DB2 for z/os Security

Transcription

1 DB2 for z/os Security Jim Pickel, STSM IBM DB2 for z/os Development Cloud, Mobile and Security Thursday, Sept (11:00 12:00) Platform: DB2 for z/os

2 Agenda DB2 for z/os Security Overview Protecting Remote Access Protecting Data Access Audit V12 Security Enhancements

3 DB2 for z/os Security Controls access to DB2 subsystem and objects in DB2 Provides security functions to meet your security objectives Provides Audit capabilities to monitor access DB2 security alone is not enough, you should leverage existing mainframe security policies and processes that have been developed over many years Deep integration with System z Security functions give DB2 a strong advantage RACF DB2 Network SECURING YOUR SYSTEMS REQUIRE A LAYERED APPROACH 3

4 Protecting Remote Access API API Connect API API API API API IBM Watson

5 z/os Built-in Protection Communications Server creates a protective zone around DB2 Application Transparent Transport Layer Security (AT-TLS) referred to as Secure Socket Layer (SSL) can be used to protect data between applications and DB2 Intrusion Detection Services (IDS) inspects inbound and outbound network activity and identifies suspicious patterns IP packet filtering blocks out all IP traffic that the DB2 server doesn t specifically permit IP Security (IPSec) is used to provide a secure connection between systems TCP transport layer AT-TLS Intrusion Detection Services IP Networking layer Intrusion Detection Services IP Filtering IPSec

6 z/os Built-in Protection Security Server protects all user access to DB2 RACF Passticket One-time only password generated for a requesting application Eliminates the need to send RACF passwords across the network in clear text. RACF SERVAUTH profiles Can be set up to protect user access from specific networks RACF Password Phrases Character string made up of mixed-case letters, numbers, special characters, and is between 9 to 100 characters long Can be used instead of a traditional 8-character password RACF DSNR Certificate Authentication Passticket Kerberos Password phrases Userid Password 256 bit AES encryption SERVAUTH

7 Improved Security functions for remote access Client Certificate Authentication AT-TLS secure handshake performs identification and authentication for client certificates DB2 client driver presents its certificate as identification and proof-of-possession as authentication Client authentication is optional and if used, can provide three levels of authentication Level 1 authentication performed by system SSL Level 2 authentication requires that a client certificate is registered with RACF Level 3 authentication provides the capability to restrict access to a server based on the user ID associated with a client certificate RACF certificate name filtering (RACDCERT MAP command) can map many certificates with one user ID Enforce connection level security using strong authentication Subsystem parameter, TCPALVER value SERVER_ENCRYPT enforces connections must use strong authentication to access DB2 7

8 DB2 Now Supports Restful HTTP POST, GET, and PUT calls (PI6682) DB2 TCP/IP listener PORTs support both DRDA and HTTP(S) requests HTTP requests are protected using a new DSNR REST check HTTP header can contain only a user ID or if a stronger form of security, such as a password or a PassTicket, is needed. If the HTTP header does not provide user credentials, authentication is performed at the network layer that uses client certificate authentication. Data Studio or Create Service API is used to create a REST Application Package requires the privileges necessary to bind a package POST { "requesttype": "createservice", "sqlstmt": "<actual sql statement>", "servicename": "<servicename>", ["collectionid": "<collectionid>",] ["description": "<servicedescription>",] ["bind options": "<values>"] } The Discover Service API is used to discover detailed information about a service if user has the required authority to execute the package GET The Invoke Service API is used to invoke a user created service if user has the required authority to execute the package POST name> 8

9 Trusted Context Provides better access control from application servers and addresses administrator challenges Trusted context establishes trust between DB2 and an external entity such as RRSAF (Resource Recovery Services Attachment Facility) CAF (Call Attachment Facility) DSN Command Processor Application Server or HTTP requests Once established, a trusted connection provides the ability to Efficiently switch user with optional authentication Acquire special set of privileges using a Role Acquire special RACF Security Label authority Manage trusted context using SQL CREATE / ALTER / DROP TRUSTED CONTEXT IBM z Systems Security 9 Conference September Montpellier

10 Database Role Database entity with one or more privileges SQL GRANT to grant privileges to a role CRITERIA(SQLROLE) keyword for permitting privileges using role in RACF Established only through a trusted connection Can optionally be the OWNER of DB2 objects Manage role using SQL CREATE / DROP ROLE IBM z Systems Security 10 Conference September Montpellier

