Enforcive CPA Cross Platform Auditing

Company Profile Formed in 1983 Pioneer in IBM mainframe and midrange security Offices in New Jersey, Toronto and Israel 80 Resellers in 60 countries Global distribution agreement with IBM Thousands of installations worldwide, including Fortune 500 companies Expertise in Compliance and Event auditing – cross platform

Customers Around the World

CPA Customers

Banking Finance Insurance Automotive Electronics Pharmaceutical Healthcare Transportation Manufacturing Others Customers from Many Segments

Enforcive Cross Platform Security Offering 6 CPS Cross Platform Security ES for IBM i Enterprise Security MF/CICS & DB2CPA Cross Platform Audit CPC Cross Platform Compliance PSS Password Self Service All products work together and can be operated through a common GUI manager Host Based Security, Audit & Compliance for IBM i Log Management & Database Activity Monitoring GRC Password Synchronization - SSO Host Based Security & Audit for IBM mainframe Access Management Field Encryption Log Management Compliance Management For IBM i Windows Unix (AIX & Solaris) Linux OS400 z/OS MS SQL Server Oracle DB2 Sybase My SQL Progess Syslog Flat File Format Windows AIX IBM i (OS400 & DB2) MS SQL Server Oracle IBM i Windows Access Management Field Masking Log Management for z/OS – CICS VSE – CICS DB2 VSAM

Goodbye Haystacks. Find the needles you’ve been looking for. Easy Said. Easy Done.

What is the Cross-Platform Audit™? An enterprise-wide Compliance Event Monitor. The CPA is all about practical organizational security. It provides log monitoring for your computer systems, and databases; collecting and consolidating data from across the enterprise. Many sources available including: Windows, Mainframe, IBM i, Unix, DB2, SQL, Oracle and Progress. The CPA filters then collects the events into a single database and presents them in an intuitive GUI for ease of analysis and investigation.

The Need Monitoring of the organization in order to satisfy regulatory policies in a multi-platform environment. Administrators need minimal platform specific expertise to achieve their goals. Reduces the need to use local disk to store historical log files. Simplifies forensic investigation by correlating seemingly unconnected events into an audit trail indicating a possible breach of security.

Differentiators A single Management Console is used to manage the central repository as well as the individual systems that are being monitored. Focus is on critical information, for example the important data changes performed in the database. High visibility of changes using before and after images. Specialized IBM i logs – covering many unique event categories, with a high level of granularity. Specialized IBM Mainframe logs – covering a large amount of event categories, with a high level of granularity.

Features of the Cross-Platform Audit™ Collection of diverse data formats into a uniform database. Comprehensive monitoring in a multi-platform environment. Reporting real user activity utilizing all the user’s identities. Graphical analysis of security information statistics. Powerful filtering to pinpoint events with specific characteristics. Event information drill-down to the field change level, incorporating ‘before’ & ‘after’ images. Audit information from different systems available all in one place. Comprehensive audit information for every critical event, showing exactly who did what, when and how.

Collection Flow

All Sources System Audit File and Field Audit Alerts Application Audit SQL Statement IP Filter Compliance Message Queue History Log View Data SMF TELNET SMF FTP SMF VSAM SMF RACF TCP/IP Application Audit (FTP and Telnet) DB2 SMF DB2 LOG (Data Audit) DB2 CICS (SQL Data Capture) DB2 BATCH (SQL Data Capture) System Audit UNIX DB2 System Audit X86 System Audit 86_64 System Audit IA64 System Audit PPC64 System Audit PPC System Audit S390X System Audit S390 System Audit SQL Statements SQL System Audit SQL Data Audit SQL Statements Oracle System Oracle Admin Oracle Profiles/Users Oracle Procedures Data Audit DB2 SMF – MF DB2 LOG (Data Audit) – MF DB2 CICS (SQL Data Capture) – MF DB2 BATCH (SQL Data Capture) – MF DB2 System Audit – i, AIX, LUW DB2 SQL Statement Audit – i, AIX, LUW System Audit Data Audit Windows Event Logs: Security, Application, DNS, and more Windows Active Directory Compliance ISA Server logs DHCP logs IIS Web Server logs Exchange Server System Audit SYSLOG Sources Routers Firewalls Antivirus Other SYSLOG senders Audit Connect Query Prepare Execute Shutdown Quit No audit Init DB Other

Event Sources (click category to expand) IBM Systems Open Systems Databases Microsoft Servers Syslogs (view all)

IBM Systems IBM System i (AS/400) IBM System z (Mainframe) IBM System p (AIX) <Return

IBM Systems Operating system: V5R1M0 and above System Audit File and Field Audit Alerts Application Audit SQL Statement IP Filter Compliance Message Queue History Log View Data IBM System i (AS/400) IBM System z (Mainframe) IBM System p (AIX) <Return

IBM Systems Operating system: z/OS v 1.9 and above SMF TELNET SMF FTP SMF VSAM RACF (according to operating system) SMF RACF Communication Server (TCP/IP) (according to operating system) TCP/IP Application Audit (FTP and Telnet) DB2 v8, v9 and above DB2 SMF DB2 LOG (Data Audit) DB2 CICS (SQL Data Capture) DB2 BATCH IBM System i (AS/400) IBM System z (Mainframe) IBM System p (AIX) <Return

IBM Systems Operating system: IBM AIX 5.3 System Audit UNIX DB2 IBM System i (AS/400) IBM System z (Mainframe) IBM System p (AIX) <Return

