SF-SecuClean
RACF database cleanup for z/OS

Downloads

SF-SecuClean Product Description as PDF →

SF-SecuClean, your ultimate RACF cleanup and initial role model creator. Clean up your RACF database without any risk, and set up an initial role model efficiently!

Clean up the RACF database and obtain an initial role model.

An elementary fact regarding security becomes very apparent whenever you react to the results of a z/OS penetration test or audit, as well as during the initial setup of a role model: it is particularly difficult to eliminate excessive or redundant authorizations in RACF, i.e. to streamline access lists, lower the universal access authority (UACC) or even delete profiles. Cleaning up the RACF database and the subsequent “tightening” of your existing security configuration is simply one of the most “feared” consequences of any audit report or role-modeling project.

What are the practical problems involved when cleaning up the RACF database? To retroactively improve a system’s security, i.e. to question existing authorizations by removing, reorganizing or reducing these, always involves the real risk of negatively influencing productive processes and provoking subtle failures. Actually, a golden rule in IT is to “never change a running system!” Nobody knows which users access which resources and would eventually sign a corresponding statement as definitive. Management is therefore constantly challenged to provide their security team with the necessary motivation for such a cleanup project while taking into account its primarily abstract values of security and compliance. At first glance, it seems as if everyone involved “has nothing to gain.” But this is no longer true – there is good news!

The right technology and support make it easy to clean up RACF – and also worthwhile from a practical point of view. Deleted profiles, streamlined access lists, compact groups – all these avoid overhead in RACF’s processing and thus save CPU time concerning each resource access check – several millions of which occur daily.

Setting up an initial role model creates challenges quite similar to those of an RACF cleanup. The first step is to define the current status quo of the required authorizations for all users. You must determine which resources each user must access regarding his or her “role(s)” in the company’s business. A complete and comprehensive assessment in this field is a prerequisite for the second step, which includes the development of a role model based on effectively required, i.e. non-excessive authorizations.

Both challenges – cleaning up RACF and setting up an initial role model – provoke a common technological desire to perform a long-term observation of all resource access requests. SF-SecuClean provides you with this efficient long-term monitoring for RACF environments. Its high performance and cost-effective technology allows you to easily 1) clean up and streamline the security configurations defined by the RACF database (e.g. streamlining access lists, lowering UACCs, removing global access authorizations, deleting profiles, etc.), and 2) perform the necessary assessment of the currently required access authorities to set up an initial role model.

SF-SecuClean’s technology extends the standard RACF environment with the required resource access monitoring without influencing RACF’s actual decisions. All resource access requests are registered in a database (DB2) that is available for online evaluation and reporting at any time. A precise knowledge base is created over time regarding which users (must) access which resources on which access levels for their daily work. The longer the observation period, the greater the informative value of this monitoring becomes. In the end, i.e. after a sufficient length of time, clarity arises regarding each user’s actually required authorizations, which then allows you to reconfigure and optimize the RACF database with minimum risk. Of course, SF-SecuClean’s unique monitoring capabilities also support daily work in your RACF administration, security monitoring, system programming and IT audit departments. Information regarding (real) occurring access requests can be obtained online at any time by following a simple procedure.

SF-SecuClean is, therefore, the ideal solution for all mainframe users across all business sectors or company sizes. It is also the “perfect match” for all pragmatic z/OS users who dismiss any “monitoring and compliance overkill” and just desire a state-of-the-art cleanup and high-performance configuration of their RACF security without investing a lot in CPU time and other costs. Check it out!

Automate your IT Security and Compliance to the max today!

Get Started Now

Solutions to the max.

Cross-Platform Security Solutions

Constant monitoring and auditing of all computer systems is state of the art. For large enterprises it also requires a real-time integration of the mainframe platforms governing event monitoring, vulnerability assessment and compliance checking. With SF-Sherlock and SF-NoEvasion, your security monitoring solution is powerful and can be implemented across your enterprise through the easy integration of the mainframe.

 

SIEM Connectors

Learn More

Mainframe Security and Compliance

Learn More

SOC (Security Operation Center)

Learn More

Compliance

Over the past several years, compliance has become more and more an important issue, but also a tedious task. Our SF solutions assist you in automating the resulting workload to the max by also covering the entire mainframe platform - thanks to a 360-degree approach.

PCI Data Security Standard (PCI DSS)

Learn More

General Data Protection Regulation (GDPR)

Learn More

Cloud Security

Learn More

Protection

With SF-Sherlock, you can also protect your mainframe platform against attacks and combat high-level risks. Thanks to our max approach this also includes malicious code and exploits. Yes, both of these are real risks on the mainframe platform!

