#mfsummit2016 secure: is your mainframe less secure than your fileserver

Is your mainframe less secure than your file server?

Malcolm Trigg | Solutions Consultant | 24th February 2016

What is

my

account

balance?

The World’s Changed


Internal Security Standards

Not Everything has Changed.Is that Good?

Not Everything has Changed

What if you could…

• Stop the user having to enter a user / password

• Allow multi-factor authentication• Something you have• Something you are• Something you know

• Use your Active Directory / eDirectory to store…• Users password• Bio-metric information such as finger print• Smart card details

• Bring the login screen in-line with modern security standards

• Protect sys admin logins

Well you can…

• Micro Focus Advanced Authentication Framework

• Link with Reflection Desktop / Rumba terminal emulation

• Choice of smart cards and/or bio-metrics such as fingerprint recognition


• Centrally manage the sign on to the mainframe

• Use a RACF one-time token in place of a password

• No need for user to enter or remember a password

• User doesn’t get prompted for user/password

• User need never know their password

Well you can…

Automated Sign-On withManagement and Security Server

1. The terminal emulator launches a host session and requests user credentials for the host application from Automated Sign-On.

2. Automated Sign-On requests a one-time-use PassTicket from RACF (from the IBM z/OS Digital Certificate Access Server).

3. The terminal emulator uses the one-time-use PassTicket credential to automatically log the user on to the host application.

With Micro Focus…

• Access to the mainframe• No longer reliant on the historic 8 character password

• Now tied to the corporate Active Directory / eDirectorycredentials

• Access to the mainframe can be revoked through group membership in Active Directory / eDirectory

• Mainframe access becomes security compliant

• Protect sys admin access

• You can automatically provision users along with permissions on host systems

Which Devices can Connect?

• Particular networks• All workstations• Any terminal emulator• No restrictions on who



• Control who can access the mainframe

• Only allow authorised terminal emulators to be used

• Access control through Active Directory / eDirectory

• Roll Based Access Control (RBAC)

• Centrally managed

• Make the firewall rules simple for mainframe

Well you can…

Client workstation

Telnet, FTP, INT-1, T27, ALC,

SSL/TLS

SSL/TLS

MSS Server

MSS Security Proxy

LDAP Directory

HTTPS

Content inspection (Intrusion Detection

System, etc.)

Host

Micro Focus Management and Security Server

Access control in middle tier:

• A layer of security in front of your hosts

• Without touching the hosts

• Using read-only access to the LDAP Directory

With Micro Focus…

• A connection to the host can only be performed if you have been pre-authenticated

• Access to the host based upon AD/eDirectorymembership

• Host can be protected by a firewall / simplified firewall rules

• Only allow connections originating from the Micro Focus Security Proxy Server

Well you can…

Client workstation

Telnet, FTP, INT-1, T27, ALC,

SSL/TLS

SSL/TLS

MSS Security Proxy


System, etc.)

Host

Client workstation

User Case Study – Airline Industry

• Problem• Need to give travel agents access to their mainframe• A traditional thick client was heavy on management• Don’t own or manage the desktop• Had to use a VPN to tunnel traffic – further complicated

the set-up• New travel agents opening all the time and also some

closing• Spread through out the world

User Case Study – An Airline

• Solution

• Management and Security Server• Strong authentication

• Security Proxy Server• Only authenticated clients could connect to the mainframe

• Thin client emulation• Readily configured sessions deployed to the desktop using

Java Applets

• Changes automatically deployed on next connection

User Case Study – An Airline

• Benefits• Mainframe protected from unauthorised access

• Deployment as easy as providing a URL and adding user to LDAP database

• Decommissioning as easy as removing the user from the LDAP database

• Easy centralised management

• Small client foot print on desktop

• Very little management of agent required by airlines help desk

Airline Solution Graphic

Travel AgentDesktop

Airlines TrafficSSL/TLS

MSS Server

MSS Security Proxy

LDAP Directory

Authenticated by MSS Server


System, etc.)

AirlinesHost

Secure token passed

HTTPS

No direct access to mainframe.Only allowed through Security Proxy

Server if authenticated by MSS Server

Screen Content


• Credit card number remains on screen after typing

• No additional access authentication required to view credit card number

• Terminal emulator only displays what the host sends it


• Mask credit card numbers or any other sensitive field

• With out changes to the host application

• Stop copy to clipboard from working for certain fields

• Redact information once typed i.e. after entry of a credit card number

Well you can…

Micro Focus Terminal Emulation

• Fields can be displayed masked with asterisks

• After typing a credit card number it can be redacted

• The copy to clipboard field can be disabled for certain fields

With Micro Focus…

• Sensitive information is only displayed to those who really need access to it

• Information typed only left on the screen until last character typed and then it is redacted

• Helps with PCI DSS

• Stop user from using terminal emulation trace facility by locking the terminal emulator down

Multiple Authentication Points


• Authenticated once

• Application security controlled by application

• Non-repudiation

• No re-authentication for certain tasks

• Replace the normal Signon with a stronger method of Authentication and enable Single Signon?

