PRODUCT sheet: CA RC/Secure for DB2 for z/os CA RC/Secure for DB2 for z/os CA RC/Secure for DB2 for z/os (CA RC/Secure) is a comprehensive, online security administration tool for DB2 for z/os that helps you streamline and automate the tasks of DB2 security administration. Business Value Product Overview Delivery Approach Effectively managing the authorities within a DB2 for z/os system can be a rigorous, full-time responsibility for a DB2 security administrator, especially if there are multiple DB2 subsystems with multiple users and departments. CA RC/Secure helps organizations easily grant and revoke privileges, monitor authorities, perform impact analyses, and much more. CA RC/Secure generates all of the required SQL statements, making DB2 security more manageable than ever. CA RC/Secure eases the burden of DB2 security administration by streamlining and automating tasks and enabling your DBAs to delegate responsibilities to others as necessary. CA RC/Secure automatically generates the commands necessary to grant or revoke privileges. CA Services provides a portfolio of mainframe services delivered through CA internal staff and a network of established partners chosen to help you achieve a successful deployment and get the desired business results as quickly as possible. Our standard service offerings are designed to speed deployment and accelerate the learning curve for your staff. CA s field-proven mainframe best practices and training help you lower risk, improve use/ adoption, and ultimately align the product configuration to your business requirements.
Features Mainframe 2.0 CA RC/Secure has adopted key Mainframe 2.0 features that are designed to simplify your use of CA RC/Secure and enable your staff to install, deploy, and maintain it more effectively and quickly. CA Mainframe Software Manager The CA Mainframe Software Manager (MSM) automates CA RC/Secure installation, deployment, and maintenance and removes SMP/E complexities. The Software Acquisition Service enables you to easily move product installation packages and maintenance from CA Support Online directly to your mainframe environment and prepare them for installation. The Software Installation Service standardizes CA RC/Secure installation, which includes a new, streamlined Electronic Software Delivery (ESD) method that allows CA RC/Secure to be installed using standard utilities. This service also provides standardized SMP/E product installation and maintenance via APARs and PTFs, and simplifies SMP/E processing through an intuitive graphical user interface and an intelligent Installation Wizard. The Software Deployment Service enables you to easily deploy CA RC/Secure in your mainframe environment. CA MSM Consolidated Software Inventory (CSI) updates and infrastructure improvements add flexibility to CA MSM processing of CSIs and enable CA MSM to more effectively utilize CPU and system memory. Installation Verification Program (IVP) and Execution Verification Program (EVP) As part of qualification for inclusion in the set of CA mainframe products released every May, CA RC/Secure has passed stringent tests performed through the IVP and the EVP to find and resolve interoperability problems prior to release. These programs are an extension of CA s ongoing interoperability certification initiative, launched in May 2009. Best Practices Guide This Guide provides information on CA RC/Secure installation, initial configuration, and deployment to shorten the learning curve for staff who are responsible for the installation and management of this product. What s New in r14 Synchronize CA RC/Secure with the DB2 Catalog After running the consistency report, you can resolve discrepancies between SRS tables and the DB2 catalog. By resolving these mismatches, you can synchronize CA RC/Secure with the DB2 catalog so that you can perform the following tasks: Revoke the authorities in DB2 that are not defined in SRS. Delete SRS objects that no longer exist in DB2. Key Capabilities CA RC/Secure provides: Flexible Security Planning CA RC/Secure provides the flexibility to develop a security plan that is optimally suited to a company s unique environment. The product supports centralized, departmental, and customized security process implementations. PRODUCT SHEET: CA RC/Secure for DB2 for z/os 2
Centralized Administration Large or complex organizations can use the Security Request Services (SRS) Domain-based facility to implement a centralized security plan, with one designated person or security group to handle security for an entire DB2 subsystem. SRS provides a centralized authorization ID that is used to issue the actual security commands. Because SRS separates ownership of objects from the ability to administer security on the objects, administrators can grant privileges that they do not possess. Departmental Administration Departmental security administration allows each operating area to administer its own security instead of submitting requests to centralized security administrators. SRS can be used to specify the maximum set of privileges for each department, as well as define the users that belong to a department so they can manage security for their area. Customized Requests For on-demand operations, CA RC/Secure contains the Grant/Revoke Services (GRS) facility, which provides a simple means of administering security when quick access to such objects as test tables is needed. Domain-based Security Implementation Because groups of users often share the use of applications, they also share groups of DB2 object privileges. However, DB2 does not directly allow grouping of users or of objects. The security needs to be granted between each user and each object. The SRS facility of CA RC/Secure allows you to easily administer security by grouping users and applications and specifying the relationships between them. When a user or application is added or removed from a group, CA RC/Secure automatically generates the security commands to effect the change. User Domains A Domain Administration facility places users into user domains. Both primary and secondary authorization IDs are supported, so the term user can indicate any authorization ID, whether primary or secondary. Users who need access to multiple applications can be listed in multiple domains, and SRS keeps track of users authorities in each domain as separate authorities. Application Domains Application domains contain DB2 privileges on DB2 objects. The SRS Domain Administration facility groups DB2 object privileges into application domains. Domain Relationships The Domain Relationship facility relates a user domain to an application domain. To assign a user access to a set of DB2 objects, you can simply assign the user to a user domain, and then relate the user domain to an application domain. Once a relationship has been defined, SRS determines the privileges that must be granted or revoked and generates the necessary control statements. Execution Procedures SRS lets you associate execution procedures with application or user domains. Execution procedures are files that are automatically processed during domain implementation. You can also capture the text of an execution procedure after all symbolic variables have been resolved, but before execution. This enables you to use the fully resolved execution procedure at a later time in a different location. Security Administration CA RC/Secure provides capabilities that make the day-to-day administration of DB2 security easier to control and manage. Standard Grant/Revoke Services Facility GRS provides a fast and easy online method of granting and revoking DB2 privileges by enhancing and simplifying the standard DB2 security system. You can use this facility to easily grant and revoke DB2 privileges without having to use the SRS component and create the user and application domains that it requires. PRODUCT SHEET: CA RC/Secure for DB2 for z/os 3