Penetration Testing

Learn More

Privileged User Monitoring

Learn More

DB2 Real-Time Monitoring

Learn More

IMS Security Monitoring

Learn More

SF Solutions

All SF solutions are invented and developed in-house. Therefore, you can count on both our unique expertise and our high level of motivation in providing you with solutions and services with maximum performance, effectiveness, and productivity.

Security and compliance monitoring

SF-Sherlock

Real-time audit & compliance data provider, and audit trail protector

SF-NoEvasion

z/OS dump and log anonymization

SF-SafeDump

RACF database cleanup for z/OS

SF-SecuClean

Maximum password and login security for z/OS

SF-LoginHood

Unique utilities as individual solutions

SF-Utilities

Are you expecting a governmental audit of your mainframe platform soon, as by the BaFin or ECB?

Let us help you prepare your mainframe security and compliance.

++800 - 37 333 853 or simply dial: ++800 - DRFEDTKE

Call our world-wide toll-free number now!

(++ represents the prefix for international calls; in most countries it is 00; in the U.S. it corresponds to 011)

News & IT Security Forum

08/2018 – SF-SafeDump supports the integration of external confidential data scanner (CDS) and data leakage prevention (DLP)

by | Aug 12, 2018 | News

Companies dealing with extremely sensitive data often use confidential data scanner (CDS) or data leakage prevention (DLP) applications to do a general scan of all documents before they may leave house. It’s important to emphasize that such CDS and DLP solutions do not perform anonymization, but instead scan documents (files) for possible sensitive content and create a corresponding report. With SF-SafeDump’s new PTF level 017 it’s easy to exploit the performance of any CDS or DLP, namely, to double-check any anonymized dumps and log files as regards possible “leftovers.” But we don’t want to give you the wrong impression: the principal quality check, which is highly comprehensive and fully sufficient, also happens within SF-SafeDump. This means that you are safe and covered without a CDS or DLP. You should also be aware of the fact that SF-SafeDump covers many more categories of sensitive information than a CDS or DLP solution.

Overall, the integration of a given CDS or DLP solution into SF-SafeDump is fully optional. On the other hand, it’s a nice feature, since a CDS/DLP scan may increase a company’s internal level of compliance and promote good feelings while applying the “golden rule” of mandatory document scanning fully effectively to in fact any document, i.e. even to dump and log files originating from the mainframe. We will definitely support any such scenario and won’t take it “personally” if users extend the already powerful quality assurance provided by SF-SafeDump through additional review capabilities. We are confident about this, since SF-SafeDump learns from the results of the CDS or DLP. Just to be clear: it’s still the goal and duty of SF-SafeDump to leave all CDS or DLP reports empty.

With PTF Level 017, everything is provided for such an integration of a CDS or DLP application and even to fully automate the related procedures; the tools provided also solve all problems of best practice that occur within such an integration. The new PTF level 017 is now released and ready for download.

 

07/2018 – SF-Sherlock’s new PTF level provides performance improvements for environments with massive amounts of event data (SIEM, Splunk, etc.)

by | Jul 26, 2018 | News

SF-Sherlock, and thus also SF-NoEvasion, has passed additional intensive performance reviews – driven by z/OS installations that process huge amounts of event data within their z/OS-SIEM, log archive, or Splunk integration. Larger amounts of event data easily result from the monitoring of DB2, CICS, MQ, Webshpere as well as other subsystems.

We achieved these great results by using the latest machine instructions supported by System Z machines as well as by further improving SF-Sherlock’s “event consolidation” feature supported by the real-time sniffer. Especially if your SIEM, log archive, or operational intelligence solution is  licensed by the data volume it receives the event consolidation feature is of great benefit and will help you to reduce costs by not wasting your licensed data volume on redundant event data.

The new PTF level 080 is now released and ready for download.

Read All News

Join our newsletter list

Worldwide toll-free phone number

++800 - 37 333 853
or simply dial:
++800 - DRFEDTKE
Alternatively:
+41 41 710 4005

(++ represents the prefix for international calls; in most countries it is 00; in the U.S. it corresponds to 011)

Find Us

Headquarters

Seestrasse 3a, 6300 Zug, Switzerland

 

Visitors & Training

Dammstrasse 19, 6301 Zug, Switzerland

 

Social Media

Xing → Linkedin →

Write Us

Marketing
marketing@enterprise-it-security.com

copy the address

Technical support and hotline: hotline@enterprise-it-security.com

copy the address