vanguard securitycenter - amazon s3 · vanguard security & compliance 2016 the toolbar ©2016...

SECURITY & COMPLIANCE CONFERENCE 2016

Vanguard SecurityCenter

John Hilman

Vanguard Professional Services

VSS6

VANGUARD SECURITY & COMPLIANCE 2016

Legal Notice

Copyright

©2016 Vanguard Integrity Professionals, Inc. All Rights Reserved. You have a limited license

to view these materials for your organization’s internal purposes. Any unauthorized

reproduction, distribution, exhibition or use of these copyrighted materials is expressly

prohibited.

Trademarks

The following are trademarks of Vanguard Integrity Professionals – Nevada:

©2016 Vanguard Integrity Professionals, Inc. 2

Vanguard Administrator

Vanguard Advisor

Vanguard Analyzer

Vanguard SecurityCenter

Vanguard Offline

Vanguard Cleanup

Vanguard PasswordReset

Vanguard Authenticator

Vanguard inCompliance

Vanguard IAM

Vanguard GRC

Vanguard QuickGen

Vanguard Active Alerts

Vanguard Configuration Manager

Vanguard Configuration Manager Enterprise Edition

Vanguard Policy Manager

Vanguard Enforcer

Vanguard ez/Token

Vanguard Tokenless Authenticator

Vanguard ez/PIV Card Authenticator

Vanguard ez/Integrator

Vanguard ez/SignOn

Vanguard ez/Password Synchronization

Vanguard Security Solutions

Vanguard Security & Compliance

Vanguard zSecurity University


The following are trademarks or registered trademarks of the International Business Machines Corporation: Java and all Java-based trademarks are trademarks of Oracle and/or its affiliates. UNIX is a registered trademark of The Open Group in the United States and other countries.

Microsoft, Windows and Windows NT are registered trademarks of Microsoft Corporation.

Other company, product, and service names may be trademarks or service marks of others.

Trademarks


CICS

CICSPlex

DB2

eServer

IBM

IBM z

IBM z Systems

IBM z13

S/390

System z

System z9

System z10

System/390

VTAM

WebSphere

z Systems

z9

z10

z13

z/Architecture

z/OS

z/VM

zEnterprise

IMS

MQSeries

MVS

NetView

OS/390

Parallel Sysplex

RACF

RMF


Session Topics

• Vanguard SecurityCenter™ Overview

• What is Vanguard SecurityCenter

• Navigating Through Vanguard SecurityCenter

• Customizing Vanguard SecurityCenter

• Using Vanguard SecurityCenter to Administer RACF®



What is Vanguard SecurityCenter?

• Windows-GUI Based RACF Administration Tool

– Also Administers Native DB2® Security

• Client/Server Architecture

– Client is a Windows Application

– Server is an z/OS® Started Task and an MVS™ Data

Space

• RACF Data is “Live” – no Extract File needed

– Current Data is maintained in the MVS Data Space

• SecurityCenter/Workstation Connects to

SecurityCenter/RACF Via TCP/IP



Starting Vangaurd SecurityCenter

• Click on SecurityCenter ICON on desktop

• Select from “All Programs/Vanguard/SecurityCenter”



Adding Host Systems



Adding a Host System



Selecting a Host System



Signing on to Vanguard SecurityCenter



Navigating Through Vanguard SecurityCenter

• Menu Bar

– File, View, Insert, Action, Options, Help

• Tool Bar

• Status Bar

• Smart Icons

– Tool Bar, Tree Structures, and Worksheets

• Context Sensitive Shortcut Menus

• Drag and Drop; Copy and Paste



Vanguard SecurityCenter Workspace


Tool Bar

Status Bar

Menu Bar


Using the Menu Bar


• File - Contains commands for printing the active window, formatting reports,

opening the files, and more.

• Edit - Contains commands for searching, undoing actions, and manipulating field text, such as copying, pasting, deleting items, and more.

• View - Contains commands for displaying items, such as the SecurityCenter toolbar and tree structures. Includes options for opening the SecurityCenter administration windows, expanding and collapsing tree structures, and changing the order of the Group Tree.

• Insert - Contains commands for inserting, or adding, new RACF profiles for users, resources and groups.

• Action - Contains commands for sending the SecurityCenter generated commands (displayed in the Command Status window) to the host for processing.

• Options - Contains commands for dynamically setting RACF options related to resource protection and for changing system preferences, such as the location of the log file.

• Window - Contains commands for managing windows, such as opening a new window, tiling multiple windows, cascading windows, and more.

• Help - Contains commands for opening the help file, contacting technical support, viewing release notes, and obtaining information about SecurityCenter, such as copyright information, free disk space, and memory availability.

