NSC Clip Natural Utilities NSC Database (FSEC)

30 NSF Features NSC Definitions RACF Definitions Library Profile Environment NSC Group User n NSF RACF Group User n Utility Profile User 2 User 1

31 NSF Features NSC Definitions RACF Definitions Library Profile Environment NSC Group User n NSF RACF Group User n Utility Profile User 2 User 1 Resource: Library

32 NSF Features NSC Definitions RACF Definitions Library Profile Environment NSC Group User n NSF RACF Group User n Utility Profile User 2 User 1 Resource Library and Environment

33 Summary NSF Features User authentication User-ID/password check via SAF SAF delivers *GROUP and *USER-NAME NSC determines group profile No user Definitions in NSC Mixed case passwords NSC user maintenance Library Access Logon Check via SAF Only default Library Profile applicably

34 Summary NSF Features Environment Check Environment determined by the system files FNAT, FUSER, FDIC and FSEC Define a profile for each system-file combination Control user access to this profiles ET-ID generation Generates a unique ID for saving Adabas End of Transaction data This may be handled by NSC or NSF There is an alternate algorithm implemented in NSF.

35 Other Security Options EntireX SAF Security (RACF, ACF2, TSS) UNIX local security or LDAP Windows local security of LDAP Entire Net-Work SAF Security (RACF, ACF2, TSS) Adabas SQL Gateway CNXNOPREAUTHORIZE parameter Adabas Online System (AOS) Requires Natural Security

36 Closing slide Thank You!