System i Security Suite

Enforcive/Enterprise Security is a suite of integrated iSeries security auditing and access control tools, providing the most powerful protection on the market and is simple enough for non-iSeries users to implement and manage. Enforcive is used by smallest and largest of iSeries shops alike and is ideal for achieving Sarbanes-Oxley, PCI, GLBA, State Privacy, HIPAA, Cobit and like compliance regulation initiatives. Enforcive's simple point-n-click features will cut implementation and ongoing maintenance tasks by more than half, and with no special training or iSeries experience necessary. That's right, no green-screen eperience needed, as quick as you can Point-n-Click, is about how fast you can implement Object Level security policies for your users, view network and system events, as well as run and view reports.

Enforcive/Enterprise Security for the iSeries includes the following 18 modules:

1. GUI Management Console
2. Application Access Control (w/ Replication and Profile Swapping)
3. Application Audit
4. Application Analyzer
5. Central Audit
6. System Audit
7. File Audit
8. System Inquiries
9. User Profile Manager
10. Object Authorization Manager
11. Port Restrictions
12. Alert Center (Intrusion Detection)
13. Extended Sucurity (Inactive User & Session Timeout Manager)
14. Maintenance Control Panel
15. Compliance Toolkit
16. Report Generator
17. Adminstration Manager
18. Control Panel
    

Details about these modules can be read below, most of which also have a short video clip demonstration.

Application Access Control:

• Complete exit point / exit program control
• Permissions by user and/or various types of user groups
• Permissions by IP address range and/or user group
• Granular permissions down to sub-function level
• Permissions at library, object, IFS and object group level (Object Level Security)
• Account swapping for adopted authority
• Controlled access by time of day
• Replication of permissions across multiple servers
• File protection against power users

Application Access is controlled through the Enforcive/Enterprise Security Intrusion Prevention System (IPS) using exit point and other technologies. It provides simple to implement (point and click) but tight access controls to prevent unauthorized requests through TCP/IP and SNA connections. Access can be restricted by user, group, IP address, application server/service and specific operations.

The summary of the iSeries application servers and services protected by Enforcive/Enterprise Security includes:

Under TCP/IP: Telnet, FTP, TFTP, Remote Command, Remote SQL, Database, Data Queue, ODBC, DDM, DRDA, IFS, Signon, File Server, Central Server, Message Server, Virtual Print, Network Print, WSG Logon, ShowCase, Sensitive Commands and more.

Under SNA: DDM, Pass through, Data Queue, File Transfer and DRDA

Under System: Delete Journal Receiver, Power Down System, System Attention Key, Change Spool File Attributes, End Job and TCP/IP control.

Access can be secured down to the level of a single action (e.g. FTP delete, SQL select statement and OS400 commands. At the object level, access can be controlled to selected devices, libraries, files, commands, programs and IFS paths.

Internet Users Control: Enforcive/Enterprise Security allows management of public internet users for web-based iSeries applications. This includes creation, updating and deletion of validation list objects and assigning and removal of users and passwords.

User Profile Manager: Efficient and controlled iSeries user management.

Session Time-Out: Customize different Session Time-Out rules for different users and groups and the actions to automate.

File Protection: Control access to iSeries files beyond the restrictions afforded by iSeries object authority. Allows restriction from any user or user group, including power users with *ALLOBJ authority and even QSECOFR.

Account Swapping: Temporarily give individual or group of users the OS/400 object authority and network permissions of another user, so that the user receives the authorities of the other user without the need to know powerful user's password. Enforcive SWAP function also provides a detailed audit trail of the actual user, related job information/commands and the reason the SWAP was required.

Inactive User Control: Customize different Inactivity rules for different users and groups and the actions to automate. Enforcive allows you to implement unique inactive user policies for different types of User Accounts and Groups. Once defined, users of the policy will automatically be disabled and/or deleted from your system. Inactive user policies can be defined at a system level as a default and additional optional policy definitions can be defined for individuals and/or groups. Furthermore, as part of the policy, you can define how the system will handle the objects owned by the user, by: calling a customer program, only deleting the user profile if it doesn't own any objects, delete user profile and the objects it owns or delete user profile and change the owner of the objects it owns to another user you define for the policy.

Object Authorization Manager: Object authority management made easy.

Port Restriction Manager: Lock down access to iSeries ports.

Field Masking (optional module): Keep sensitive field values safe from prying eyes for compliance.

Report Generator: Enforcive's Report Generator is a very robust and flexible Report Writer capably of addressing the most demanding requirements and includes100's of canned, ready-to-run iSeries reports for System Journal, Network (exit points), Sensitive Files, User Profiles, Compliance, Policies, Objects, Jobs, IFS, Alerts, PTF's, or any other file on your system. Customize any existing report or create one from scratch using Advanced SQL or the built in Wizard. Report output formats include (PDF, CSV, HTML & Spool File). The Report Generator includes a built in scheduler that can be used for individual reports or groups of reports. Reports can be configured to run on the local system, a remote system or a group of systems.