File Edit View Insert Action Options Window Help


Customize Tool Bar


Select View,

Toolbars,

Customize

Select Appearance of Tool Bar


The Toolbar


Group

Tree

Group and User Worksheet

and Resource Explorer

Group, User, Ghost, Resource

Administration

Create New

Group, User, Resource

Help Desk Administration,

Send Commands to Host,

Scratch Pad,

Command Status

Member Cross

Reference,

DB2 Administration

Copy, Paste

Undo, Redo

Filter


Filter Toolbar

Becomes Active when Using:

• Group Worksheet

• User Worksheet

• Resource Explorer

• Connections

• Access List

• Effective Access List

• Subgroups

• Owned Groups

• Owned Users


Filter Characters:

+ Represents 0 to n characters.

% Represents a single character.

* Represents 0 to 8 characters

within a qualifier.

| Finds items that meet either

condition specified.


Working with Tree Structures

• Group Tree Explorer Window

– Opening Multiple Group Tree Windows

– Restructuring with Drag and Drop

• Group and User Worksheets

– Using the Filter Toolbar

• Resource Explorer Tree

– Class Families, Classes

• Access List and Owned

Resources Tabs



Group Tree Explorer Window



Group Worksheet



User Worksheet



Adding a Field to the Worksheet


1. Right Mouse Click on the header bar

3. Select the field(s) you want to add

2. Select Add Field(s)


New Field Added



Resource Explorer Tree


Specify Filter

Select Resource


Working With Profiles

• Administering Group Profiles

• Adding Group Connections

• Administering User Profiles

• Cloning User IDs

• Help Desk Administration

• Administering Resource Profiles



Adding a Group Profile


1. Select New Group button

2. Fill In the blanks – Click OK


Group Installation Data


3. Fill In the Installation Data – Press Enter


Add a Group Connection


4. Click Connections Tab, enter the

User ID you wish to connect to group


Send Commands to Host


5. Review commands in Command Status Tab

6. Click Send button


Adding a User Profile


1. Select New User button

2. Fill In the blanks – Click OK


TSO Segment Information


3. Select the TSO tab

and fill in the

information


Connect User to Groups


4. Select the Connections

tab and enter the group

name


Send to Host


5. Review Commands in Command Status Tab



Cloning a User Profile


1. Select New User button

2. Enter the User ID

3. Click Clone User

4. Enter the Clone ID

5. Fill In the User

Name and

Password

6. Select the segments

to clone


Send to Host





Define Alias Command


Option to add Define Alias


Command Generation Tab



Side-by-Side Administration


Click the Tab

and Pull Down




Select groups to copy




Drag and drop


Delete a User Profile - from Worksheets


1. Click the User

2. Press the Delete Key


Delete a User Profile - from User Admin


1. Click the User

Administration button

2. Enter User ID to delete

3. Right mouse click above the tabs

4. Select Delete Item


Delete With Cleanup Wizard



Generated Commands to Delete User ID


Review Commands in Command Status Tab

Click Send button


Help Desk Administration


Click Help Desk button

Enter User ID




Enter New Password

and Verify, Uncheck

the Revoked box,

then press OK

Used to Establish a

Future Revoke or

Resume Date


What is a Hard Revoke?

• Purpose - Revoke a user in a way that the Help Desk cannot resume the user

• When a user is Hard Revoked, the user is revoked and a bit is set in the Userdata field of the user profile

• The Hard Revoke bit is looked at only

by the Identity Manager function and


• Who can use Hard Revoke?

– System-SPECIAL

– User who is not System-SPECIAL must

be authorized by FACILITY class profiles



Hard Revoke


Click Hard Revoke


Help Desk View



Help Desk Administration Security

FACILITY Class profiles control:

• What User Profile fields may be viewed?

• What actions may be performed for which types of users?

$RIO.HDA.item.action.owner.userid



View User Info

Revoke

Resume

Reset Password

FACILITY

Profiles


Resource Administration


1. Click the Resource

Administration button


Data Set Administration


2. Select Class Family and Class

3. Enter Data Set Profile Name


Working with the Access List


5. Enter the Group or User ID

6. Select the Access level

4. Select the Access List Tab


Review the Commands – Send to Host





Optional Generic Refresh


RACF Preferences can

automatically issue Generic

Refresh


Finding the Best Fitting Profile


1. Select View,

Data Set Protection Analysis |

Profile That Protects a Data Set

2. Enter the Full Data Set Name in the Pop Up Window


Profile Found


3. Double Click the Profile to Display


Profile Displayed


4. Click Effective Access

List Tab


Find Data Sets Protected by Profile


1. Right Mouse Click next to Profile Name

2. Select Data Sets Protected By


Data Set Names Displayed



Clone Dataset Profile


1. Right Mouse Click next to Profile Name

2. Select Clone


Clone Dataset Profile


1. Enter New Dataset Profile Name

2. Click OK


Add BUDDY to Access List



Upload Commands to File



Specify PDS and Member Name



Commands Uploaded



Thanks for Attending


vanguard securitycenter - amazon s3 · vanguard security & compliance 2016 the toolbar ©2016...

Documents