Pre-Con Ed: Real-Time Data Audit and Security: Find, Classify and Protect Sensitive Data on the Mainframe
0 likes1,086 views
The document discusses CA's real-time data audit and security solutions for mainframes, CA Data Content Discovery and CA Compliance Event Manager. CA Data Content Discovery scans mainframe data stores to find and classify regulated and sensitive data. CA Compliance Event Manager monitors mainframe security events and configuration changes in real time to detect vulnerabilities and policy violations. It also provides audit logging, reporting, and forensic capabilities. The solutions help customers improve compliance, reduce data security risks, and gain visibility into sensitive data and privileged user activity on the mainframe.
Pre-Con Ed: Real-Time Data Audit and Security: Find, Classify and Protect Sensitive Data on the Mainframe
- 2. 2 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD For Informational Purposes Only Terms of this Presentation © 2016 CA. All rights reserved. All trademarks referenced herein belong to their respective companies. The presentation provided at CA World 2016 is intended for information purposes only and does not form any type of warranty. Some of the specific slides with customer references relate to customer's specific use and experience of CA products and solutions so actual results may vary. Certain information in this presentation may outline CA’s general product direction. This presentation shall not serve to (i) affect the rights and/or obligations of CA or its licensees under any existing or future license agreement or services agreement relating to any CA software product; or (ii) amend any product documentation or specifications for any CA software product. This presentation is based on current information and resource allocations as of November 1, 2016, and is subject to change or withdrawal by CA at any time without notice. The development, release and timing of any features or functionality described in this presentation remain at CA’s sole discretion. Notwithstanding anything in this presentation to the contrary, upon the general availability of any future CA product release referenced in this presentation, CA may make such release available to new licensees in the form of a regularly scheduled major product release. Such release may be made available to licensees of the product who are active subscribers to CA maintenance and support, on a when and if- available basis. The information in this presentation is not deemed to be incorporated into any contract.
- 6. 6 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD Reducing the likelihood of catastrophic data breaches in the data center – Complementing IAM with data-centric Situation Risk What’s Broken The Solution Mainframe still transacts ~70% of mission essential data Sensitive and Regulated data is stored on the mainframe Accidental orphaned data disclosure by an employee Intentional data leakage via a breach “We take data off the mainframe for classification and audit reporting – risky, expensive…” “We have home-grown, time consuming processes – very expensive…” Improving compliance by locating the orphaned or hidden & unprotected regulated data Scanning and classification remain on the mainframe “With breaches in the news every day, being able to find where regulated data resides - or ruling out the existence of sensitive data - is a critical first step in protecting your business.”
- 8. 8 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD Based on regulation or organizational sensitivity Data remains on the z/OS platform Regulated and sensitive data in your mainframe data stores Protect CA Data Content Discovery Reducing the likelihood of a catastrophic data breach The App Economy creates new risks of catastrophic data compromise “With breaches in the news every day, being able to find where regulated data resides - or ruling out the existence of sensitive data - is a critical first step in protecting your business.” X 70%of the world mission critical data transacts on the mainframe. Find ProtectClassify
- 9. 9 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD 10+ Filetypes CA Data Content Discovery FIND Set up the scan Initiate the scan Provide discovered results to Security Administrator Security Operations 110+ Classifiers out of the box: § PCI, HIPPA, PII, etc. Custom classifiers CLASSIFY Review compliance results and label sensitive data Provide compliance report to Internal Auditor Internal Auditor § Identify Who Has Access to What Data § Identify Who Accessed Data PROTECT Modify access based on scan results Confirm successful audit against industry regulations Security Administrator
- 10. 10 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD File Types Available In Development Physical sequential (including access methods: QSAM, BSAM, BDAM) Data in Motion: Connect: Direct PDS / PDSe DB2 tables USS ( HFS & zFS) VSAM Datacom IMS Data in Motion: FTP Data in Motion: SMTP Find It: Data Types
- 12. 12 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD Account Data Cardholder Data Sensitive Authentication Data Primary Account Number (PAN) Magnetic stripe data Cardholder Name CAV2/CVC2/CVV2/CID Expiration Date PINs/PIN blocks Service Code Classify It: PCI Data
- 13. 13 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD Classify It: PII Data PII Attributes Full Name Date of birth Home Address Email address National Identification Number Passport number Drivers License Number Vehicle registration Birthplace Genetic information Telephone number Login name, screen name, nickname, handle Face, fingerprints, handwriting IP Address Credit Card Numbers Digital identity First Name Last Name State Age Gender Race Schools attended Criminal record Country US Zip Code C C C C C C C Custom Classifier Quick Picks
- 14. 14 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD Classify It: PHI Data PHI Attributes Full Name Geographic subdivision Data elements Telephone number Fax number Electronic mail address SSN Medical record number Health Plan beneficiary number Account number Certificate/license number Vehicle ID/Serial number/license plate number Device identifier/serial number Biometric identifier Full face photograph or image Other unique identifying element C Custom Classifier Quick Picks C C C C C C
- 16. 16 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD Alert: Bring real-time awareness of critical MF security issues § Monitor Security details direct from ESM and control points in z/OS § Detection of security system changes and policy violations § Built for high volume security events (router sends events to various components, lightening load on system and ESMs) proven at millions of events. Inspect: With comprehensive Auditing and Forensics support § Policy-base filtering and real-time recording of critical security for actions. § Provides ability to ‘replay’ all security events, supporting forensic analysis of security situations with High-volume raw security data recording. § Search, filter and analyze recorded historical data, with automatic tape retrieval and load Protect: Ensure Mainframe integrity and bring Data Centric awareness § Designed for Security: Immune from Exits placed in SMF and configuration files, meant to hide activity. Uses ‘superset’ of SMF Security data. § Real-time monitoring of critical z/OS configuration files detect potentially malicious changes before IPL executes them. § Analyze users accessing critical sensitive and regulated datasets, via integration with Data Content Discovery CA Compliance Event Manager: Mainframe Security Vulnerability Platform
