Security Information & Event Management Blog | SIEM

Guest blog post, z/OS security, from Barry Schrager Part 7 of 7: Monitoring the Security of Your z/OS System

Posted by Barry Schrager on May 4, 2016 11:00:00 AM

Every day, after you get your first cup of coffee, do you scan the mainframe security system violation and logging reports looking for abnormal behavior, strange activity, etc.?  Given the size of these, do you do a thorough job of it?  How much time has elapsed from the time any activity occurred to the time you got to this?

When I first developed these reports for ACF2 (dataset and resource) we had systems that ran at a rate of a few MIPS – maybe 10-20.  The current IBM z13™ will process 110,000 MIPS.  The volume of processing has grown exponentially and so has the volume of security incidents – either loggings or violations – produced each day.  Remember that the violations and loggings are there to highlight activity which may affect sensitive data – either the organization’s sensitive data or the z/OS system itself – for, if the z/OS system is modified illicitly, this may be the vehicle for actually accessing or modifying sensitive data by bypassing the z/OS security system controls.  In case you didn’t realize this – if someone can modify the z/OS system and libraries by doing something as simple as link editing a program with the Authorized Program attribute and storing it in an Authorized Library, they can then execute that program and utilize that authorization with relatively simple code to bypass whatever controls you have in place in ACF2, RACF or Top Secret.  

Read More

Topics: insider threat, compliance standards, network security, security threat, z/OS security, mainframe security

Guest blog post, z/OS security, from Barry Schrager Part 6 of 7: Is the network connected to your mainframe secure?

Posted by Barry Schrager on Apr 20, 2016 12:00:00 PM

This segment of my series was authored by Peter Hager and Earl Rasmussen of Net’Q (www.net-q.com). I thank them for their input since the network connected to our mainframes must also be secured.

In today’s world we are all connected. There was a time that mainframe access was reserved to the datacenter. Those days are long gone….

Read More

Topics: insider threat, compliance standards, network security, security threat, z/OS security, mainframe security

Guest blog post, z/OS security, from Barry Schrager Part 5 of 7: Monitoring Access to Sensitive Data

Posted by Barry Schrager on Apr 7, 2016 11:56:03 AM

Now that you have eliminated all the z/OS system integrity vulnerabilities you could find, re-evaluated your user validation to minimize the possibility of credentials being stolen, found all your sensitive data and eliminated unneeded copies and implemented a test data management solution, and validated the users who have access to the remaining data and transactions, it is time to evaluate how accesses by authorized users are being monitored.

Remember, there are two different scenarios that can harm your organization. One is the obvious one – a trusted employee goes rogue, obtains sensitive data and uses it in a manner that either profits him and/or harms the organization – Edward Snowden of the NSA is the poster child for this type of calamity. The other is that a loyal employee has their identity stolen and the hacker misuses it. Note that even though you have gone through the steps of securing your z/OS system, nothing is perfect and there are still vulnerabilities in the network configuration and usage that allow Userids and passwords to be passed in the clear, people doing silly things like writing down their passwords on a post-it note, someone looking over a valid user’s shoulder, etc.

Read More

Topics: insider threat, compliance standards, network security, security threat, z/OS security, mainframe security

Guest blog post, z/OS security, from Barry Schrager Part 4 of 7: Who has access to your sensitive data?

Posted by Barry Schrager on Nov 19, 2015 11:00:00 AM


Now that we’ve gone through verifying that your system has no known integrity vulnerabilities, users are validated in a manner that will minimize the chance of someone stealing their identity and located all the sensitive data on your systems, remediating the copies that should not have been there in the first place, it is time to focus on who has access to your organization’s sensitive data.

Read More

Topics: compliance standards, network security, security threat, z/OS security, mainframe security

Don’t expect to move your cyber-security gauge towards 'safe' until..

Posted by Charles Mills on Apr 1, 2014 1:00:00 PM

Your network is vulnerable because your log management practice fails to include real-time mainframe data.

The InfoSec World show is upon us. For those of you unfamiliar with InfoSec World, it is an educational conference organized by the MIS Training Institute, an international organization that specializes in audit and information security training. According to their website, www.misti.com, they have trained more than 200,000 IT professionals over the course of its existence.

Read More

Topics: PCI DSS compliance, Log Management, security threat, enterprise SIEM system

FIM for Service Reliability, Security, Compliance and... Gamers!

Posted by Tony Perri on Apr 30, 2012 11:35:00 AM

No, I'm not a gamer but...

I did read an article (Sony confirms external attack brough down PlayStation Network - Dean Takahashi, April 22, 2012) on GAMESBEAT this morning that talks about the recent crash of the Sony PlayStation Network. In the article Sony points the finger at Anonymous and Anonymous denies it was to blame, even going so far as to label the media giant "incompetent."

Read More

Topics: compliance standards, automated threat detection, PCI DSS compliance, Log Management, security threat

6 Log Management Questions to Ask this Holiday Shopping Season

Posted by Tony Perri on Oct 5, 2011 10:17:00 PM

Recently, one of our customers reported that they are running upwards of 200 million messages per day through the CorreLog Enterprise Server – and this is just from the IBM z/OS mainframe!  The closer we get to December 25, the more that number will balloon upwards.  Collecting all of this data is certainly a necessity for compliance standards, forensic analysis and managing end-user performance and availability.  But how can they possible make sense of all the data filing through every minute? 

Read More

Topics: compliance standards, automated threat detection, collect log data, PCI DSS compliance, Log Management, security threat, enterprise SIEM system, end-user performance and availability, managing corporate IT security and compliance, indexing and storing data

Subscribe via Email

Connect with CorreLog