Our Job Helping you avoid problems and improve IPL Integrity'

1
Presentation ISACA - Silicon Valley
Thursday December 9th , 2004
Your presenter for this session
Paul Robichaux
prr_at_newera.com
NewEra Software
Our Job? Helping you avoid problems and improve
IPL Integrity.
2
Todays Agenda - 30/45 minutes
Regulation Control
Necessity Complexity
Critical Success Factors
Overview Example
NewEra Software
Our Job? Helping you avoid problems and improve
IPL Integrity.
3
Committed to Protecting Host Environments
NewEra Software, Inc.
MVS z/OS Systems
15 Years 600 Organizations Worldwide 1,000
of Technical Users Privately Owned Morgan Hill,
CA.
Stand Alone Environment SAE
NewEra Software
Our Job? Helping you avoid problems and improve
IPL Integrity.
4
Committed to Protecting Host Environments
A New Reality A Methods
Available Resources Down

• Staff - Fewer
• Budget - Smaller

System Staff Workload Up

• Strategy - Dynamic
• Regulation - Increasing
• Availability - Longer Windows
• System Changes - More Controlled

1990
2020
1964
2004
NewEra Software
Our Job? Helping you avoid problems and improve
IPL Integrity.
5
Committed to Protecting Host Environments
A New Reality A Methods
Available Resources Down
Development Drivers

• Staff - Fewer
• Budget - Smaller

System Staff Workload Up

• Strategy - Dynamic
• Regulation - Increasing
• Availability - Longer Windows
• System Changes - More Controlled

