Data Access Monitoring Date (DAM) for IBM System i (a. k. a. POWER Systems / i. Series / AS/400) How to Protect Your Corporate Data and Comply With Regulations Easily October, 2011 © Tango/04 Computing Group, Inc.
How do you “audit” your bank? You have no idea if your bank is using firewalls, antivirus, etc. But you just need to see your account transactions to know if there is anything suspicious Date Movement Euros Account Balance
Why audit your corporate data? Legal and regulatory pressure keeps growing People’s rights Laws and regulations Inspectors and auditors 21 CFR Part 11 Food & drug industry HIPAA Healthcare industry Sarbanes-Oxley (SOX) Publicly traded U. S. companies, their international branches and other related businesses (Japan: J-SOX) Basel II Banking & finance SB 1136 Companies operating in California European Privacy Laws EU companies using personal data PCI Credit Card companies
How to audit your corporate data? Available methods Pros and cons
How to audit your corporate data? Access control is insufficient • Greatest threat comes from legitimate users • Most internal security breaches go undetected • Most cases of data loss or corruption are caused by human error It does not comply with SOX requirements It does not comply with other regulatory requirements It does not meet best practice codes It does not protect data against the most common vulnerabilities
How to audit your corporate data? Field-level data audit methods Application logs • Incomplete (changes can be done by direct access) SQL Analysis / Sniffing • Complex, incomplete, does not provide before/after images at field level, very difficult to understand, cannot set alerts based on data values, may not access encrypted SQL Custom Application changes • Cumbersome, incomplete, requires development and maintenance Database Triggers • Cumbersome, slow, may create security risk Native methods for every database system • Optimal! Journals in System i are very efficient, and usually they are already in use
Auditing Your Corporate Data with Tango/04 New Tango/04 Data Monitor
New Tango/04 Data Monitor A firewall for your corporate data Any change can be audited in real-time, including those performed by DBAs and legitimate users Without There is no protection here With Both External AND Internal Users are controlled
New Tango/04 Data Monitor Prevent fraud, accidents and fines – Record-level data auditing solution • Who, What, When, Where? – Capture all changes… and read access, too! – Rapid, easy deployment – Detailed information: • User • Real user (to control ODBC accesses, for instance) • Timestamp • Transaction type • Enriched data (with virtual field support) • IP address • Library, Job, Process – Low resource consumption and TCO – Flexible reporting
New Tango/04 Data Monitor – Advanced Reporting Flexible reporting simplifies your job – Enforce your security policy – Detect fraud and misuse of data – Comply with regulations – Easy to read, color coded, customizable reports
New Tango/04 Data Monitor – Advanced Reporting Advanced reporting capabilities Sensitive fields can be hidden shown (Salaries, Credit Cards, etc. – Before/after image – Data masking (protect sensitive fields) – Data enrichment (from any other table) Changes are clearly marked
New Tango/04 Data Monitor – Advanced Reporting Group summaries – Per user class Why are Security Officers modifying customer data?
Advanced Reporting Group summaries – Per real user • Quickly spot suspicious activity – Per application – Per accounting code
New Tango/04 Data Monitor – Advanced Reporting Group summaries – Per transaction type
New Tango/04 Data Monitor – Advanced Reporting Group summaries – Per application It is easy to spot “strange” things here (such as DFU programs)
State-of-the-Art, Unparalleled Report Manager Rapidly select what you want to see – By date, time, user, file, operation type, key value, user group… Select transactions when a field has been modified, or a condition is met – Example: FIRSTNAME = “John”, ADRESS LIKE “Beverly Hills %”, STATE <>“NY”, SALES >= 5000, YEAR < 2000 Create and use multiple Calendars to fine-tune your reports – Detect suspicious changes during local holidays, weekends, unusual hours… i. Pad-compatible Report Manager
New Tango/04 Data Monitor Use this data firewall to implement custom data auditing controls – – – – All changes to a sensitive table Detect DFU/SQL changes Who changed the SALARY table while logged in as a powerful user? Have any of these changes been made by someone not from the HR group? What changes have been made by programmers or security officers? What data has been deleted from the PAYMENTS file? Changes made without using the company’s ERP Changes during the weekend or after working hours All SALES table changes to the DISCOUNT field after invoice creation All SALES entered with a DISCOUNT within the normal range Changes made not using PRODUCTION/CHG 05 RPG program How many records were added/deleted/modified in the MASTER table during peak hours? Who is looking to the SALARY data? Number of deletes/adds/updates by user group, program, user class, etc. Are there any movements affecting dormant bank accounts? And much more!
