1. Protecting Critical Data on IBM i and Beyond
Presented by Arjon Cohen,
Vice President Sales & Channel Management

2. Agenda 1. Intro: Babylon Has Fallen
2. Security 101: Layered Security Fundamentals
3. Data Protection and Business Resilience
4. Layered Security Fundamentals
5. Layered Security for IBM i - Native iOS Capabilities
6. Enforcive’s Approach: IBM i and Other Platforms
7. Background
8. Q & A
Securing Critical Data on IBM i: A Layered Approach

3. Siege of Babylon Securing Critical Data on IBM i: A Layered Approach
This John Martin painting from 1831 depicts the fall of the first great empire in recorded history. According to Herodotus, the Babylonians had prepared provisions for many years against the attack of Cyrus of Persia. Their defenses were all but impregnable, the Persian armies supply lines and provisioning resources would become over-extended and the Babylonians could eventually break our outlast the siege. A viable strategy, or so it seemed.
Securing Critical Data on IBM i: A Layered Approach

4. The Writing on The Wall
According to the Bible which tells about this war ,one person read the writing on the wall…
A prophecy had appeared on the wall of the son of the king of Babylon: Mene Mene Tekel Upharsin
“God has numbered the days of your reign and brought it to an end. .You have been weighed on the scales and found wanting. Your kingdom has been divided and given to the Medes and Persians.”. In Short: ”your time is up”
Securing Critical Data on IBM i: A Layered Approach

5. The Writing on the Wall Why would we worry?
Many small and medium sized businesses don’t feel like they need to be concerned about a data breach
According to a survey by McGladrey, 80% of respondents indicted a risk level of “3” or “3” on a five-point scale, with 11% reporting they faced no risk whatsoever.
Nearly four out of five professionals who responded to a survey by Informatica and the Ponemon Institute said “data security is a serious threat, but only 51% said securing and protecting data is a high priority in their company.”
Securing Critical Data on IBM i: A Layered Approach

6. The Writing on the Wall So, what are the facts?
2016 saw a 40% data breach increase compared to 2015
A breach can happen to anyone, no matter the size of the company
The threat is both external as well as internal. A bank that we met a few years ago said that a bank customer record would cost a few USD. People having access to 1000s of records can make a quick dollar.
Securing Critical Data on IBM i: A Layered Approach

7. The Writing on The Wall
In some organizations today there are folks who can read the writing on the wall. …
Securing Critical Data on IBM i: A Layered Approach

8. and took Babylon virtually without a fight!
Babylon Has Fallen
By diverting the Euphrates River Cyrus took down the firewall, well, waterwall, entered with his army marching on the now passable riverbanks…
According to Herodotus there were two primary contributing factors to the Fall of Babylon. Firstly, everyone was busy celebrating a festival, carrying on as if there wasn’t an army outside seeking their doom. Secondly, Babylon had a Zero Day Vulnerability that hadn’t come up in any of the scans…
and took Babylon virtually without a fight!
Securing Critical Data on IBM i: A Layered Approach

9. Agenda
1. Intro: Babylon Has Fallen 2. Security 101: Layered Security Fundamentals 3. Data Protection and Business Resilience 4. Layered Security Fundamentals 5. Layered Security for IBM i - Native iOS Capabilities 6. Enforcive’s Approach: IBM i and Other Platforms 7. Background 8. Q & A
Securing Critical Data on IBM i: A Layered Approach

10. Security 101: Layered Security Fundamentals
Assume Vulnerability, Not Impregnability
Securing Critical Data on IBM i: A Layered Approach

11. Security 101: Layered Security Fundamentals
Layered Security: The Swiss Cheese Model
We Assume There Are Holes, We Can’t Plug All Of Them
The Goal Is Not To Plug All The Holes
James T. Reason, University of Manchester, 1990
Securing Critical Data on IBM i: A Layered Approach

12. Security 101: Layered Security Fundamentals
The Goal is to Prevent a Breach
Securing Critical Data on IBM i: A Layered Approach

13. Security 101: Layered Security Fundamentals
An Additional Layer of Control Adds Additional Security
Securing Critical Data on IBM i: A Layered Approach

14. Security 101: Layered Security Fundamentals
Each Additional Layer of Control Adds Costs, Management, Resources, and Compliance Requirements
Due to diminishing returns, you have to…
Securing Critical Data on IBM i: A Layered Approach

15. Security 101: Layered Security Fundamentals
Choose Your Battles Wisely
Securing Critical Data on IBM i: A Layered Approach

