1. Multi Factor Authentication for Z
Steven Ringelberg
Vanguard Integrity Professionals
go2vanguard.com

2. About Vanguard
Founded: 1986
Business: Cybersecurity Experts for Large Enterprises
Software, Professional Services,
and Training
Customers: 1,000+ Worldwide
Over 20 distributors/resellers serving 50+ countries worldwide 3

3. Data Breaches Number of breaches and outside attacks increasing
Continuing problem of insiders - malicious or by accident 4

4. “Target was certified as meeting the standard for payment card industry (PCI DSS) in September Nonetheless, we suffered a data breach…”
now ex-chairman, ex-president, and ex-CEO of Target Corporation, Gregg Steinhafel ( 6

5. Logica and Nordea Bank Mainframe
Data Breaches
Logica and Nordea Bank Mainframe
breached in April 2013 7

6. Data Breaches
Others:
Home Depot
Staples
Anthem Health Insurance 7

7. Data Breaches: Two Themes
Mandiant: Data Breach Report
100% of breaches examined included an exploitation of a user id and password that was compromised. 7

8. An Industry full of often confused terms
Multi Factor Authentication
An Industry full of often confused terms
Multi-Factor Authentication is a method of requiring factors from the following three categories;
Knowledge Factors
Possession Factors
Inherence Factors

9. Multi Factor Authentication
Two-Factor Authentication
Two-Step Verification
Strong Authentication

10. Multi Factor Authentication
Knowledge Factors
Password
PIN Number
Mothers Maiden Name
Favorite Potato Chip

11. Multi Factor Authentication
Possession Factors
Disconnected (RSA, ActivID, etc)
Sequence-Based Tokens – Singular button, multiple depresses
Time-Based Tokens – Change Every ‘x’ Seconds typically
Challenge-Based Tokens – Small keypad to enter challenge code
Mobile Phones
Soft Token
SMS one-time password

12. Multi Factor Authentication
Possession Factors
Connected
Magnetic Strip – ATM Card, etc
Contacts – SmartCard, EMV Credit Cards,
USB – zPDT Key, RSA SecureID800,
Wireless – RFID, Bluetooth, Proximity
Other – Audio Port, iButtons, etc

13. Multi Factor Authentication
Possession Factors
Connected
Magnetic Strip – ATM Card, etc
Contacts – SmartCard, EMV Credit Cards,
USB – zPDT Key, RSA SecureID800,
Wireless – RFID, Bluetooth, Proximity
Other – Audio Port, iButtons, etc

14. Inherence Factors Fingerprint Hand Topography Eye (Iris)
Multi Factor Authentication
Inherence Factors
Fingerprint
Hand Topography
Eye (Iris)

15. Multi Factor Authentication
Exposure Issues
Phishing/Man-In-The-Middle
Malware
Session Hijacking
Lost/Stolen

16. Exposure Issues Multi Factor Authentication
Coding Flaws – Exposures in the Code of the applications, protocols, or other Example: Attackers Exploit the Heartbleed OpenSSL Vulnerability to Circumvent Multi-factor Authentication on VPNs

17. US based Regulation and Guidance
Multi Factor Authentication
US based Regulation and Guidance
NIST FIPS 201/HSPD-12
HIPPA
NERC CIP
NIST SP
PCI DSS
FFIEC

18. Vendors – Multi Factor and Z
Vanguard Integrity Professionals.
Physical Tokens – Vanguard ez/Token
“soft” Tokens – Vanguard Tokenless
“Smart Cards” a/k/a “PIV Cards” a/k/a “CAC Cards” 33

19. Vanguard Software Services Training
We provide you with the analytical tools that allows you to do an in-depth audit of your z/OS systems against multiple standards
Provides detailed explanation, risk analysis, user action to correct
Services
We will execute z/OS system audits against multiple standards
We will also remediate
Training
We will train you how to audit z/OS systems against multiple standards
We will also train you to remediate 33

20. Questions? 35

21. Call 800-794-0014 or email us at info@go2vanguard.com
For more information
Call or us at
Thai
Thank You
English
Arabic
Gracias
Spanish
Obrigado
Brazilian Portuguese
Danke
Grazie
Korean
German
Italian
Simplified Chinese
Russian
Merci
French
Japanese
Traditional Chinese
Hindi 37