New Tango/04 Data Monitor Easily implement advanced COBIT controls – SOX, J-SOX – ISO Compliance
Data Monitor for IBM i Some Technical Highlights
Maximum, Unmatched Power Ultrafast Audit Report Comprehension – Add calculated data – Add “virtual fields” with data from other tables to make compliance reports easier to read (see full names instead of codes) • Key Description • Customer Data, Country Name, Maximum Discount, User Department, User Status (has this employee been fired? ) Cross-analyze transactions to see if they are valid • Correlate Human Resource or Sales Policies data • Is this employee on vacations? Is he/she in the building? Is the discount correct? Detect fraud, impersonation, etc. Smart filtering for storage savings – Save only relevant transactions if desired • Ex: Customer. Type = “A” – Save only relevant fields if desired • Ex: Total. Price not equal zero
Unlimited Automation: 360º Protection Automation for Total Protection – Execute actions when an expression is true (or always) – Examples: • If DISCOUNT = ‘Y’, then TOTAL : = TOTAL * 0. 8 • If an expression is true, send a message to a Message Queue – If (Too Much Discount) then Alert the Sales Manager – If (Change Outside the Application or After Hours) then Alert the Security Officer • If an expression is true, execute a command automatically – Order a low-stock item – Supports For/While cycles and External Program Calls for maximum flexibility – Supports multiple record formats
Zero-Touch Administration! Advanced Record Format Management for faster Deployment – Format Autodiscovery! – Can automatically load record formats – Can automatically detect and update record format changes Automatable Data Repository Cleaning for easier Maintenance – Clear roll-backed transactions – Clear historical data • By date range • Keep a number of days – Automatically! Automated Report Delivery to make Auditors Happy – Email, Web/Intranet (HTML format) – Multiple format conversions – Flexible scheduling
New Tango/04 Data Monitor Near-zero impact on system performance – Reusing your existing journals for data auditing in i. Series – Remote journal support The Data Monitor repository can be located at the Primary System or at the backup LPAR Data Monitor Audit File IBM i OS Remote Journal OS/400 Primary Secondary
New Tango/04 Data Monitor Minimal use of disk space in production systems – Saving your audit trail files on an external server (remote journaling) Oracle, SQL Server, etc… (This also adds more security to the audit data base) Data IBM i OS Data Monitor Audit File Journal Data Monitor Audit File Primary Audit Server
And Much More Application enrichment – Use Data Monitor to have a history of changes of customer accounts – with no programming Including web-based reports! Read-only access auditing – Requires an additional license (Beware! Auditing all reads in a heavily utilized application it is VERY CPU intensive!) Business Rules control / BAM / Operational Business Intelligence – Alerts immediately to anything out of the ordinary! • Send alerts to Tango/04 Smart. Console (sold separately) and/or – – message queues in real time Easy definition of rules • “Stock below minimum levels” • “Dormant account was modified by user JSMITH” • “Purchase Order totaling more than 2, 000 US$ approved by a user with no credit approval permission” Collect KPIs with virtually no performance impact!
