#mfsummit2016 secure: is your mainframe less secure than your fileserver
TRANSCRIPT
Is your mainframe less secure than your file server?
Malcolm Trigg | Solutions Consultant | 24th February 2016
What if you could…
• Stop the user having to enter a user / password
• Allow multi-factor authentication• Something you have• Something you are• Something you know
• Use your Active Directory / eDirectory to store…• Users password• Bio-metric information such as finger print• Smart card details
• Bring the login screen in-line with modern security standards
• Protect sys admin logins
Well you can…
• Micro Focus Advanced Authentication Framework
• Link with Reflection Desktop / Rumba terminal emulation
• Choice of smart cards and/or bio-metrics such as fingerprint recognition
What if you could…
• Centrally manage the sign on to the mainframe
• Use a RACF one-time token in place of a password
• No need for user to enter or remember a password
• User doesn’t get prompted for user/password
• User need never know their password
Well you can…
Automated Sign-On withManagement and Security Server
1. The terminal emulator launches a host session and requests user credentials for the host application from Automated Sign-On.
2. Automated Sign-On requests a one-time-use PassTicket from RACF (from the IBM z/OS Digital Certificate Access Server).
3. The terminal emulator uses the one-time-use PassTicket credential to automatically log the user on to the host application.
With Micro Focus…
• Access to the mainframe• No longer reliant on the historic 8 character password
• Now tied to the corporate Active Directory / eDirectorycredentials
• Access to the mainframe can be revoked through group membership in Active Directory / eDirectory
• Mainframe access becomes security compliant
• Protect sys admin access
• You can automatically provision users along with permissions on host systems
• Particular networks• All workstations• Any terminal emulator• No restrictions on who
Not Everything has Changed
What if you could…
• Control who can access the mainframe
• Only allow authorised terminal emulators to be used
• Access control through Active Directory / eDirectory
• Roll Based Access Control (RBAC)
• Centrally managed
• Make the firewall rules simple for mainframe
Well you can…
Client workstation
Telnet, FTP, INT-1, T27, ALC,
SSL/TLS
SSL/TLS
MSS Server
MSS Security Proxy
LDAP Directory
HTTPS
Content inspection (Intrusion Detection
System, etc.)
Host
Micro Focus Management and Security Server
Access control in middle tier:
• A layer of security in front of your hosts
• Without touching the hosts
• Using read-only access to the LDAP Directory
With Micro Focus…
• A connection to the host can only be performed if you have been pre-authenticated
• Access to the host based upon AD/eDirectorymembership
• Host can be protected by a firewall / simplified firewall rules
• Only allow connections originating from the Micro Focus Security Proxy Server
Well you can…
Client workstation
Telnet, FTP, INT-1, T27, ALC,
SSL/TLS
SSL/TLS
MSS Security Proxy
Content inspection (Intrusion Detection
System, etc.)
Host
Client workstation
User Case Study – Airline Industry
• Problem• Need to give travel agents access to their mainframe• A traditional thick client was heavy on management• Don’t own or manage the desktop• Had to use a VPN to tunnel traffic – further complicated
the set-up• New travel agents opening all the time and also some
closing• Spread through out the world
User Case Study – An Airline
• Solution
• Management and Security Server• Strong authentication
• Security Proxy Server• Only authenticated clients could connect to the mainframe
• Thin client emulation• Readily configured sessions deployed to the desktop using
Java Applets
• Changes automatically deployed on next connection
User Case Study – An Airline
• Benefits• Mainframe protected from unauthorised access
• Deployment as easy as providing a URL and adding user to LDAP database
• Decommissioning as easy as removing the user from the LDAP database
• Easy centralised management
• Small client foot print on desktop
• Very little management of agent required by airlines help desk
Airline Solution Graphic
Travel AgentDesktop
Airlines TrafficSSL/TLS
MSS Server
MSS Security Proxy
LDAP Directory
Authenticated by MSS Server
Content inspection (Intrusion Detection
System, etc.)
AirlinesHost
Secure token passed
HTTPS
No direct access to mainframe.Only allowed through Security Proxy
Server if authenticated by MSS Server
Not Everything has Changed
• Credit card number remains on screen after typing
• No additional access authentication required to view credit card number
• Terminal emulator only displays what the host sends it
What if you could…
• Mask credit card numbers or any other sensitive field
• With out changes to the host application
• Stop copy to clipboard from working for certain fields
• Redact information once typed i.e. after entry of a credit card number
Well you can…
Micro Focus Terminal Emulation
• Fields can be displayed masked with asterisks
• After typing a credit card number it can be redacted
• The copy to clipboard field can be disabled for certain fields
With Micro Focus…
• Sensitive information is only displayed to those who really need access to it
• Information typed only left on the screen until last character typed and then it is redacted
• Helps with PCI DSS
• Stop user from using terminal emulation trace facility by locking the terminal emulator down
Not Everything has Changed
• Authenticated once
• Application security controlled by application
• Non-repudiation
• No re-authentication for certain tasks
• Replace the normal Signon with a stronger method of Authentication and enable Single Signon?