Policy Compliance Manager (optional module): Template-based control of OS/400 definitions incorporating template definition, deviation reporting and controlled adjustment. A must for all compliance policies.

Application Audit: Detailed reports and logging (includes details like IP address, user, file, library, even the FTP and SQL statements themselves) of network and native exit point activity with powerful filtering tools.

Application Analyzer: A graphical exit point traffic "Network" analyzer to understand trends and pinpoint possible security threats. The Application Analyzer provides summary forensic information about your users activities, exit points, policies and IP Address. This data is derived from the detailed forensics log stored in the Application Audit, which stores all traffic going in and out of your iSeries via the network (FTP, ODBC, JDBC, RMTSQL, DDM, PASS-THROUGH, DRDA, File Server, File Transfer and like OS400 exit points). The analyzer provides a simple means to investigate and drill down into security issues that typically would be missed.

File Audit: Field values can be displayed in a before and after the change format accompanied by a full description of the environment at the time of the change including user, the program through which the change was made and more. The product has been designed for users who do not possess a deep knowledge of system commands. You can easily view changes in field values, or details of deleted and added records.

Enforcive/Enterprise Security File Audit can pinpoint exact changes made and assist you in making decisions regarding security breaches and the restoring of corrupted data.

System Journal Audit: An innovative GUI management tool for the iSeries System Journal. It provides full supervision of the system journal including management of journal receivers, audit policy definition, on-line viewing and reports, comprising dozens of pre-shipped reports and a generator to create your own custom reports.

The interactive system journal viewer provides retrieval through filtering by different criteria. The Enforcive/Enterprise Security System Audit facilitates easy investigation of security breaches and turns a previously complicated and time-consuming task into a simple and efficient one.

The powerful report generator allows you to create reports of system events with the selection criteria you require. Reports can be run directly or placed on the iSeries scheduler for running later. After completion the report can be previewed on the screen or printed. The product ships with dozens of built-in reports already defined. System audit policy can be changed at the click of the mouse at system, user and object levels.

Multi-Source Audit History including Read-Record Field Values:
The Central Audit brings together audit information from various sources to one single point of contact. The system and file journaling information you extract is available as audit history even when receivers have been deleted. Other audit data comes from the product database and includes network access detail, field level contents for database changes and even read access when no changes were made.

iSeries Inquiries: On-line reports of object and user authorities to help you identify and close security risks in your system definitions. All inquiries are run from the GUI but give a real-time picture of the definitions on your server. This gives the system administrator a valuable set of tools for pinpointing any vulnerability in your iSeries system.

The suite of inquiries provides up-to-the-minute reports with supplementary information to save you looking elsewhere. Examples are authorization lists by object and by user and the system values inquiry showing full description, current value, recommended values and policy group. Other inquiries cover users, environment, policy settings, passwords, special authorities and library authorities.

Alert Center: Intrusion detection system (IDS) provides instant alerts for network and native system events and can:

• Write to Windows Event Log
• Send email
• Call Program
• Send Message to Data Queue
• Send Message to Message Queue
• Send SNMP Trap
• Send Entry to System Journal
• Disable User
• Enable User
• Revoke User Special Authority

Compliance Toolkit: Essential reports and alerts built specifically for the requirements of Sarbanes-Oxley.

SQL Statement Audit: Allows you to monitor and SQL events, including: interactive SQL processes, embedded SQL in HLL, DRDA, DDM, ODBC and OS/400 queries

Deploy and manage with speed and confidence: Enforcive/Enterprise Security was designed for security administrators of all calibers (even with no Green Screen experience).

Windows-based GUI: Simple point and click interface intuitive and completely integrated solution.

Multi-server: Multiple servers are managed simultaneously from your PC by the Enforcive/Enterprise Security Manager.

Administration Role Manager: Tailor specific security admin tasks to different administrators. Define the degree of authority and scope they have over each task facilitates separation of duties.

Help Desk Assistant: Use Enforcive to define limited-control admin roles for the purpose of basic support functions.

On-line Help: Full explanations and step-by-step instructions of each feature at your fingertips (if ever required).

Learning Aids: Free learning aids can be downloaded by our customers, including presentations, tutorials and documentation.

Multi-Language: Interface in English, Italian, German and Japanese interfaces shipped free. Contact us for other language options.

Learn more about how Enforcive/Enterprise Security can help you achieve compliance by contacting Midland Information Systems, Inc. - a Tier 1 Enforcive Distributor.

• Private Demonstrations (on-site, remote, and large group via the Web)
• Security Assessment Risk Analysis
• Trial Evaluations of Enforcive/Enterprise Security
• White Papers addressing Security Regulation Requirements, like (SOX, PCI, HIPAA, GLBA, etc.)
• Onsite and remote training, security policy development and implementation services

1. Operating system - Windows 2000, 2003, XP, Vista, Windows 7 or later.
2. TCP/IP communication to the iSeries or AS/400.