• Prompt a user at any point during any type of transaction to Re-Authenticate?

• Re-Authentication could have context like:• Financial Value or transaction type?

• Time since last Authentication?

• Write away before and after values of any transaction to a Non-Repudiation system which could be used to report on activity?

• With NO changes of any code on the legacy system?


Well you can…

• Micro Focus Advanced Authentication Framework

• Link with Reflection Desktop / Rumba terminal emulation

• Choice of smart cards and/or bio-metrics such as fingerprint recognition

Micro Focus Multi-Factor Solution

With Management Security Server (MSS)and Advanced Authentication you can...

• Create an enforceable access control layer between your employees and your legacy systems.

• Leverage your enterprise directory to authorise users to host sessions.

• Utilise strong authentication technology to confirm user identity.

• Make use of multifactor Authentication.

• Invoke Authentication and Authorisation at any stage during a session or function on a legacy application with full audit reporting.

• Centrally administer access to terminal host sessions and macros.

Directory(eDIR, AD, LDAP, RACF)

User

Reflection /Rumba

AAFRTE

Credentials(MFA, Mix & Match)

RACF/TOP Secret Authentication

Secondary Application Authentication

Sensitive Enquiry Authentication

Sensitive Transaction Authentication

Time Based Authentication

VBA

Reflection / Rumba and Advanced Authentication Framework

With Micro Focus…

• Insecure user/password host logon a thing of the past

• Multiple re-authentication points can be utilised

• Multi-factor authentication

• Tied into AD / eDirectory security groups

• Roll Based Access Control can be applied

• Permissions can be easily revoked

• Central management of terminal emulation and access

Re-using Mainframe Information

What is

my

account

balance?

Account

Balance

is

here….


Well you can with Micro Focus…

Micro Focus

IBM 3270

IBM 5250

VT/UNIX

HP700/92

Business Application

• Well featured design time environment

• Wraps host application logic with SOA interface

• Non invasive ‘off host’ architecture

• No change to host applications

• Leverage existing business rules

• Real time integration

• Acts as a ‘data firewall’ – securing and guaranteeing integrity of

the application

• Robust, scalable and secure• Rejuvenation options available

1 2 3

Full Terminal Support

Zero Footprint

No Map

Enhanced Emulation

Custom WebServices

Custom Mobile AppsTerminal Emulation• Screen re-presented as HTML or HTML5

• One to one with host screen

• Can be accessed on desktop to mobile devices

• Provides a secure method of accessing the host remotely

• No direct access to host from client

1 2 3

Custom WebServices

Custom Forms

Server-SideMacros

Managed

Enhanced Emulation Custom Mobile AppsTerminal Emulation• Automation of host application

• Still have access to host screen

• Secure connection

• Scalable


1 2 3

Custom WebServices

Fully Customized UI

SOA Capable

Trans-form

Terminal Emulation Enhanced Emulation Custom Mobile Apps• User sees no host screens

• Complete web-frontend

• Fields can be hidden from user


• Secure and scalable

With Micro Focus…

• Host systems can easily become web service enabled

• Providing a secure method of integrating

• Hide fields from developers

• Platform for rejuvenation

• Integration with other systems

• Mobile device access as well as desktop

• Secure and scalable solution

Macros – Useful?


• Macros managed by users

• Development against production system

• Sharing of macros

• Ownership / support

• Change control


• Prevent users from creating macros

• Prevent users from viewing macros

• If macros not required then prevent running of macros

• Control the distribution of macros

• Make macros part of a secure development life cycle

• Ensure macros are part of change control

Well you can…

Management and Security Server• Distribute macros• Control access to terminal emulation

Reflection / Rumba Terminal Emulation • Lock down emulation• Prevent macros being run from untrusted

locations• Prevent macros from being created• Lock down API

With Micro Focus…

• Macros can be managed

• Terminal emulation locked down

• Macros become known and managed by IT

• Secures the mainframe from abuse by macros

Security Across the Board

General Security

• Crypto modules FIPS 140-2 validated

• Used by US DoD

• TLS 1.2 fully supported

• Secure development life cycle (SDLC)

• Security given prominence throughout development of products

• Intensive security testing of products

Summary

General Security

• Advanced Authentication Framework

• Enhance the authentication process

• Multi factor authentication

• Multiple points of authentication

• Allow automated provisioning of mainframe users and permissions

General Security

• Manage access to mainframe

• Management and Security Server

• Security Proxy Server• Can’t connect unless authenticated

• Redaction of sensitive information

• Secure integration of mainframe information

• Macros can be managed

#mfsummit2016 secure: is your mainframe less secure than your fileserver

Technology