• Prompt a user at any point during any type of transaction to Re-Authenticate?
• Re-Authentication could have context like:• Financial Value or transaction type?
• Time since last Authentication?
• Write away before and after values of any transaction to a Non-Repudiation system which could be used to report on activity?
• With NO changes of any code on the legacy system?
What if you could…
Well you can…
• Micro Focus Advanced Authentication Framework
• Link with Reflection Desktop / Rumba terminal emulation
• Choice of smart cards and/or bio-metrics such as fingerprint recognition
With Management Security Server (MSS)and Advanced Authentication you can...
• Create an enforceable access control layer between your employees and your legacy systems.
• Leverage your enterprise directory to authorise users to host sessions.
• Utilise strong authentication technology to confirm user identity.
• Make use of multifactor Authentication.
• Invoke Authentication and Authorisation at any stage during a session or function on a legacy application with full audit reporting.
• Centrally administer access to terminal host sessions and macros.
Directory(eDIR, AD, LDAP, RACF)
User
Reflection /Rumba
AAFRTE
Credentials(MFA, Mix & Match)
RACF/TOP Secret Authentication
Secondary Application Authentication
Sensitive Enquiry Authentication
Sensitive Transaction Authentication
Time Based Authentication
VBA
Reflection / Rumba and Advanced Authentication Framework
With Micro Focus…
• Insecure user/password host logon a thing of the past
• Multiple re-authentication points can be utilised
• Multi-factor authentication
• Tied into AD / eDirectory security groups
• Roll Based Access Control can be applied
• Permissions can be easily revoked
• Central management of terminal emulation and access
Well you can with Micro Focus…
Micro Focus
IBM 3270
IBM 5250
VT/UNIX
HP700/92
Business Application
• Well featured design time environment
• Wraps host application logic with SOA interface
• Non invasive ‘off host’ architecture
• No change to host applications
• Leverage existing business rules
• Real time integration
• Acts as a ‘data firewall’ – securing and guaranteeing integrity of
the application
• Robust, scalable and secure• Rejuvenation options available
1 2 3
Full Terminal Support
Zero Footprint
No Map
Enhanced Emulation
Custom WebServices
Custom Mobile AppsTerminal Emulation• Screen re-presented as HTML or HTML5
• One to one with host screen
• Can be accessed on desktop to mobile devices
• Provides a secure method of accessing the host remotely
• No direct access to host from client
1 2 3
Custom WebServices
Custom Forms
Server-SideMacros
Managed
Enhanced Emulation Custom Mobile AppsTerminal Emulation• Automation of host application
• Still have access to host screen
• Secure connection
• Scalable
• No direct access to host from client
1 2 3
Custom WebServices
Fully Customized UI
SOA Capable
Trans-form
Terminal Emulation Enhanced Emulation Custom Mobile Apps• User sees no host screens
• Complete web-frontend
• Fields can be hidden from user
• No direct access to host from client
• Secure and scalable
With Micro Focus…
• Host systems can easily become web service enabled
• Providing a secure method of integrating
• Hide fields from developers
• Platform for rejuvenation
• Integration with other systems
• Mobile device access as well as desktop
• Secure and scalable solution
Not Everything has Changed
• Macros managed by users
• Development against production system
• Sharing of macros
• Ownership / support
• Change control
What if you could…
• Prevent users from creating macros
• Prevent users from viewing macros
• If macros not required then prevent running of macros
• Control the distribution of macros
• Make macros part of a secure development life cycle
• Ensure macros are part of change control
Well you can…
Management and Security Server• Distribute macros• Control access to terminal emulation
Reflection / Rumba Terminal Emulation • Lock down emulation• Prevent macros being run from untrusted
locations• Prevent macros from being created• Lock down API
With Micro Focus…
• Macros can be managed
• Terminal emulation locked down
• Macros become known and managed by IT
• Secures the mainframe from abuse by macros
General Security
• Crypto modules FIPS 140-2 validated
• Used by US DoD
• TLS 1.2 fully supported
• Secure development life cycle (SDLC)
• Security given prominence throughout development of products
• Intensive security testing of products
General Security
• Advanced Authentication Framework
• Enhance the authentication process
• Multi factor authentication
• Multiple points of authentication
• Allow automated provisioning of mainframe users and permissions
General Security
• Manage access to mainframe
• Management and Security Server
• Security Proxy Server• Can’t connect unless authenticated
• Redaction of sensitive information
• Secure integration of mainframe information
• Macros can be managed