Pre-Con Ed: CA ACF2 and CA Top Secret – Part 2: Advanced Security Controls

1. World®
’16
CA ACF2 and CA Top Secret – Part 2: Advanced
Security Controls
John Pinkowski - Product Owner
MFX39EB
MAINFRAME AND WORKLOAD AUTOMATION

2. 2 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
For Informational Purposes Only
Terms of this Presentation
© 2016 CA. All rights reserved. All trademarks referenced herein belong to their respective companies. The presentation provided at CA
World 2016 is intended for information purposes only and does not form any type of warranty. Some of the specific slides with customer
references relate to customer's specific use and experience of CA products and solutions so actual results may vary.
Certain information in this presentation may outline CA’s general product direction. This presentation shall not serve to (i) affect the rights
and/or obligations of CA or its licensees under any existing or future license agreement or services agreement relating to any CA software
product; or (ii) amend any product documentation or specifications for any CA software product. This presentation is based on current
information and resource allocations as of November 1, 2016, and is subject to change or withdrawal by CA at any time without notice. The
development, release and timing of any features or functionality described in this presentation remain at CA’s sole discretion.
Notwithstanding anything in this presentation to the contrary, upon the general availability of any future CA product release referenced in
this presentation, CA may make such release available to new licensees in the form of a regularly scheduled major product release. Such
release may be made available to licensees of the product who are active subscribers to CA maintenance and support, on a when and if-
available basis. The information in this presentation is not deemed to be incorporated into any contract.

3. 3 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
Abstract
More than 70 percent of corporate mission-essential data
resides on the mainframe. Do you have enough security
controls in place to protect it? This session will do a deep dive
into the most granular configuration and security controls of CA
Top Secret® and CA ACF2™, and provide a walk-through of why
it's absolutely necessary to implement granular security in
mainframe environments.
John Pinkowski
CA Technologies

4. 4 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
Agenda
CASECAUT RESOURCE CLASS
NEW GENCERT GRANULARITY CONTROLS
1
2

5. 5 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
What Is CASECAUT?

6. 6 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
The CASECAUT Resource
§ CA ACF2 r15 introduced the new pre=defined resorruce clas of CASECAUT.
The internal CLASSMAP record with TYPE=AUT.
§ CA Top Secret r15 introduced the new resource definition table (RDT) class
of CASECAUT.

7. 7 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
The CASECAUT Resource
§ Supplements existing administrative authorities by providing the ability to
authorize users to perform administrative functions over passwords, password
fields, and certificates without adding any high-level privileges to the user.
§ To granularly control administrative functions in order to prevent users from
performing administration tasks that they should not be authorized to do. For
instance, modifying the passwords for user ID’s outside of their scope, like a high-
level security admin. Conversely, CASECAUT can be used to allow certain
administrative functions for use by an ID while blocking others. For instance,
allowing a Help-Desk administrator to modify another user’s password, but not
change any of the password requirements, like number of special characters
required.

8. 8 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
What Can I Control?

9. 9 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
Changing Password Fields (CA Top Secret)
The following shows the authorizations needed to change password-related fields:
Field Name CASECAUT Entity Name Applicable Commands for cmd Qualifier
ASUSPEND TSSCMD.USER.cmd.ASUSPEND REMOVE
KERBVIO TSSCMD.USER.cmd.KERBVIO REMOVE
NOPW TSSCMD.USER.cmd.NOPW CREATE, ADDTO, or REMOVE
NOPWCHG TSSCMD.USER.cmd.NOPWCHG CREATE, ADDTO, or REMOVE
PASSWORD TSSCMD.USER.cmd.PASSWORD CREATE, ADDTO, or REPLACE
PHRASE TSSCMD.USER.cmd.PHRASE CREATE, ADDTO, or REPLACE
PSUSPEND TSSCMD.USER.cmd.PSUSPEND ADDTO or REMOVE
SUSPEND TSSCMD.USER.cmd.SUSPEND CREATE, ADDTO, or REMOVE
VSUSPEND TSSCMD.USER.cmd.VSUSPEND ADDTO or REMOVE
XSUSPEND TSSCMD.USER.cmd.XSUSPEND ADDTO or REMOVE

10. 10 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
NEWPW Restrictions (CA Top Secret)
The following shows the authorizations needed to bypass PWADMIN NEWPW restrictions:
Field Name CASECAUT Entity Name Applicable Commands for cmd Qualifier
PASSWORD(newpw) TSSCMD.USER.cmd.PWADMIN.NO CREATE, ADDTO, or REPLACE
PASSWORD(newpw) TSSCMD.USER.cmd.PWADMIN.EXP CREATE, ADDTO, or REPLACE
PASSWORD(newpw) TSSCMD.USER.cmd.PWADMIN.INT CREATE, ADDTO, or REPLACE
PASSWORD(newpw) TSSCMD.USER.cmd.PWADMIN.ZEROINT CREATE, ADDTO, or REPLACE
PASSWORD(newpw) TSSCMD.USER.cmd.PWADMIN.HISTBYP ADDTO or REPLACE

