1 Authority on Demand Provide high authority “as-needed” with full Audit Trail

2 The Challenge Companies are finding it more and more difficult to monitor activities of “non-corporate” personnel such as consultants, auditors, contractors, etc. The increase in “insider threats”, i.e. from company personnel, has made it mandatory that employee’s activities be closely monitored. Emergency access to critical application data and processes is a very common security breach which is often uncovered in IBM i audits. Manual documentation of emergency access is not only error-prone, but does not comply with regulations and auditor’s security requirements. Companies define user’s security levels and allocate security rights in accordance with job responsibilities; sometimes (evenings, weekends, vacations, etc.) these rights may not be enough to carry out an assignment..

3 Authority on Demand- Features Easy to Use – Green-screen & GUI (suitable for non-technical staff) simplify granting special authorities when needed. Add & Swap Security Levels – Unique feature! Adds additional security rights to requesting user which is mandatory for correct auditing; can also swap higher rights from a more powerful user as done by competitive products, but this compromises auditing. Authority Transfer Rules & Providers – Easily pre-define special authority "providers" and special authority transfer rules, including in emergency situations. Safe Recovery from Emergency - Enables recovering from different types of emergency situations with minimum risk of human error. Full Monitoring Capabilities - logs and monitors all user’s activities during the period with higher authorities. Sends real-time alerts when personnel request higher authorities. Automatically sends audit trail report when high authority is released including screenshots viewed, commands issued, field data updated or viewed, etc. Controlled Access – Allows only relevant personnel to access business-critical data & processes.

4 Part 1 Authority on Demand Scenario

5 Without Authority on Demand: Inefficient Work Mode Sam Evans Programmer Has authorities for Test & Development Needs authorities for Production once a week Richard Garner Busy IT Manager Hi Sam… temporary authorities for the Production folder? Don’t have time now… maybe next week... OR OK, let me make a note on this slip of paper…Damn, can’t find it. Authority Request Rejected

6 With Authority on Demand: Automatic Granting of Special Authorities Let’s define authority rules: When Sam Evens requests authority for Production Folder between 8AM-16:30PM, Authority on Demand will automatically grant it… Uh, Richard, I need authorities for the Production folder again…

7 Requesting Special Authority… Now that we have AOD, I’ll request authority… Wow, this is so much easier than calling up Richard…

8 Instantly & Automatically Receiving Authorities Got the authorities!

9 Finally, I don’t have to waste my time on granting special authorities… the whole process is automatic and I can see a full log of Sam’s authority requests and even screen captures! Effective Monitoring of Special Authorities

Consultant or Programmer requests to temporary access to an object for which they don’t have authority; perhaps on a weekend, overnight, etc. Gives permanent additional authority Manually Adds additional authority to user profile and sets a reminder to revert Swaps requestor’s user profile with an alternate user profile which has higher authority Adds temporary higher authority to requestor’s user profile Full audit trail of requestor’s activities while working with higher authority. Authority should be given on “as needed” basis only Forgets to revert user profile to original status When viewing DB & QAUDJRN logs, a wrong user profile appears! No Risk thanks to AOD ProviderRequesterRegulator The 4 Options for the Authority Provider Risk

AOD Workflow: From User to Provider to Auditor User needs temporary, “higher” authority … User requests via GETAOD from Provider, automatically or ad-hoc (as QSECOFR) User receives temporary, higher authorities and Provider is notified Review Time Group IP Address Date/Time PIN User’s higher authorities revoked by RLSAOD or time expiration Auditor automatically receives reports and recorded session screenshots via Higher authority not granted Request Approved Request Not Approved

12 Part 2 Authority on Demand Screens

13 AOD Welcome Screen

14 Authority on Demand Log DANA obtained ADD authority of user QSECOFR in job /DANA/QPADEV0003. Reason: Need to check problem in production system. Confirmation ID: 5634 Time: 11/03/14 22:40 DANA released ADD authority of user QSECOFR in job /DANA/QPADEV0003. Time: 11/03/08 23:19 ID: 653 Attachment 1 – Commands entered Attachment 2 – Captured Screens Attachment 3 – DB Records changed Commands entered ID: 653, Attachment 1 DB Records changed ID: 653, Attachment 3 Captured Screens ID: 653, Attachment 2 * Other attachment options available (all QAUDJRN information, summary of changes made by Ad-Hoc utilities…)

15 Authority on Demand Main Menu

16 Work with Authority Rules

17 Modify an Authority Rule

18 Modify an Authority Rule

19 Work with Authority Providers

20 Modify definitions for an Authority Provider

21 Define (Option 6) and Change a Time Group

22 Activation menu (Option 11)

23 Request to obtain Authority (GETAOD)

24 GETAOD was successful- with message

25 messages for Start/End Authority

26 GETAOD was not successful- with message

27 Unsuccessful GETAOD: log and

28 Unsuccessful GETAOD- full explanation

29 Display AOD Log Entries- Option 41

30 Sample AOD Log Entries- F10 for Details

31 Select type of AOD Log entries to Display

32 This is the QAUDJRN log for one AOD request. Audit Log for one Get AOD request

33 AOD log contains “pointers” (i.e. attachments) to the appropriate QAUDJRN log. Option 43: Print Log

34 This is the printed QAUDJRN log for a single AOD request. Print output of QAUDJRN

35 Showing “Captured” Screen Image

36 Another “Captured” Screen Image

37 AOD System Configuration- Option 81

38 General Definitions Configuration Screen

39 AOD Log Retention Configuration Screen

40 SYSLOG Definitions

41 These are the SYSLOG messages written when authority was added. SYSLOG Messages

42 Emergency Operator Screen

43 Please visit us at Thank You!