Enhanced XA Security CISTECH Security Solutions Belinda Daub, Senior Consultant Technical Services...

Enhanced XA Security

CISTECH Security Solutions

Belinda Daub, Senior Consultant Technical Servicesbelinda.daub@cistech.net

704-814-0004

1. Introduction to Enhanced Security

2. Implementing a Security Model

3. Auditing and Reporting

4. IFM Security Information

5. iSeries Profile and Object Authorities

6. Prerequisites

Agenda

Why is it necessary?• Auditor Requirements

• Documented security policy and procedures • Formal approval for user rights• Regular auditing and monitoring • Protect investors, employees, community

• CAS Security• Difficult to determine how user has access to tasks• No auditing capability • Risk to productivity when changes are made

• iSeries Security• Many factors affect user access to system and objects• No central management tool

Enhanced Security for XA

ES can help

• Add-on application written using Integrator • Implemented by environment• XA components:

• Security Modeling and Planning • Routine Auditing and Reporting• View Current User Rights

• iSeries components:• User Profile auditing• Object Authority auditing

Enhanced Security for XA

Power and Flexibility of the XA Client architecture:– Create views and subsets– Export to Excel

Add-on Application using Integrator

• Install in each environment• Includes all CAS tasks (if assigned to an area)• Includes IFM Application tasks (in base features only)• Auditing for each environment including IFM task security

Implemented by environment

• Security Model - Create and finalize a new security model• Security Audits - Track changes to security • Current Environment - View current security configuration

and user rights in the environment

Enhanced Security Application Card

• Provides for implementation of new plan– Import users, groups, areas, and tasks from CAS files– Decide what you want to lock– Create groups and authorize to tasks– Assign users to groups– View current and planned user rights

• Optional component

Note: this is all done in the model – not the live environment

Security Modeling and Planning

• Import from the current environment:– Users– Groups– Areas and tasks – Group Authorities– Private Authorities

You don’t have

to start from scratch!

1. Import Security Components

• Subsets– Unlocked– Application– Type

• Mass Change• Model Template

It’s Easy!

2. Decide what you want to lock

• Subsets• Views• Mass Change• R7

– Quick Change– Append subsets

• Model Template

Piece of Cake!

3. Create groups & authorize to tasks

• Validation• Subsets

– User Groups– Group members

• Templates • Return-to-create

Your model

is almost ready!

4. Assign users to groups

Current and planned rights

A. User being reviewed

B. Tasks the user is granted

C. How access was granted• Private (user id)

• Group (group id)

• Not locked (blank)

A BC

5. View user rights

• Compare planned versus current rights– View tasks user will no longer have access to– View tasks user could not do before (for approval)– Final Adjustments to the model

• Export files to a test environment for user testing – Included with modeling option– Handles security validation stamps

Benefits– Reduce risk of affecting user productivity at go live– Resolve issues quickly after plan is implemented

Advanced Analysis and Testing

Rights Revoked:

If users need any of these rights to do their jobs, they will be adversely affected when the plan is implemented.

Enhanced Security lets you make sure this won’t happen.

Advanced Analysis

Rights Granted:

SOX requires that all access be reviewed by authorizing manager.

With Enhanced Security, you can

export user rights to standard forms for

management approval.

Advanced Analysis

We can use Integrator to build approvals right in to the application!!!

Testing is critical to ensure users are not affected by the new plan.

• Users from every group

• Formal test plan

Enhanced Security provides an export process for moving user rights from the model to an XA environment on the same or different iSeries.

• Validation stamps generated

• No re-keying

Testing

Auditors require regular review of changes to security authorizations

Enhanced Security provides:• Detailed Transaction History• Security Change Audit• Violations to Segregation of

Duties• Regular Audit Reports

Security Auditing and Reporting

• Start Auditing– Saves an image of environment security files– Journals are activated on the files– Changes in user rights are extracted from the journals

Routine Auditing and Reporting

• Determine how a user has gained access to a task• Quickly identify the area(s) where changes need to be made• Customize views, subsets, and sorts• View or Host Print

Detailed Transaction History

• Net Changes only (since last run)• Navigate to Detailed Transactions that resulted in the change• View or Print Report

Security Change Audits

Schedule regular Auditor reports

Set Audit Options

Regular Reporting – Scheduled Job

Summarize authority granted to users for the reporting period

• From last run date (monthly changes)

Security Audit Report

Users who have authority for tasks that auditors define as conflict of interest, for example:

• Create a purchase order

• Generate an AP check

Security Audit ReportsHigh-Risk Authority Conflicts

IFM Security

• View and Print• IFM Users• IFM Applications• User Authority to Applications• IFM Application Tasks• User Defaults• User rights to IFM Tasks are shown with CAS

application tasks so you can see everything the user can do

IFM SecurityUser Authorities to IFM Applications

IFM SecurityIFM Application Tasks

IFM SecurityIFM User Defaults

All user rights to CAS and IFM Tasks in one place

View user rights

iSeries Security

• User Profiles – view and print• Power Users• Logon Statistics• Password Info• Groups and group membership• Startup Information

iSeries SecurityiSeries User Profiles – Special Authorities

iSeries SecurityiSeries User Profiles – Password Information

iSeries Security

• Object Authorities – view and print• All objects – all libraries• User rights – display/maintain• XA objects not owned by AMAPICS

iSeries SecurityiSeries Object Authorities

• Integrator (R6 or R7)– R6 requires new business objects created at installation

• OS V5R3 or higher

• All functions to be secured must be set up in CAS as tasks and assigned to an area

Prerequisites

New Feature

• Database File Audit • File being corrupted or changed outside of XA• You need to know who and how it’s done• Turn on auditing for the file

• Starts journaling if not already• Extracts information • View who made changes to the file and if they

used outside tools to do it (SQL, DFU, and others)

Base Package:• Enhanced Security $9,500.00

• XA Security Views and Reports• IFM Security Views• iSeries Security Views• Installation /Training Services

Three days on-site plus expenses

Optional Features and Services:• Security Model feature $ 4,500.00• Security Consulting Services $1,600.00/day

• Security Audit (2-3 days)• Security Planning and setup (approx 10-15 days)

ES Packaging and Pricing

Thank you!

Questions?