11 Trusted Context Authid Switching Allows trusted connection to be used by different users Optional authentication requirement Specific ROLE and RACF Security Label can be assigned to the user Switch user options Authorization name EXTERNAL SECURITY PROFILE Profile-name PUBLIC Distributed Identities Can be used to exploits RACF distributed identity mapping capability RACF RACMAP command is used to associate a distributed ID to a DB2 RACF user ID. 11

12 Securing mobile and cloud applications Trusted context and role can be used to limit the exposure Remove privileges from users and assign privileges to roles using a trusted context Access can be restricted so they are only valid when connected from the valid IP addresses Application or REST Client IP Address= DB2 Server CREATE ROLE APP_ROLE; GRANT TO ROLE APP_ROLE; CREATE TRUSTED CONTEXT... ATTRI BUTES(ADDRESS )... DEFAULT ROLE APP_ROLE;

13 Protecting Data Access

14 Data Protection Best Practices Incorporating separation of duties Limit the use of privileged users Restrict the use of implicit privileges Limit the view of data Enable auditing of privileged users Enable auditing of tables with sensitive data Encrypting sensitive data Periodic audits to verify security process Assess Defend Audit COMPLIANCE IS A CONTINUOUS PROCESS

15 Incorporate Separation of Duties in your security processes DB2 Native Authorization Database administrators manage security Security definitions in DB2 Catalog External Exit Authorization System Security administrators manage security Security definitions and data are separate Objects don't need to exist DB2 11 removes majority of the restrictions imposed when using the authorization exit

16 Separation of Security from System Administration System Authorities for Security management SECADM Manage access control using SQL GRANT and REVOKE Manage DB2 security objects and audit policies ACCESSCTRL Manage access control using SQL GRANT and REVOKE Exception: System DBADM, DATAACCESS, ACCESSCTRL authorities Exception: CREATE_SECURE_OBJECT privilege System Parameter: SEPARATE_SECURITY Install SECADM authority manages subsystem security SYSADM and SYSCTRL can no longer implicitly grant or revoke privileges, set package owner to any value SYSADM can no longer set current SQLID to any value Install SYSADM authority not impacted

17 Granular System Authorities: Reduce risk by minimizing use of SYSADM System Database Administrative Authorities System DBADM Manage user objects DATAACCESS Access to data in all user tables ACCESSCTRL Control access to data System Authority for Monitoring and Tuning SQL SQLADM authority EXPLAIN privilege System parameter REVOKE_DEP_PRIVILEGES Control cascading effect of revoke Revoke dependent privileges SQL clause INCLUDING DEPENDENT PRIVILEGES NOT INCLUDING DEPENDENT PRIVILEGES NOT INCLUDING DEPENDENT PRIVILEGES drops dependent views/mqts and invalidates dependent packages 17

18 DB2 11: External Security Enhancements Support OWNER privileges for authorization Allows owner to be checked for authorization on BIND and REBIND commands Supports dynamic SQL authorization using DYNAMICRULES behavior Package owner ID that executes the package ID that defined the routine ID that invokes the routine Allows automatic rebind (AUTOBIND) Owner can be a RACF ID, GROUP or ROLE. DB2 provides owner ACEE to RACF Similar behavior between DB2 native authorization and RACF exit authorization New installation parameter, AUTHEXIT_CHECK is used to govern owner authorization Values: DB2, PRIMARY (default)

19 DB2 11: External Security Enhancements Sync RACF Permission Changes to DB2 Cache ENF 62 DB2 Engine Exit ENF 71 RACF RACLIST Classes ENF 79 PKG Auth Cache Routine Auth Cache Dynamic Stmnt Cache DDF User Cache User Definitions Group Definitions DB Objects 2 Almost instant updates SETROPTS 1 Changes made

20 To Help Keep DB2 in sync with RACF changes RACF Event Notifications (ENF) Notifications generated by RACF when a profile is changed DB2 11 listens for: ENF 62: RACF options refreshed SETROPTS RACLIST REFRESH ENF 71: User permissions changed ALTUSER REVOKE, CONNECT REVOKE, DELUSER, DELGROUP, REMOVE ENF 79: User permissions to access resource changed PERMIT..DELETE, ACCESS(NONE), RESET, WHEN(CRITERIA(SQLROLE...)) RALTER.. UACC(NONE), DELMEM; RDELETE On receipt of ENF 79, DB2 stores the changes and refreshes cache entries only when ENF 62 is heard Requirement: RACF class descriptor table must have SIGNAL = YES Enabled for IBM supplied RACF resource classes for DB2 New installation parameter, AUTHEXIT_CACHEREFRESH is used to govern cache refresh Values: All, None (default)