Unique Capabilities – Years ahead of the competition Differentiators – – – Ease of Use Customizable No triggers used IBM i 7. 1 ready (previous versions supported) Flexible, Web-based, i. Pad-compatible Reporting System Maximum information Low Performance Impact Remote Journal Support Automatic Double-Byte Support • Allows reporting in original field character code – Katakana, Chinese, Hebrew… Independent ASPs (i. ASPs) Support Changes to the schema (formats) are recorded and audited Alerts on Table Drop (DLTPF), End Journaling, Delete All (CLRPFM)
How to audit your corporate data? Practical advice Conclusions
Practical Advice and Conclusions View data auditing as the basis for compliance and BSM – Data auditing is required by many regulations Business Service Management (BSM) and IT Governance IT Security – Compliance is an opportunity to improve your security policy ISO 17799 COBIT Data Auditing ITIL – Scale-up your project • Service Level Management • ITIL • BSM • ISO 17799/27001 – Obtain maximum functionality • Audit all suspicious logs and events • Unique console, advanced reports • Business Impact Analysis
Practical Advice and Conclusions SOX Compliance – Upgrade to the Tango/04 VISUAL Security Suite (SIEM) and enjoy Real Time Dashboards, advanced alerting, multiplatform coverage, complex event correlation and much more (sold separately) and create Real-Time Security dashboards
Practical Advice and Conclusions SOX Compliance and beyond – COBIT Control Dashboards – KRI (Key Risk Indicators) – KPIs – Infrastructure Monitoring – Availability and Service Level Management – Business Process Optimization – Continual Service Improvement
Data Monitor for i. Series Case Study: High Throughput, Minimal CPU usage Large Insurance Company – Problem: strong internal auditing requirements, need to control, European privacy laws compliance – Transactions : +2 Millions per hour • +1, 000 Millions per month – Dozens of terabytes in hundreds of tables – Complex requirements • Field preprocessing to obtain the real user id • Filtering of non-critical transactions – Only 0, 04% stored (99, 96% discarded) • CPU: less than 3% – Very rapid deployment – High customer satisfaction • Later, they upgraded to the full Tango/04 VISUAL Security Suite for added protection
Practical Advice and Conclusions Data is your most valuable asset Audit your critical data easily and affordably – Technology is on your side • Rapid, non intrusive auditing – Obtain reports and demonstrate compliance – Real time detection of deviations and breaches – Prevent fraud • Detection, Forensics, Dissuasion Use automated solutions – Simplify auditing Protecting your data is protecting your business – Anti-Fraud, COBIT, ISO, SOX, J-SOX, HIPAA, 21 CFR Part 11, Central Bank Regulations, etc. Insert your project in a continuous improvement cycle – Use best practices – Let us help you! Reuse our knowledge from hundreds of worldwide projects – Tango/04 and its business partners can provide you with the support you need
About Tango/04
Tango/04 Computing Group, Inc. Software company, founded in 1991, European Leader in Service Oriented Monitoring • + 2000 customers around the world Branch offices in: New Hampshire Paris Geneva Buenos Aires Santiago Vercelli Barcelona Sao Paulo Bogotá Specialized on multiplatform solutions for : § Monitoring and IT Governance § Security Compliance and Control § Business Service Management • + 50 business partners worldwide • 11 out of the world’s 20 largest banks • Worldwide alliance with • Only monitoring solution appearing in two Gartner Magic Quadrants (ECA/SIEM)
11 out of the 20 biggest banks in the world are using Tango/04 solutions Selected Tango/04 customers worldwide – – – – IBM SONY Barnes & Noble Johnson & Johnson VISA Nestlé Telefónica Ford Tupperware L’Oréal Random House Avon Coca-Cola Miele Raiffeisen Bank – – – – Nike – Shell – Chase – Santander – Chrysler – Government of – Amsterdam Bridgestone/Firestone – – Bacardi – BMW – Bayer – Volkswagen – Toyota – Novartis BAI – Banco Africano do Investimento 3 M City Group De. Cecco London Stock Exchange Boehringer Ingelheim Kia Zurich Insurance Honda Danone Mercedes Benz Liberty BBVA And many more
“I love Tango/04! We deployed Sarbanes Oxley controls very rapidly with it. ” D. Keating, IT Manager, Henry Schein (USA) For more customer quotes, case studies, and additional resources visit our web site at your convenience
Thank you for your attention!
Скачать презентацию Data Access Monitoring Date DAM for IBM System
9509f863cd1f55d22e022a1ad7fbc00b.ppt