„what can happen when you put your cics on the web“ martin trübner
DESCRIPTION
„What can happen when you put your CICS on the web“ Martin Trübner. Front page. Current config. Paul L'Heureux On VSE-L: OK, I have a real problem that just sprung up today and it is killing us. Multiple cwxn transactions are appearing in PRODCICS. - PowerPoint PPT PresentationTRANSCRIPT
„What can happen when you put your CICS on the web“
Martin Trübner
Front page
Current config
CPU IBM eServer xSeries 232 Model 11x (FLEX)~ 8 MipS
OP-SYS VSE/ESA 2.7.1
CICS/TS 1.1
3270 users (PCOM) hundreds of county employees county-wide
web-users anyone with a legitimate Will County PIN number
The Problem 1 of 3
Paul L'Heureux On VSE-L:
OK, I have a real problem that just sprung up today and it is killing us.
Multiple cwxn transactions are appearing in PRODCICS.
This causes ipn166 MESSAGES IN F7 and eventually TCPIP locks up.
I have already IPL'd twice.
Does anyone know ....
The Problem 2 of 3
Web server attack
There are many methods hackers could use to attack web servers in order to compromise sites they host. Entry points include:
Weak username/password combinations. Vulnerable web applications. Vulnerable OS. Vulnerable web server software, database, tools or
libraries.
From the web:input Validation
Root cause of most web hacks All inputs received should be validated:
data type data range Metacharacters
Tampering with hidden fields Bypassing client side checking (i.e. javascript)
But we do all this!
Who is to blame?
This program is running since 2003
TCP is same version since 1 year
There is nothing in our legislatur that would change user behaviour
CICS/TS has notchanged in 6 years
The 3390 are 3 years old
A look at the process
The internet
COBOL-INIT
TCP/IP
CICS-itself
Application
Applied changes
The data that comes into CICS is passed to a URM called „the analyser“
This does now some early verification (length and type)
TCP/IP process is not changed at all (GETVIS)
Application is not changed (double process, but...)
A look at the intermediate process
The internet
COBOL-INIT
TCP/IPCICS-itself
Application
Application
The process todayThe internet
COBOL-INIT
TCP/IPCICS-itself
Application
Application
Application on a different platform
Part of the webpresence was there anyway
Preprocessing for CCWTR51 now there as well
Cheaper than an upgrade of the current machine
More solutions:
Delayed answer (1 imm, then delayed) No robots Registration
THE END
Questions ?
Original at
pi-sysprog.de/gse My E-mail: My E-mail:
[email protected]@pi-sysprog.de