21 Restrict the use of implicit privileges Trusted context and role help address concerns with implicit owner privileges and DBA access to sensitive data An auditable DBA process can be done with trusted context and role: Create a role, DBAROLE Grant DBADM to role, DBAROLE Create a trusted context for the DBA and assign role, DBAROLE with role as the object owner When a DBA needs to perform a system change: ENABLE trusted context to allow access DISABLE trusted context after the change is done An auditor can review the audit trace Objects created by this process will be owned by role, DBAROLE.

22 Data Privacy: Row and Column Access Controls Views for access control Evolution of security policies affect security logic in applications View s updatability may not correctly reflect security policies Complex to contain all the restrictions in one view Can be bypassed by malicious users Difficult to maintain Row Permissions and Column Masks Define additional data controls at the row and column level in DB2 Security policies are defined using the power of SQL Separate security logic from application logic Protects all access via SQL including privileged users, adhoc query tools, report generation tools is automatically protected Policies can be added, modified, or removed to meet current company rules without change to applications

23 How to exploit row and column access controls SQL CREATE PERMISSION establishes a row policy for a table Filter rows out of answer set Policy can use session information, e.g. the group or the role associated with the user, to control the rows returned in result set Applicable to SELECT, INSERT, UPDATE, DELETE & MERGE statements Row permission definition: CREATE PERMISSION policy-name ON table-name FOR ROWS WHERE search-condition ENFORCED FOR ALL ACCESS ENABLE;

24 How to exploit row and column access controls SQL CREATE MASK establishes a column policy for a table Mask column values in answer set Policy can use session information, e.g. the group or the role associated with the user, to control the masked value returned in result set Applicable to the output of outermost subselect Column mask definition: CREATE MASK mask-name ON table-name FOR COLUMN column-name RETURN CASE-expression ENABLE;

25 How to exploit row and column access controls Table policies can be defined based on session information SESSION_USER Primary authorization ID of the process CURRENT SQLID SQL authorization ID of the process VERIFY_GROUP_FOR_USER function VERIFY_ROLE_FOR_USER function Managed using ALTER TABLE ACTIVATE/DEACTIVATE ROW/COLUMN ACCESS CONTROL SECADM authority is required to alter these options DB2 11 supports GROUP BY, DISTINCT, UNION for Column Mask

26 Audit

27 Audit tables with sensitive data Establish audit policies to audit any table with sensitive data Audit specific programs or users during the day Audit policy allows to audit use of any authority Audit policy allows to audit all access to a table Does not require AUDIT clause to be specified using DDL to enable auditing Generate records for all read and update access not just first access Generate additional records identifying the specific SQL statements Wildcarding based on table names Audit policies allows to comply without the need of external collectors

28 How to exploit Audit Policies Security Administrator using the SECADM authority maintains DB2 audit policies in the catalog table, SYSIBM.SYSAUDITPOLICIES Audit policies enabled using STA TRACE command Audit policies disabled using STO TRACE command Up to 8 audit policies can be specified to auto start or auto start as secure during DB2 start up Only user with SECADM authority can stop a secure audit policy trace

29 Audit policy categories Categories CHECKING VALIDATE OBJMAINT EXECUTE CONTEXT SECMAINT SYSADMIN DBADMIN Mapping IFCIDs IFCID 83 (only authentication failures), IFCID 140 IFCIDs 55, 83, 87, 169, 269, 319 IFCID 142 IFCIDs 143, 144, 145 IFCIDs 23, 24, 25 IFCIDs 141, 270, 271 IFCID 361 (Audits installation SYSADM, installation SYSOPR, SYSOPR, SYSCTRL, SYSADM) IFCID 361 (Audits DBMAINT, DBCTRL, DBADM, PACKADM, SQLADM, system DBADM, DATAACCESS, ACCESSCTRL, SECADM)