16. Data Protection and Business Resilience
In this time of external and internal threats organizations aim at Business Resilience
Quickly adapting to disruptions
Want to keep core business processes running
Safeguarding people, assets and brand equity
From an IT Security point of view the major component for Business Resilience is Data Protection:
Protection of critical data from corruption or loss either through
malicious behavior or error

17. Agenda 1. Intro: Data Breach Facts
2. The Ostrich Theory: Get Your Head Out of the Sand
3. Data Protection and Business Resilience
4. Layered Security for IBM i - IBM i OS Capabilities
5. Enforcive’s Approach: IBM i and Other Platforms
6. Background
7. Q & A
Securing Critical Data on IBM i: A Layered Approach

18. Layered Security for IBM i
Where are the critical assets on IBM i?
How can you get to them?
Auditing for the above
Flexible alerting and reporting capabilities
Securing Critical Data on IBM i: A Layered Approach

19. Object Level Security Powerful capability but complex
Must have someone on staff with working knowledge of IBM i security schemas
Many packages implement Full Access to everyone
Object level security does not differentiate between internal and external access to the file
How do you check your settings remain as you set them - assure object level security stays in place
Object Authority/Native Security Knowledge: performance, need to know, not intuitive
Differentiation internal and external access

20. File Security Object Level Security is an extremely powerful tool
However, it can be bypassed/neutralized by users with powerful user profiles (of which there are too many in most organizations)
Organizations therefore are looking for full role based access to sensitive DB2 Files.
IBM offers an exit point but you have to write program
Management infrastructure is needed to optimally use it

21. Field Level Security
Different requirements based on regulations to assure sensitive data is not seen by unauthorized eyes
Used to be complicated task, requiring changes to applications, copying files (especially on the decrypt) etc.
In OS 7.1 IBM released the Field Procedure which makes the process (almost transparent).
It offers various options including:
Masking
Encryption
Security
Field Audit (compensate for journals)

22. Field Level Security #2 Approaches in the OS Field Procedure
Called at database level
Advantages
Control on almost everything related to the field:
encryption/decryption
Masking
Scrambling
Field Audit-
Field Security
Disadvantage
CPU intensive
RCAC (Row Column Access Control)
Pure IBM internal DB functionality
Different masking views fields and records for different users
Regulates access by data in the row according to user authority
Advantage
Good and fast performance
Disadvantages
No Encryption
No Field Auditing
No Scrambling
Columns = Fields, Row = Record
Field Procedure is like an Exit Point inside the Field. RCAC is part of the Database (which is why it is faster)

23. TCP/IP Security Exit Points - WRKREGINF
- Risk of menu security being bypassed through tools like FTP, ODBC,
RMTCMD, IFS etc
- Object Security is often not an option – hard to maintain, problems with
apps, audit trail
- Need structure to manage the exit programs – role based, layered
What if there are no Exit Points
- For ways of TCP/IP access where IBM is not providing
- Exit Points – need to address them too
- Examples SSH, SFTP
- Socket or Packet Level

24. Command Security & Monitoring
Security exposure of everyone having access to commands.
Monitoring of commands is possible in QAUDJRN but at User level
Individual users need to be configured for *CMD auditing with CHGUSRAUD command.
Limit access to command line (FTP command line still bypasses, powerful user)
Another option is to use the exit point IBM provides - allows you to have role based management infrastructure as well as an audit trail

25. Auditing
OS contains many journals and logs that contain a wealth of information
Challenge is to present this information in a user friendly and comprehensive way
Example File Journal – information is spread out over various screens
File Journal- file information, but what about read data events?
Journals need to be taken offline, restoring them for forensics needs can be at cross purposes with operational needs.
SQL – running this log without management
tools is setting up for performance problems
SQL – problem with ??? in SQL Statements

26. Auditing - example No indication of the PC that accessed the file
No indication of the SQL statement
No separation of field values
No display of non-character fields
No indication that this was breach rather than legitimate update
This is before image event entry in the File Audit. From a security point of view important information is missing.

27. Agenda
1. Intro: Babylon Has Fallen 2. Security 101: Layered Security Fundamentals 3. Data Protection and Business Resilience 4. Layered Security Fundamentals 5. Layered Security for IBM i - IBM i OS Capabilities 6. Enforcive’s Approach: IBM i and Other Platforms 7. Background 8. Q & A
Securing Critical Data on IBM i: A Layered Approach