SRS Security Request Execution When security changes are requested through domain relationships, all GRANTs and REVOKEs are left pending. Pending privileges can be viewed before they are processed. SRS implementation runs online or as a batch job that executes all the necessary GRANTs and REVOKEs. You can execute the job during off-peak hours to optimize performance and reduce catalog contention. Recover Dropped Object Security You can display a list of objects defined to an SRS. Then, you can use the Recover Dropped Object Security facility to indicate which objects must have GRANTs re-executed to recover object authorities that were lost when the object was dropped. Revoke Impact Analysis When a privilege is revoked from one user, that same privilege is revoked from other users to whom that user has granted the privilege. Revoke Impact Analysis allows you to see the impact that a revoke will have not only on the named user but on possible dependent users before issuing the revoke statement. COLLAPSE Command You can choose to issue the COLLAPSE command to revoke authorities from the specified ID and cause the next-higher level of the hierarchy to grant the authorities to the next-lower level of the hierarchy. COLLAPSE revokes authorities from one ID without affecting the authorities of other IDs in the chain. Catalog Consolidation Using secondary IDs can significantly impede system performance, forcing DB2 to search both primary and secondary IDs when accessing DB2 resources. The Catalog Consolidation facility allows you to consolidate primary and secondary ID authorities and eliminate duplicate authorities without the danger of unplanned revoke cascades. Report and Analysis Facilities These facilities help security administrators understand and document the security that has been established in their DB2 environment. Log Display This displays a detailed audit trail of all grants and revokes that are executed through SRS or GRS and provides the ability to specify which grantor, grantee, item, creator, and time-frame to view. Secondary Authid Services This facility can be leveraged to monitor authorities held by users through both their primary and secondary IDs. Security authid services easily generate reference reports that correlate primary and secondary IDs and list the authorities held by specific IDs. Report Facility The Report facility provides the following types of reports: User Report Lists privileges for a user Privilege Report Lists users who have access to an object Domain Report Provides information on the domain Pending Report Lists pending GRANTs and REVOKEs by object, department, or DB2ID Relationship Report Shows the relationships between users, objects, user domains, and application domains, and also primary authid relationships to secondary IDs Comparative Report Shows which privileges were granted through SRS and which were granted through GRS or directly through DB2 Integration with Other CA Products For alteration and compare strategies created using CA RC/Migrator for DB2 for z/os (CA RC/Migrator), you can invoke CA RC/Secure to load PRODUCT SHEET: CA RC/Secure for DB2 for z/os 4
SRS information for newly created, dropped, or updated (renamed) objects. This automates the maintenance of the CA RC/Secure-managed security information for the objects. Benefits CA RC/Secure eases the burden of DB2 security administration by streamlining and automating tasks and enabling your DBAs to delegate responsibilities to others. It frees systems and database administrators from time-consuming and costly DB2 security administration by transferring these duties to those who are best equipped to determine the need for DB2 access. Easy to use, CA RC/Secure requires minimal DB2 expertise to operate. Online screens permit you to grant several authorities at once by selecting the desired objects, privileges, and users from selection lists. Since CA RC/Secure automatically generates the commands necessary to grant or revoke the privileges, time is not wasted hand-coding commands that are subject to trial and error. Why CA A key component of CA s Mainframe 2.0 strategy, CA RC/Secure is a member of the CA Database Management Solutions for DB2 for z/os family. Using these solutions helps you to optimize performance and reduce database downtime, as well as enhance the overall business value provided by DB2 applications. CA Database Management Solutions for DB2 for z/os is part of a family of database products that support both mainframe and distributed environments. This family of products helps enable you to reduce the amount of time, effort, and human error that is involved in implementing, maintaining, and maximizing the availability of efficient database applications. Organized into three solution areas comprised of Database Administration, Database Performance Management, and Database Backup and Recovery, these products help Database Administrators (DBAs) to be more productive, accurate, and efficient. CA Database Management provides products that help manage the total cost of database ownership by automating day-to-day operations and increasing overall service responsiveness. From DB2 and IMS on the mainframe to Oracle, DB2, and SQL Server on distributed servers, CA Database Management provides advanced technology and integration to manage increasingly large and complex databases. Copyright 2010 CA. All rights reserved. IBM, z/os, IMS, and DB2 are trademarks of International Business Machines Corporation in the United States, other countries, or both. All trademarks, trade names, service marks, and logos referenced herein belong to their respective companies. This document is for your informational purposes only. CA assumes no responsibility for the accuracy or completeness of the information. To the extent permitted by applicable law, CA provides this document as is without warranty of any kind, including, without limitation, any implied warranties of merchantability, fitness for a particular purpose, or noninfringement. In no event will CA be liable for any loss or damage, direct or indirect, from the use of this document, including, without limitation, lost profits, business interruption, goodwill, or lost data, even if CA is expressly advised in advance of the possibility of such damages. 1752