30 Audit change data Audit change data by enabling a Temporal Table to automatically maintain a history as an audit trail Two types of time sequences of table rows are supported with database defined time periods SYSTEM_TIME Period that represents when a row is valid to the system BUSINESS_TIME Period that represents when a row is valid to the user or application BITEMPORAL Combines SYSTEM_TIME period and BUSINESS_TIME period System period data versioning Alter an existing table or create a table with two timestamps Create a history table and define a versioning relationship between the tables Auditor can query historical data through SQL DB2 rewrites the user s query to include data from the history table

31 Audit change data DB2 for z/os V10 system versioning feature provided an auditing solution to track WHEN the data is modified. DB2 for z/os V11 supports new GENERATED ALWAYS AS clause to audit and track WHO modified the data and WHAT action (SQL statement) caused the data modification. Delete operation can also be audited. APARs PM99683/PI15298/PI15666 Supported on CREATE and ALTER TABLE statements generated-clause supports: DATA CHANGE OPERATION Special-register Session-variable

32 Audit change data Special registers that can be audited using GENERATED ALWAYS AS clause: Example: User_id Varchar(128) GENERATED ALWAYS AS (USER) CURRENT CLIENT_ACCTNG VARCHAR(255) CURRENT CLIENT_APPLNAME VARCHAR(255) CURRENT CLIENT_CORR_TOKEN VARCHAR(255) CURRENT CLIENT_USERID VARCHAR(255) CURRENT CLIENT_WRKSTNNAME VARCHAR(255) CURRENT SERVER CHAR(16) CURRENT SQLID VARCHAR(8) SESSION_USER or USER VARCHAR(128)

33 Audit change data Session Variables that can be audited using GENERATED ALWAYS AS clause: Example: Pkg_name Varchar(128) GENERATED ALWAYS AS (SYSIBM.PACKAGE_NAME) SYSIBM.PACKAGE_NAME VARCHAR(128) SYSIBM.PACKAGE_SCHEMA VARCHAR(128) SYSIBM.PACKAGE_VERSION VARCHAR(122) DATA CHANGE OPERATION DB2 generates one of the following values: I Insert operation U Update operation D Delete operation A table can have only one DATA CHANGE OPERATION column

34 V12 Security Updates

35 Separation of duties Transfer ownership New SQL statement TRANSFER OWNERSHIP Allows to transfer the ownership of database objects to an authorization-id or a role Database objects and system object are supported Database, Table space, Table, View, Index Stogroup No change to the schema of the transferred object No change to the grants made by the previous owner Ownership or SECADM authority is required to do the transfer

36 Separation of duties Install / Migration and Utility changes Install or migrate DB2 subsystem using installation SYSOPR authority Allows a system administrator to install or migrate a subsystem with no expose to user data Requires current SQLID to be set to SYSINSTL Requires BIND owner with privilege to bind and execute SQL in the package Installation and migration jobs have been modified to support the new process New UNLOAD privilege to separate SQL and utility access New UNLOAD privilege is checked, by default, for UNLOAD utility access with new function activation AUTH_COMPATIBILITY zparm can be set to SELECT_FOR_UNLOAD to retain SELECT privilege check IFCID 404 can be activated to audit SELECT privilege usage for UNLOAD IFCID 404 V11 APAR PI

37 Summary Trusted connections provide better user accountability and improved compliance Granular administrative authorities help reduce data exposure for administrators Row and column access table controls implement privacy controls to safe guard your data Access Control Authorization Exit enhancements provide consistent security model and improved RACF integration Auditing features using Audit Policies provide better auditing capabilities Temporal data to comply with regulations to maintain historical data 37

38 Disclaimer Information regarding potential future products is intended to outline our general product direction and it should not be relied on in making a purchasing decision. The information mentioned regarding potential future products is not a commitment, promise, or legal obligation to deliver any material, code or functionality. Information about potential future products may not be incorporated into any contract. The development, release, and timing of any future features or functionality described for our products remains at our sole discretion.