1990
20
60
NewEra Software
Our Job? Helping you avoid problems and improve
IPL Integrity.
6
Committed to Protecting Host Environments
Compliance Cost
Organizational Necessity
Process Complexity
NewEra Software
Our Job? Helping you avoid problems and improve
IPL Integrity.
7
Committed to Protecting Host Environments
Organizational Necessity - FUD
1) List Key Business Processes Cash
Management, etc. 2) Describe each such process
from Start to Finish 3) Describe the risk
involved in each facet of the process 4)
Describe the controls used to lessen each risk
5) Describe how each such control is tested 6)
Test each control against Real-World
Transactions 7) Have CEO and CFO certify that
controls do in fact work 8) Have Auditors
assess Process and Control Documentation 9)
Have Auditors test controls for flaws 10) Have
Auditors detail Pass or Fail in Annual Report
10 Steps to Compliance
Sarbanes-Oxley Sections 302 404
NewEra Software
Our Job? Helping you avoid problems and improve
IPL Integrity.
8
Committed to Protecting Host Environments
Process Complexity of Information Asset
System Details
Protected
Vulnerable to Attack
NewEra Software
Our Job? Helping you avoid problems and improve
IPL Integrity.
9
Committed to Protecting Host Environments
Process Complexity of Information Asset
System Details
Protected
Vulnerable to Attack
NewEra Software
Our Job? Helping you avoid problems and improve
IPL Integrity.
10
Committed to Protecting Host Environments
Process Complexity of Information Asset
System Details
Protected
Access Control
Vulnerable to Attack
NewEra Software
Our Job? Helping you avoid problems and improve
IPL Integrity.
11
Committed to Protecting Host Environments
Process Complexity of Information Asset
System Details
Access Control
Vulnerable to Attack
Denial of Service ltgt Loss of Integrity
NewEra Software
Our Job? Helping you avoid problems and improve
IPL Integrity.
12
Committed to Protecting Host Environments
Understanding the Stakeholders
Why OS Changes?
Why Change Control?
Change Integrity?
Updates Upgrades Repairs
IPL
Planned
NewEra Software
Our Job? Helping you avoid problems and improve
IPL Integrity.
13
Committed to Protecting Host Environments
Understanding the Stakeholders Shared Interest
Why OS Changes?
Why Change Control?
Change Integrity?
Updates Upgrades Repairs
IPL
Planned
Stakeholders
Technical
Security
Audit
DR Staff
NewEra Software
Our Job? Helping you avoid problems and improve
IPL Integrity.
14
Committed to Protecting Host Environments
Critical Success Factors
Operational Fitness
Will the configuration accomplish the
organizational function for which it was
intended? Simply Stated - Will it IPL?
NewEra Software
Our Job? Helping you avoid problems and improve
IPL Integrity.
15
Committed to Protecting Host Environments
Critical Success Factors
Ongoing Compliance
Will changes to the established configuration be
recognized and evaluated for its impact? Simply
Stated - Will it stay that way?
NewEra Software
Our Job? Helping you avoid problems and improve
IPL Integrity.
16
Committed to Protecting Host Environments
Critical Success Factors
3rd Party Review
Is the established OS System fully documented
and ready for 3rd Party Review? Simply Stated -
Is it fully documented?
NewEra Software
Our Job? Helping you avoid problems and improve
IPL Integrity.
17
Committed to Protecting Host Environments
Critical Success Factors
System Recovery
Is a Disaster Recovery Plan in place? How is
it practiced and/or evaluated? Simply Stated
- When it fails, what will you do?
NewEra Software
Our Job? Helping you avoid problems and improve
IPL Integrity.
18
Committed to Protecting Host Environments
Critical Success Factors
Drilling-Down
Layers of OS Integrity
NewEra Software
Our Job? Helping you avoid problems and improve
IPL Integrity.
19
Committed to Protecting Host Environments
Balancing Cost, Interest and Exposure
Audit Interest / Audit Scope
Extreme
High
Moderate
Low
Other
NewEra Software
Our Job? Helping you avoid problems and improve
IPL Integrity.
20
Committed to Protecting Host Environments
A Control Methodology - Overview
Change Management Surveillance
NewEra Software
Our Job? Helping you avoid problems and improve
IPL Integrity.
21
Committed to Protecting Host Environments
A Control Methodology - Overview
Change Management Surveillance
Change
Integrity
Building Blueprints! --- Auto-Discovery
Determining Impact! -- IMAGE Inspection
Recovery
Fixing Failed Components!
NewEra Software
Our Job? Helping you avoid problems and improve
IPL Integrity.
22
Committed to Protecting Host Environments
A Control Methodology - Example
NewEra Software
Our Job? Helping you avoid problems and improve
IPL Integrity.
23
Committed to Protecting Host Environments
A Control Methodology - Example
The IPL Path
The IPL Rules
Inspection Server (A Virtual IPL Environment)
Actions
Notices
Something Changed?
Alerts
Something is Wrong!
Blueprints
Inspections
Compliance Reports
NewEra Software
Our Job? Helping you avoid problems and improve
IPL Integrity.
24
Committed to Protecting Host Environments
A Control Methodology - Example
Layered Security Controlling the Integrity
Threat Environment
Denial of Service
NewEra Software
Our Job? Helping you avoid problems and improve
IPL Integrity.
25
Committed to Protecting Host Environments
A Control Methodology - Example
Layered Security Major Threat Topics Include
01 - Access Control 02 PGM Tables 03 APF
Authorization 04 System Exits 05 System
SVCs 06 TSO Commands 07 Named Consoles 08
Start Commands 09 I/O Appendages 10 Named
Modules
NewEra Software
Our Job? Helping you avoid problems and improve
IPL Integrity.
26
Committed to Protecting Host Environments
IMAGE Sentry
Layered Security Threat Topic - Access Control
Access Control Dataset Access TSO
Users Profile Authority
Profile Privilege Revocation
History Date of Last Access
Modules/Started Task Product
Association Group Association
Profile Privilege Date of
Last Access
NewEra Software
Our Job? Helping you avoid problems and improve
IPL Integrity.
27
Committed to Protecting Host Environments
IMAGE Sentry
Integrity Threat Matrix Threat Topic - Access
Control
Access Control System Logon TSO
Users Profile Authority
Profile Privilege Revocation
History Date of Last Access
Modules/Started Task Product
Association Group Association
Profile Privilege Date of
Last Access
NewEra Software
Our Job? Helping you avoid problems and improve
IPL Integrity.
28
Committed to Protecting Host Environments
IMAGE Sentry
Integrity Threat Matrix Threat Topic - Access
Control
(Name, Count, Classify and Evaluate)
Access Control System Logon TSO
Users Profile Authority
Profile Privilege Revocation
History Date of Last Access
Modules/Started Task Product
Association Group Association
Profile Privilege Date of
Last Access
NewEra Software
Our Job? Helping you avoid problems and improve
IPL Integrity.
29
Committed to Protecting Host Environments
IMAGE Sentry
Integrity Threat Analysis Threat Topic - Access
Control
Access Control System Logon TSO
Users Profile Authority
Profile Privilege Revocation
History Date of Last Access
Modules/Started Task Product
Association Group Association
Profile Privilege Date of
Last Access
Rscore Weight Wscore Dist Action
NewEra Software
Our Job? Helping you avoid problems and improve
IPL Integrity.
30
IMAGE Management
Thank You
www.newera.com
Your presenter for this session
Paul Robichaux
prr_at_newera.com
NewEra Software
Our Job? Helping you avoid problems and improve
IPL Integrity.