Open Systems Linux Solaris *Coming SoonSolaris <Return

Open Systems Linux Solaris *Coming SoonSolaris <Return Operating system: Linux all distributions (Red Hat, CentOS) Kernel version >= 2.6 System Audit X86 System Audit 86_64 System Audit IA64 System Audit PPC64 System Audit PPC System Audit S390X System Audit S390

Cross-Platform Security™ Enterprise-wide Compliance Event Monitor Updated: October, 2013

Open Systems Linux Solaris *Coming SoonSolaris <Return System Audit

Databases Agentless collection SQL Server Oracle Server Progress OpenEdge DB2 Sybase <Return

Databases Agentless collection SQL Server Oracle Server Progress OpenEdge DB2 Sybase <Return SQL Server 2005/2008 SQL Statements SQL System Audit SQL Data Audit SQL Server 2000 SQL Data Audit

Databases Agentless collection SQL Server Oracle Server Progress OpenEdge DB2 Sybase <Return V10 and up SQL Statements Oracle System Oracle Admin Oracle Profiles/Users Oracle Procedures Data Audit

Databases Agentless collection SQL Server Oracle Server Progress OpenEdge DB2 Sybase <Return V10, V11 System Audit Data Audit

Databases Agentless collection SQL Server Oracle Server Progress OpenEdge DB2 Sybase <Return DB2 v8, v9 and above DB2 SMF DB2 LOG (Data Audit) DB2 CICS (SQL Data Capture) DB2 BATCH DB2 LUW (Linux UNIX Windows) DB2 System Audit DB2 SQL Statement Audit

Databases Agentless collection SQL Server Oracle Server Progress OpenEdge DB2 Sybase <Return V15.7 System Audit

Microsoft Servers Agentless collection Windows Server 2008 Windows Server 2003 Windows Server 2000 Windows 7 Windows XP <Return

Microsoft Servers Agentless collection Windows Server 2008 Windows Server 2003 Windows Server 2000 Windows 7 Windows XP <Return Windows Event Logs: Security, Application, DNS, and more Windows Active Directory Compliance ISA Server logs DHCP logs IIS Web Server logs

Microsoft Servers Agentless collection Windows Server 2008 Windows Server 2003 Windows Server 2000 Windows 7 Windows XP <Return Windows Event Logs: Security, Application, DNS, and more Windows Active Directory Compliance ISA Server logs DHCP logs IIS Web Server logs

Microsoft Servers Agentless collection Windows Server 2008 Windows Server 2003 Windows Server 2000 Windows 7 Windows XP <Return Windows Event Logs: Security, Application, DNS, and more Windows Active Directory Compliance ISA Server logs DHCP logs IIS Web Server logs

Microsoft Servers Agentless collection Windows Server 2008 Windows Server 2003 Windows Server 2000 Windows 7 Windows XP <Return Windows Event Logs: Security, Application, DNS, and more Windows Active Directory Compliance

Microsoft Servers Agentless collection Windows Server 2008 Windows Server 2003 Windows Server 2000 Windows 7 Windows XP <Return Windows Event Logs: Security, Application, DNS, and more Windows Active Directory Compliance

Syslogs Routers Firewalls Antivirus Other Syslog senders <Return

Syslogs Routers Firewalls Antivirus Other Syslog senders <Return Standard Syslog messages can be picked up by the Enforcive Syslog Connector, then forwarded to the CPA Manager. If required CPA can act as a SYSLOG server.

Syslogs Routers Firewalls Antivirus Other Syslog senders <Return Standard Syslog messages can be picked up by the Enforcive Syslog Connector, then forwarded to the CPA Manager. If required CPA can act as a SYSLOG server.

Syslogs Routers Firewalls Antivirus Other Syslog senders <Return Standard Syslog messages can be picked up by the Enforcive Syslog Connector, then forwarded to the CPA Manager. If required CPA can act as a SYSLOG server.

Syslogs Routers Firewalls Antivirus Other Syslog senders <Return Standard Syslog messages can be picked up by the Enforcive Syslog Connector, then forwarded to the CPA Manager. If required CPA can act as a SYSLOG server.

Feature: CPA as SYSLOG Server

Our Goal: Simplicity in implementation and daily use.

Implementation: Simple Steps Add Systems Set Audit Policy Define Data Transfer Specify Alerts Tailor Reports

Examples: Using CPA 1) Make a change to table contents in SQL 2) View that event locally 3) View that event in the Central Repository 4) Defining an audit policy 5) How to define which events are collected 6) How to alert on critical events 7) Investigating a global user’s activities 8) Visual analysis 9) Correlation Reporting

1: Make a change to table contents in SQL This example demonstrates how the CPA Repository will monitor critical events within a database: A user executes an SQL statement to change the salary field in an employee record.

2: View that event locally The change appears locally, both in the SQL Statement Audit and in the Data Audit SQL Statement Audit: Data Audit: Curren t Previou s

3: View that event in the Central Repository Once collected into the Repository the information can be filtered by date, platform and user. The event will appear both as an SQL statement and a Data Audit event showing the changes Curren t Previou s

4: Defining an Audit Policy

5. How to define which events are collected.

6: How to alert on critical events.

7: Investigating a Global User’s Activities IBM z IBM i Windows AIX DB2

8: Visual Analysis Report of currently active applications

8: Visual Analysis

9: Correlation Reporting Network Access Login:

9: Correlation Reporting Database contents before and after image report:

9: Correlation Reporting Mainframe Violations in both RACF and DB2

9: Correlation Reporting Oracle Logon Failure Report

9: Correlation Reporting Program Failures

Sneak Peek: User Identification Functionality