28. Layered Security for IBM i
Firewall/IP Packet Filtering
Allows you to monitor and secure all inbound and outbound TCP/IP connections to your IBM i environment.
Policy Compliance Manager
Provides a way to monitor object level security and enable updates from GUI interface.
Application Access Control
Provides auditing and protection from unauthorized activity coming to or from the TCP/IP network through exit poitns
Command Control
A layer of access control to system commands that is applied in addition to the object authority controlled by the operating system.
File Protection Layer
Powerful feature that allows you to control record level access internally and externally to file objects in a way that complements the control afforded by the operating system’s built in object authority.
Field Encryption
A comprehensive platform for field level encryption as well as for security, masking, and scrambling. Includes save file encryption.
Layers of Data Security
Securing Critical Data on IBM i: A Layered Approach

29. Policy Compliance Manager - Object Authority
Assure object level security stays in place
To capture security and system policies into templates
To validate systems against that policy
To fix (remediate) systems to match the policy
Templates can be created for object definitions, user profiles, user & object auditing, authorization lists etc.
Usually organizations have some Object Level Security in place. Therefore it is helpful if a tool can check if the desired policy is indeed in place.

30. Policy Compliance Manager example

31. Policy Compliance Manager Benefits
Maintains a documented security policy which can be instantly shown to auditors.
Allows auditors & managers to check if corporate policy is just a document or is really implemented.
Provides non-IBM i experts with a window into how security policy is implemented.
Allows definition of a variety of security policies, check them at will and even fix the current system definitions to conform to the organizational policy.
Facilitates regulatory compliance.

32. File Protection Features Role-based
System policy allowing Implicit or Explicit permission definitions
Multi-level permissions for individual users and groups
Protect specific file members
Full activity log available
Instant alerting
Control record level access to file objects
Complements the control afforded by the operating system’s built-in object authority – additional layer.
Control of access source: Network and Native Green Screen
Access methods: SQL, non-SQL, database, XCOM etc.

33. Field Encryption Enforcive/Encryption™ includes:
Field Encryption – Encrypts the field in the database without application changes.
Field Security – On the
fly, security of a field.
Field Masking – On the fly, masks the field to the unauthorized user.
Field Scrambling – On the fly, scrambles the numeric value of the field to the unauthorized user.
Field Audit (integrated with wider product audit and reporting functionality)

34. Field Encryption
Masking (either by Field Procedure –OS 7.1or RCAC – OS 7.2)
Mixing and matching of options
Dual Keys (master & data keys)
(Remote) Key Storage
Multiple encryption algorithms even within same file
Algorithms use a key to encrypt. Data keys are used for encryption. Master key encrypts data key.

35. TCP/IP Security - Exit Points

36. TCP/IP Security - Exit Points
Application Access Control
Exit point control (ODBC by Interface Type, FTP, Remote Command, IFS, etc.)
Role Based Access Management
Security by IP address range, date & time
Granular access management down to library, object group and IFS Links
Lockdown is first performed in “warning mode” to allow collection of pertinent security events and reveal usage patterns
After thorough analysis security lockdown and access control can commence
Account swapping for adopted authority for interactive & TCP/IP environments
Replication of policies across multiple servers

37. TCP/IP Security – Firewall/IP Packet Filtering
Controls outgoing traffic by user profile by IP address and /or port (Firewall)
Protects IP address by port, direction (inbound/outbound), line
Protects Port by IP address , direction (inbound/outbound), line
Blocks network traffic that avoids exit points
Includes audit log of connection attempts
Rules defined at user and group levels
Includes new and unfamiliar protocols
Shows currently open ports

38. Command Security
It is an additional layer of security on commands which will secure any command, even from *SECOFR or *ALLOBJ users.
Features
Create a master list of commands
Once defined, commands are activated and assigned specific permissions.
Allow/Disallow access for execution according to role (— user ID, group profile, generic or user group.
Users without special commands permissions, are covered by the System Default.
Grant/Removed use for all the commands in one action.
Access control to commands can be applied in addition to the object level authority controlled by the operating system. To run the commands defined in Command Control, a user must have permission in the Enterprise Security Application Access Control module and also have sufficient system object level authority..

39. Audit Logs
Logs/Journals Covered
Granular tools to set policies about what to monitor
Dissecting strings into useful information
Common look & feel

40. Auditing
Application Audit Detailed log of network and native exit point activity with powerful filtering tools. Firewall/IP Packet Filtering (optional) Monitors Port & IP (range activity) including direction (inbound/outbound) System Audit A log for the System Journal (QAUDJRN) including tools to manage logging policies, view events and create reports. File Audit Field level auditing of files provides comprehensive tracking with “Before” and “After” views of changes to sensitive data. View Data Monitor Read Events at Database Field Level SQL Statement Audit Monitor and audit internal SQL events on the system, including interactive SQL processes, QSHELL database functions, embedded SQL in high level languages and queries. With this ability, security officers can quickly identify suspicious statements.

