Risk. Systemystem. A SAS Datawarehouse on OpenVMS (AXP)

Transcription

1 Group Audit Department Project ICARUS Information Collecting Risk Andnd Uncovering Systemystem A Datawarehouse on OpenVMS (AXP) UBS Giampaolo Trenta Juni 98 / 1 The Group internal Audit department (GADE) of the Union Bank of Switzerland (UBS) GADE is a control instrument reporting directly to the president of the board of the directors. ICARUS was the project to implement a data warehouse The data warehouse is intended to support the work of the business auditor A new approach for auditing macro analysis rather than micro analysis Data on the warehouse are available for a longer period of time than on the production system Trend analyses and cross comparisons between periods are possible We want to use the data analysis capabilities of We already discovered interesting properties of rate deviations in 1

2 Data Delivery Trading Data (international) Swiss Data (national) New York London Zurich Geneva Lugano Tokyo Tokyo Hong Kong DECnet Data Warehouse on OpenVMS TCP/IP Singapore UBS Swiss Banking System ABACUS UBS Giampaolo Trenta Juni 98 / 2 We collect UBS trading data (Foreign Exchange) from around the globe We collect data from our Swiss banking system (ABACUS) Due to the sensitivity of the data we need strong security while also requiring flexibility Legacy aspects with a GADE application called IDA required DECnet support TCP/IP support is also required The system do not have to require intensive support The system must run as automatically as possible (management by exceptions) The system must deliver the best possible price/performance ratio All this aspects spoke for OpenVMS on Alpha AlphaServer4100/300 with 512MB RAM and 2x2GB and 8x4GB Disks Control level based on RAID capabilities (level 2 sysdisk, level 5 data disks) 2

3 mailbox detached OpenVMS process File Processing program process flow 3 get notification 3 read file ID 4 move file 5 enqueue loader 5 enqueue 6 process data loader 7 move file notify transmit data move file 7 move file data flow RCV DATA ARCH external influence internal influence UBS Giampaolo Trenta Juni 98 / 3 Data is delivered in form of ASCII files File transfer applications support the POSTPROCESSING Supported network protocols are TCP/IP and DECnet No matter the used protocol file processing schema is always the same The range of influence of the process delivering the data is keep as small as possible Only trusted processes and users are allowed to access the database The use of a mailbox eliminates the need for polling The post processing process performs an asynchronous write on the mailbox A detached process perform a synchronous read on the mailbox The same process submit the process running and the data loader program This introduces a convenient point to control execution namely a queue The queue is also used to serialize data loading jobs and avoid concurrent access The moving files (rename) can be considered an atomic operation 3

4 Data Loader Objective Data load is correct and complete or the target dataset has not been changed Problem No transaction processing and support and therefore no rollback in Strategie Data load into a WORK dataset if no errors occured then append the WORK dataset to the target dataset ASCII work dataset target dataset work dataset UBS Giampaolo Trenta Juni 98 / 4 Executed in batch mode The integrity of the database has the highest priority The loader has to deal with possible error conditions during parsing of the delivered files An administrative database with statistics on loaded data is also updated Database updates are conservative 4

5 Business Model Product FOREX ZHR GEN LUG NY HK TOK SIN LON Regions Switzerland Europe Americas Asia Pacific X X X X X X X X Divisions Private Banking Consumer & Corporate Investment Banking Asset Management X X X X X X X X UBS Giampaolo Trenta Juni 98 / 5 The business model has to be taken into consideration when organizing data The implementation model has to reflect the business model We have auditors assigned to regions or divisions Regional view and/or product view Both view must co-exists and be supported 5

6 Technical Implementation CH prg EU hardlink set file/enter=... xx USA warehouse data AS IB ZHR ACL identifier=mgr, access=rwed identifier=ib_usr, access=r adm PB identifier=ch_usr, access=r AM identifier=*, access=none OpenVMS CC UBS Giampaolo Trenta Juni 98 / 6 Every auditor is assigned to a fixed home directory All object accessible to him are directly accessible inside his subtree In order to avoid duplication of datasets we define hard links OpenVMS identifiers, based on access control lists, allow role based access control /SHARE and /CONNET strictly observe user-based OpenVMS access control Role-based access control rules on data don t need to be continuously maintained Identifiers granting and revoking is the only necessary administrative task 6

7 /CONNECT SA S VT TCP/IP VT Connection VMS Session SA S VT VT Connection SA S VT VT Connection VMS Session Client Server VMS Session VT = Virtuell Terminal UBS Giampaolo Trenta Juni 98 / 7 There are many possibilities to access the data stored on the server Behind /CONNECT on TCP/IP there is in fact a terminal based connection on client acts like a virtual terminal, driven by the events generated by the GUI This requires an OpenVMS interactive license for every concurrent client However, data on the server can be processed strictly on the server (remote execution functions) The authentication is performed directly by the OpenVMS login and passwords are sent in clear text The rel 7.0 will also have a spawner for OpenVMS (already available for UNIX and NT) Thus the client will connect via the spawner rather than the OpenVMS login Note that every client requires a dedicated server process 7

8 /SHARE TCP/IP socket communication ICARUS_SVR TCP/IP socket comm. TCP/IP socket communication Detached VMS Process executing ICARUS_SVR. Client Server UBS Giampaolo Trenta Juni 98 / 8 A /SHARE process can serve many clients concurrently Authentication is performed directly by the share process based on OpenVMS username/password There is no OpenVMS login (interactive/noninteractive) for users using /SHARE However, the OpenVMS context of the users is fully respected for access control Network access could be an issue since /SHARE makes libraries available over the network In reality good performance has been observed especially using sql 8

9 /SHARE Server Startup submit/user=icarus $run/detach/process=icarus_srv /uic =icarus/.. /priv =(nosame,netmbx,..) /error =icarus_srv_err.log /output =icarus_srv.log /input =icarus_srv.com sys$systemloginout.exe $ /LS=80 /LOG=ICARUS_SRV_.LOG /FULLSTIMER ICARUS_SRV. icarus_svr.com icarus_svr_startup.com required privbilegies for ICARUS NETMBX, TMPMBX, SYSNAM, AUDIT icarus_svr.sas %let TCPSEC=_SECURE_; %let AUTHENCR=REQUIRED; options comamid=tcp; proc server uavalid=yes oavalid=yes id=icarus; run; UBS Giampaolo Trenta Juni 98 / 9 The /SHARE process must be up and running to allow user connections Not like /CONNECT where dedicated user processes are created on the fly The /SHARE process is implemented as a detached OpenVMS process running the image and a program Requiring encrypted authentication 9

10 /SHARE vs /CONNECT /SHARE /CONNECT authentication based on OpenVMS Auth. Database encryption username/password no OpenVMS user processes (no OpenVms licenses) data on server processed strictly locally (remote processing) users can be locked on OpenVMS level full OpenVMS audit on users users can change their password full OpenVMS access control restricted security and audit on OpenVMS (e.g. disuser) OpenVMS password change? no remote processing functions network traffic could be an issue hidden terminal based connection scripting to build terminal session no spawner in the current 6.12 for OpenVMS OpenVms login with plaintext username/password every client session required OpenVMS license user could get DCL-prompt user can execute DCL-command UBS Giampaolo Trenta Juni 98 / 10 Both product strictly observe OpenVMS and fully implement access control 10