- 17. 17 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD CA Compliance Event Manager v5: What’s New CA Compliance Event Manager gathers security events from ESM, z/OS functions and files. The solution can determine what was changed, who made the change and when, as well as monitor changes and run compares for compliance changes and changes to access permissions. Differentiators: Runs exclusively on Mainframe, no need to move mainframe data, PDS monitor CA Compliance Event Manager v5 brings: § Improved Time to Value with new installation, deployment and configuration architecture § Simplified User Experience with new Web User Interface and an intuitive policy administration UI § Reduced footprint with lighter weight alternative to previous CA Chorus for Security and Compliance Management § Improved performance with Real Time Alerting and Monitoring for identifying potential breaches or violations of policy § High Availability with support for Sysplex § Integration with DCD for Data centric security
- 18. 18 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD CA Compliance Event Manager: Alert Alerts and Monitoring CA Compliance Event Manager Capability Business Benefit Monitors security details direct from ESM and control points in z/OS Immune from Exits placed in SMF and configuration files, meant to hide activity. Uses ‘superset’ of SMF Security data. Monitor critical security system PDS changes for security issues Discover changes to files used when IPLing the mainframe that might load unwanted routines Built for high volume security events (router sends events to various components, lightening load on system and ESMs) proven at millions of events Scales for our largest customers Out of box policies for critical vulnerabilities and configurations: ex: JSCBPASS, sys1.parmlib Deploying CEM improves base security posture
- 19. 19 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD Compliance Event Manager: Inspect Audit CA Compliance Event Manager Capability Business Benefit Detection of security system changes and policy violations Alerts in near real-time (5 minutes) to changes to configuration files, preventing errors or worse Data warehouse for real-time event management, and auditing Stores policy filtered events in database for queries, forwarding, analysis and auditing purposes. Advanced reporting Build reports around security policies and compliance rules
- 20. 20 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD Compliance Event Manager: Inspect Forensics CA Compliance Event Manager Capability Business Benefit CA CEM has a high-volume recording of raw security data, creating a historical record of all security data over long periods of time for future investigation. This provides the ability to automatically archive to tape. Provides ability to ‘replay’ all security events, supporting forensic analysis of security situations. Datamart utility allows for search, filtering and analysis of recorded historical data, with automatic tape retrieval and load Help identify issues quickly by querying time-frames and Targeting specific security events, creating a subset of the full data stream for detailed analysis.
- 21. 21 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD Compliance Event Manager: Protect CA Compliance Event Manager Capability Business Benefit Monitor Security details direct from ESM and control points in z/OS Immune from Exits placed in SMF and configuration files, meant to hide activity. Uses ‘superset’ of SMF Security data. Monitor PDS and other critical configuration files Real-time monitoring of critical z/OS configuration files detect potentially malicious changes before IPL executes them. Understand Who has accessed sensitive and regulated data, including last access and how often, building policies to monitor further access. Analyze users accessing critical sensitive and regulated datasets, via integration with Data Content Discovery.
- 25. 25 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD Demo! § CA Data Content Discovery – product overview § Custom classifiers in CA DCD § Who has Access/ Who Accessed § CA Compliance Event Manager – product overview § Policy overview § Splunk App preview
- 26. 26 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD Roadmap Stay connected at communities.ca.com
- 27. 27 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD CA Data Content Discovery Promise FIND IT CLASSIFY IT PROTECT IT For CISOs and Mainframe Security Directors For CISOs, Internal Auditors and Risk Officers For Mainframe Security analysts and Mainframe Data analysts The first data-pattern scanning capability uniquely natively on mainframe in the market Simple and Modern GUI along with Flexible scheduling designed for both z and non-IBM z personnel Eliminate risky offloading- with data security right on the mainframe. Only Data security product currently on the market for mainframe to use specialty engines to reduce upgrade costs Gain quick and critical insight about the potential and magnitude of data exposure on the mainframe Prove to auditors that controls are checked by data-types to satisfy regulations Stay in control – eliminate risk while reducing costs of data protection processes
- 28. 28 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD CA Compliance Event Manager Promise ALERT INSPECT PROTECT CISO, Compliance Officer Security Architect, Auditor, IT Operations Mainframe Security Analysts, Mainframe Data Analyst CA Compliance Event Manager helps mitigate security events through more detailed and real-time alerting 100% on the mainframe Real-time alerting to critical security situations combined with deeper insight into security and compliance issues, leading to an improved risk posture. CA enables deeper insight for data security and compliance, allowing customers to find where data is located, when it moves and who has access to it Gain immediate and critical insight about the potential and magnitude of data exposure on the mainframe Prove it to auditors that controls are checked by data-types to satisfy regulations and quickly communicate compliance posture Stay in control of the most mission essential assets in the business to act quickly & eliminate risk while reducing costs of data protection processes
- 30. 30 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD Recommended Sessions SESSION # TITLE DATE/TIME MFT53T In the Voice of a Mainframe Millennial: How Can Mainframe Security Be Made Easier? 11/16/2016 at 12:45 pm MFT174S Mainframe Security Strategy and Roadmap: Best Practices for Protecting Mission Essential Data 11/17/2016 at 12:45 pm MFT175S Gaps in Your Defense: Hacking the Mainframe 11/17/2016 at 3:00 pm