41. Auditing, Cont. Message Queue (MSGQ) & System History (QHST) Monitors
Analyze and report on the behavior of users, applications and devices and group messages to specific
business processes.
Cross-Platform Audit (optional)
Log management software build into the Enterprise Security Manager’s interface for consolidating events from different platforms and databases into a uniform database for correlation, reporting alerting and viewing through dashboards. The CPA trackers under activity across multiple IBM i servers/partitions as well as across other platforms (z/OS, Windows, AIX, Linux) and databases (DB2, Oracle, MS SQL Server, Sybase, Progress). The CPS offers the ability for organizations to take large amounts of logs from expensive production environments, and transferred to a dedicated environment for auditing and medium, to long-term storage.
Data Provider (optional)
Organizations looking to consolidate IBM i events with events from other platforms can do so using Syslog Data Provider. Security officers can easily configure Enforcive/Enterprise Security to export events in syslog format to third party log management and SIEM products..

42. Audit Logs – audit policy

43. Audit Logs – events

44. Common Facilities
Developed common facilities to that bundle these point offerings into a comprehensive solutions
GUI
Log Management
Account Management
Report Generator
Alert Center
Replication and Cross Partition Grouping
Common look & feel to various logs and events
We have used these various layers from the OS to develop and enhance security functionality. In addition we have developed common facilities that tie these functionalities together into a comprehensive approach to security

45. Common Facilities – GUI
Graphical User Interface:
Empowering Security
Enforcive/Enterprise Security is fully GUI enabled
Covers 25+ modules for security, auditing and compliance
Allows easy roll out access management policies
Makes journals and logs easy to manage & interpret.
Monitors high-level policies and drills down to the user or object in seconds.
Involves “non-green screen” IT professionals in security related tasks.

46. Common Facilities – Account Management
Allows for Role Based Security

47. Common Facilities – Multi-System Capabilities
The settings of most modules in the Enforcive suite for IBM I can be replicated from one to the other .
Reports and Compliance Templates can be defined to cover multiple servers/partitions

48. Common Facilities - Report Generator
Complete solution for defining, optimizing, distributing and archiving reports.
Data such as system values, user profile attributes, power user activities, changes to sensitive data and system by system comparisons can be easily organized to best meet the desired criteria

49. Common Facilities - Report Generator
Features
Full control of column selection and positioning
Flexible filtering on all fields with Boolean logic
Sorting on any field in ascending/ descending order
Primary selection criteria tailored to report type
Option of adding advanced SQL statement
Real time & scheduled
Group definitions using custom report groups
Report formats incl. spooled files, HTML, CSV and PDF
Archive reports on IFS in Text, CSV, PDF and HTML format
Export/Import report definitions
Reports can run across multiple servers/partitions
More than 250 predefined reports

50. Common Facilities - Alert Center
Features
Real-time
Granular
Messages in , on screen display, syslog, SNMP formats
Reactions like disable users/revoke special authority/call program
Areas covered
Exit Points
QAUDJR
File Journal
SQL Statements
MSGQ & QHST
Policy Compliance Deviations
Firewall
Internal: Health Monitor

51. Common Facilities - Central Audit
Consolidates events from different logs & journals of a single iBM i server/LPAR into one consolidated log.
Filtering of diverse audit events on common criteria
Covers all Audit logs in Enforcive
Data partition rollover
IASP library storage option
 Makes organizations independent of OS400 journals by storing relevant events on IBM i even after the journals in which these events were captured have been detached

52. Common Facilities - Cross Platform Audit
Consolidation of logs/events sets from different server platforms and databases into a single repository
Granular - Focused on providing practical and relevant information
Dashboard, online log, reports, alerts
Correlation of seemingly unconnected events into an audit trail indicating possible breach of security
Saves resources in platform-specific expertise
Frees up production environments from logs that often need to
be maintained online for a long time
Empowering auditors and IT security personnel with dedicated
environment
Monitoring of organizational and regulatory policy in a multi- platform & multi-partition environment
Sources include; Windows, Mainframe, IBM i, DB2 (all
flavors), AIX, UNIX, Linux, Sybase, Solaris,
SQL, Oracle and Progress

53. Cross Platform Audit – common repository

54. Beyond IBM i
Worked to expand concepts developed for IBM i to other server platforms & databases:
AIX
Linux
z/OS-VSE
Windows
MS SQL Server
Oracle
DB2
Monitoring
Compliance
Access Management
File Protection

55. Beyond IBM i - monitoring
AIX & Linux Monitoring is provided by the Cross-Platform Audit module.
Wealth of data about system, users and objects access and changes
Linux
AIX
. This example shows that user root read the password file passwd.