11. 11 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
Digital Certificate and Keyring Commands (CA Top Secret)
The following shows the authorizations needed to issue digital certificate and keyring-related commands:
Command CASECAUT Entity Name
ADD TSSCMD.CERTUSER.ADDTO
CHKCERT TSSCMD.CERTUSER.CHKCERT
EXPORT TSSCMD.CERTUSER.EXPORT
GENCERT TSSCMD.CERTUSER.GENCERT
GENREQ TSSCMD.CERTUSER.GENREQ
P11TOKEN TSSCMD.DIGTCRT.P11TOKEN.tokencmd
REKEY TSSCMD.CERTUSER.REKEY
REMOVE TSSCMD.CERTUSER.REMOVE
ROLLOVER TSSCMD.CERTUSER.ROLLOVER

12. 12 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
Running Utilities (CA Top Secret)
The following shows the authorizations needed to execute TSS batch utilities:
Utility CASECAUT Entity Name
TSSXTEND CASECAUT(TSSUTILITY.TSSXTEND)
TSSFAR CASECAUT(TSSUTILITY.TSSFAR)
TSSAUDIT CASECAUT(TSSUTILITY.TSSAUDIT)
TSSCHART CASECAUT(TSSUTILITY.TSSCHART)
TSSUTIL CASECAUT(TSSUTILITY.TSSUTIL)
TSSSIM CASECAUT(TSSUTILITY.TSSSIM)
TSSCFILE CASECAUT(TSSUTILITY.TSSCFILE)
TSSTRACK CASECAUT(TSSUTILITY.TSSTRACK)

13. 13 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
Controlling Password/Password Field Administration
(CA ACF2)
Field Name CASECAUT Resource Name
PASSWORD ACFCMD.USER.PASSWORD
PWPHRASE ACFCMD.USER.PWPHRASE
PWP-VIO ACFCMD.USER.PWP-VIO
PSWD-VIO ACFCMD.USER.PSWD-VIO
PSEDCVIO ACFCMD.USER.PSWDCVIO
KERB-VIO ACFCMD.USER.KERB-VIO
CANCEL ACFCMD.USER.CANCEL
SUSPEND ACFCMD.USER.SUSPEND

14. 14 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
Controlling Certificate Administration (CA ACF2)
Certificate Command Resource Names
CHKCERT ACFCMD.DIGTCERT.CHKCERT
CHANGE ACFCMD.DIGTCERT.ALTER
CONNECT ACFCMD.DIGTCERT.CONNECT
DELETE ACFCMD.DIGTCERT.DELETE
EXPORT ACFCMD.DIGTCERT.EXPORT
EXPORT (KEYRING) ACFCMD.DIGTCERT.EXPORTKEY
GENCERT ACFCMD.DIGTCERT.GENCERT
GENREQ ACFCMD.DIGTCERT.GENREQ

15. 15 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
Controlling Certificate Administration (CA ACF2)
Certificate Command Resource Names
INSERT ACFCMD.DIGTCERT.ADD
INSERT (CERTMAP) ACFCMD.DIGTCERT.ADDMAP
INSERT (KEYRING) ACFCMD.DIGTCERT.ADDRING
LIST ACFCMD.DIGTCERT.LIST
P11TOKEN BIND ACFCMD.DIGTCERT.P11TOKEN.BIND
P11TOKEN IMPORT ACFCMD.DIGTCERT.P11TOKEN.IMPORT
P11TOKEN UNBIND No CASECAUT auth’s required.
REKEY ACFCMD.DIGTCERT.REKEY

16. 16 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
Controlling Certificate Administration (CA ACF2)
Certificate Command Resource Names
REMOVE ACFCMD.DIGTCERT.REMOVE
RENEW ACFCMD.DIGTCERT.RENEW
ROLLOVER ACFCMD.DIGTCERT.ROLLOVER

17. 17 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
New GENCERT Granularity controls

18. 18 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
Granular Certificate Administration
To Turn On/Off Granular Administration

19. 19 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
Granular Certificate Administration
§ New Certificate/Key ring Administration
– Use RDATALIB class
– Access is given to specific certificate/key ring
– Rules can be masked
– Scoping can be used to restrict access further
– Similar rules used by R_datalib callable service (DataPut, DataRemove)

20. 20 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
Questions?

21. 21 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
Recommended Sessions
SESSION # TITLE DATE/TIME/ROOM
MFX119S Encryption and Hashing and Keys – Oh, my! 11/16/2016 at 1:45pm Jasmine E
MFX118S
How is Buying a Home Like Justifying Data Security Investments?
Developing Return on Security Investment (ROSI) Analysis
11/16/2016 at 3:00pm Jasmine E
MFX173S The Importance of Mainframe Security Education 11/16/2016 3:45pm Jasmine E
MFX172S
The Key to Complying With New Regulations and Standards:
Comprehensive Mainframe Security
11/16/2016 at 4:30pm Jasmine E
MFT174S Mainframe Security Strategy and Roadmap: Best Practices for
Protecting Mission Essential Data 11/17/2016 12:45pm Mainframe Theater
MFT175S Gaps in Your Defense: Hacking the Mainframe 11/17/2016 3:00pm Mainframe Theater

22. 22 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
Must See Tech Talks and Demos – Expo Floor
MFT53T
How Can
Mainframe Security
be Made Easier?
11/16/2016 @
12:45pm
Mainframe Theater
Mainframe
Security and
Enterprise
Security
Demos
SCT38T SCX05E
PAM Threat
Analytics
11/17/2016 @
4:00pm
Security Theater
Governing Your
Privileged Users
11/16/2016 @
3:45pm
Security Theater

23. 23 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
Thank you.
Stay connected at communities.ca.com