39 Legal Disclaimer IBM Corporation All Rights Reserved. The information contained in this publication is provided for informational purposes only. While efforts were made to verify the completeness and accuracy of the information contained in this publication, it is provided AS IS without warranty of any kind, express or implied. In addition, this information is based on IBM s current product plans and strategy, which are subject to change by IBM without notice. IBM shall not be responsible for any damages arising out of the use of, or otherwise related to, this publication or any other materials. Nothing contained in this publication is intended to, nor shall have the effect of, creating any warranties or representations from IBM or its suppliers or licensors, or altering the terms and conditions of the applicable license agreement governing the use of IBM software. References in this presentation to IBM products, programs, or services do not imply that they will be available in all countries in which IBM operates. Product release dates and/or capabilities referenced in this presentation may change at any time at IBM s sole discretion based on market opportunities or other factors, and are not intended to be a commitment to future product or feature availability in any way. Nothing contained in these materials is intended to, nor shall have the effect of, stating or implying that any activities undertaken by you will result in any specific sales, revenue growth or other results. If the text contains performance statistics or references to benchmarks, insert the following language; otherwise delete: Performance is based on measurements and projections using standard IBM benchmarks in a controlled environment. The actual throughput or performance that any user will experience will vary depending upon many factors, including considerations such as the amount of multiprogramming in the user's job stream, the I/O configuration, the storage configuration, and the workload processed. Therefore, no assurance can be given that an individual user will achieve results similar to those stated here. If the text includes any customer examples, please confirm we have prior written approval from such customer and insert the following language; otherwise delete: All customer examples described are presented as illustrations of how those customers have used IBM products and the results they may have achieved. Actual environmental costs and performance characteristics may vary by customer. Please review text for proper trademark attribution of IBM products. At first use, each product name must be the full name and include appropriate trademark symbols (e.g., IBM Lotus Sametime Unyte ). Subsequent references can drop IBM but should include the proper branding (e.g., Lotus Sametime Gateway, or WebSphere Application Server). Please refer to for guidance on which trademarks require the or symbol. Do not use abbreviations for IBM product names in your presentation. All product names must be used as adjectives rather than nouns. Please list all of the trademarks that you use in your presentation as follows; delete any not included in your presentation. IBM, the IBM logo, Lotus, Lotus Notes, Notes, Domino, Quickr, Sametime, WebSphere, UC2, PartnerWorld and Lotusphere are trademarks of International Business Machines Corporation in the United States, other countries, or both. Unyte is a trademark of WebDialogs, Inc., in the United States, other countries, or both. If you reference Adobe in the text, please mark the first use and include the following; otherwise delete: Adobe, the Adobe logo, PostScript, and the PostScript logo are either registered trademarks or trademarks of Adobe Systems Incorporated in the United States, and/or other countries. If you reference Java in the text, please mark the first use and include the following; otherwise delete: Java and all Java-based trademarks are trademarks of Sun Microsystems, Inc. in the United States, other countries, or both. If you reference Microsoft and/or Windows in the text, please mark the first use and include the following, as applicable; otherwise delete: Microsoft and Windows are trademarks of Microsoft Corporation in the United States, other countries, or both. If you reference Intel and/or any of the following Intel products in the text, please mark the first use and include those that you use as follows; otherwise delete: Intel, Intel Centrino, Celeron, Intel Xeon, Intel SpeedStep, Itanium, and Pentium are trademarks or registered trademarks of Intel Corporation or its subsidiaries in the United States and other countries. If you reference UNIX in the text, please mark the first use and include the following; otherwise delete: UNIX is a registered trademark of The Open Group in the United States and other countries. If you reference Linux in your presentation, please mark the first use and include the following; otherwise delete: Linux is a registered trademark of Linus Torvalds in the United States, other countries, or both. Other company, product, or service names may be trademarks or service marks of others. If the text/graphics include screenshots, no actual IBM employee names may be used (even your own), if your screenshots include fictitious company names (e.g., Renovations, Zeta Bank, Acme) please update and insert the following; otherwise delete: All references to [insert fictitious company name] refer to a fictitious company and are used for illustration purposes only.

40 References Security Functions of IBM DB2 10 for z/os (SG ) DB2 10 for z/os Technical Overview (SG ) DB2 11 for z/os Managing Security (SC ) 01.ibm.com/support/knowledgecenter/SSEPEK_11.0.0/com.ibm.db2z11.doc/src/alltoc/db2z_m secuhome.dita?lang=en DB2 11 for z/os RACF Access Control Module Guide (SC ) DB2 11 for z/os Administration Guide (SC ) DB2 10 for z/os: Configuring SSL for Secure Client-Server communications - Red paper DB2 for z/os Information Center IBM z Systems Security 40 Conference September Montpellier