56. Beyond IBM i - Compliance
Similarly to the Enforcive IBM i PCM module, the Cross-Platform Compliance module allows to create and implement security policy for multiple system and platforms such as AIX, Windows, Linux and more.
This example shows a check result of the AIX password policy.

57. Beyond IBM i - Compliance
Linux
AIX

58. Beyond IBM i – AIX Access Control
Same concept as for IBM i
Role based
Regulates access to services and applications
The product accommodates for newly installed applications and services
Allow, Reject, Warning modes
Full Audit Log

59. Beyond IBM i – AIX File Protection
Works on top of OS permissions as an additional protection layer
Can reject access by root user
Role based
Regulate access to Files & Directories
Read, Write, Change Mode and Change Owner
Allow, Reject, Warning
modes
Full Audit Log

60. Agenda
1. Intro: Babylon Has Fallen 2. Security 101: Layered Security Fundamentals 3. Data Protection and Business Resilience 4. Layered Security Fundamentals 5. Layered Security for IBM i - Native iOS Capabilities 6. Enforcive’s Approach: IBM i and Other Platforms 7. Background 8. Q & A
Securing Critical Data on IBM i: A Layered Approach

61. About Enforcive
Enforcive provides comprehensive security solutions to help businesses
reduce workloads, satisfy auditors and improve responsiveness to security
threats. For over three decades, Enforcive has been providing solutions within
mission critical environments using platforms including IBM i, System z, AIX,
Linux and Windows. Our expertise and commitment to innovation enables us
to offer the best of breed solutions to our customers.
Formed in 1983
Pioneer in IBM mainframe and midrange security
Offices in New Jersey, Toronto and Israel
80 Resellers in 60 countries
Global supplier agreement with IBM
Thousands of installations worldwide, including Fortune 500 companies

62. CPC Cross-Platform Compliance
Product Lines
CPS
Cross Platform Security ES
Enterprise Security
CPA
Cross-Platform Audit
CPC Cross-Platform Compliance
PSS
Password Self Service
MF/CICS & DB2
All products operate through a common GUI manager
Host Based Security Audit
& Compliance for IBM i
Log Management & Database Activity Monitoring
GRC (Governance, Risk Management, and Compliance)
Cross Platform Password Management
Host Based security &
Audit for IBM Mainframe
For use with:
Core ES Product
Exit Point Security
System Monitoring
Alerting
Reporting
Admin Tools
Firewall Manager
Field Encryption
Policy Compliance
Data Providers
Password Self Service
Accelerator Package
For use with:
Windows
Unix (AIX & Solaris)
Linux
IBM i (OS400 & DB2)
z/OS
MS SQL Server
Oracle
DB2
Sybase
MySQL
Progress
Syslog
Flat File Format
For use with:
Windows
AIX
IBM i (OS400 & DB2)
MS SQL Server
Oracle
Linux
For use with:
IBM i (OS400 & DB2)
Windows Active Directory
Linux
AIX
Open LDAP
For use with:
z/OS – CICS
VSE – CICS
DB2 (CICS Field Security)
VSAM (CICS Field Security)
SMF TELNET & FTP
SMF VSAM
SMF RACF
TCP/IP App. Audit (FTP & Telnet
DB2 SMF
DB2 LOG (Data Audit)
DB2 CICS (SQL Data Capture)
DB2 BATCH (SQL Data Capture)

63. Agenda
1. Intro: Babylon Has Fallen 2. Security 101: Layered Security Fundamentals 3. Data Protection and Business Resilience 4. Layered Security Fundamentals 5. Layered Security for IBM i - IBM i OS Capabilities 6. Enforcive’s Approach: IBM i and Other Platforms 7. Background 8. Q & A
Securing Critical Data on IBM i: A Layered Approach

64. Q&A

65. Email: info-eu@enforcive.com
Thank You…
Enforcive provides comprehensive security solutions to help businesses reduce workloads, satisfy auditors and improve responsiveness to security threats. For over three decades, Enforcive has been providing solutions within mission critical environments using platforms including IBM i, System z, AIX, Linux and Windows. Our expertise and commitment to innovation enables us to offer the best of breed solutions to our customers.
Enforce your policy by:
Defining clear access control and segregation of duties
Implementing comprehensive and demonstrable security and compliance policies
Automating compliance related administration tasks
Leveraging Enforcive’s predefined reports, alerts and compliance templates for specific regulations including SOX, PCI DSS, ISO 27002, and COBIT
Addressing your medium to long term audit log archiving requirements
Offloading resource hogging compliance related tasks from your production environment
North America
Tel:
Enforcive, Inc.
International
Tel: (+972)