Q and A

PowerNews: January 2011

Posted in Audits, Company News, Q and A, Security, Services on January 14th, 2011 by Will – Be the first to comment

Innovation and Airline Food

Innovation and Airline Food: 2010 in Review

By Robin Tatam, Director of Security Technologies

For the first PowerNews of 2011, I’d like to step back from our traditional format and share some personal reflections on my year at PowerTech, and on things to come in the New Year.

New: Receive PowerNews in Print!

PowerTech from the Inside

I’m happy to report that, in 2010, PowerTech and Help/Systems continued to focus on customers. We hosted meetings, where we shared glimpses of our future and listened to your feedback on development and other issues. In response to the sessions, we released a great database monitoring solution. Overall, our customers reiterated what we already knew: we aren’t perfect, but we can be proud of our solutions and service.

Product-wise, 2010 brought a major update to our popular Network Security solution, including exciting features like object-level rule support, and a stronger infrastructure design to support future enhancements. As I write, our team is putting the finishing touches on Compliance Monitor 3, and we’ll roll out further enhancements throughout 2011. I can’t wait to see your reaction to these upgrades.

On the training front, we launched several great online classes in 2010, with more options coming in 2011. Watch for a Compliance Monitor class to complement the existing Network Security and Authority Broker classes. For those with a tight budget, this is an inexpensive way to gain expert training.

Life on the Road

Readers of my blog know that my objectives last year often involved boarding passes and suitcases, as I traveled to cities including Seattle, Orlando, Dallas, and New York. For those keeping track, here are some of my 2010 travel statistics:

Air miles 41,684
Cities 16
Continents 2
Nights spent in hotels 56
Nights spent in a lighthouse 1

If the lighthouse didn’t throw you, consider the number of hours I spent with my 6’ 6” frame crammed inside a Boeing 767.

Longest flight: Minneapolis to London, 4,015 miles
Shortest flight: Minneapolis to Chicago, 355 miles

High-Water Marks

I do whatever it takes to reach my customers. Last year, I rode planes, trains, cars, taxis, shuttle buses, untold miles of moving walkway—even an airboat (I’m not kidding!).

I baked in the sun and froze in the snow, though I managed to evade the Metrodome’s collapsing roof.

On my way, I met great customers and took in fantastic sights. I memorialized many of them in landscape photographs that brighten my office and my blog. I hope you enjoy them as much as I enjoy taking them.

vegas1

Beautiful Las Vegas, Nevada.

A Steady Pulse

For now, I’m home again. I smile when I think back to one year ago, when our competitors were suggesting that PowerTech had no future. In reality, PowerTech’s heartbeat is stronger than ever, as our recent growth illustrates.

It was a great year, but the best is ahead.

Fire up the airboat.

—————————————————————————————-

7 Habits of Highly Secure Companies: Part III

By Robin Tatam

Please enjoy the final entry in my 7 Habits series. Feel free to go back and review Part I and Part II.

Habit 5: Use Existing Technology

Security companies spend millions of dollars to develop and perfect their solutions, so take advantage of their efforts.

Alternatively, you could hire staff to develop and support your own technology, but auditors frown upon self-policing.

You could also spend hours manually reviewing log entries and events, but automated solutions can notify you of actions. And what about activities the operating system cannot see, such as downloading payroll files via FTP?

In these cases, and many others, commercial security technologies can be extremely helpful. However, you must be sure to deploy them properly, and, in the case of IBM i, leverage your operating system’s built-in security controls.

Habit 6: Monitor Ongoing Compliance

Security isn’t a destination; it’s a journey. But this doesn’t mean you should dawdle. If you manage to elude mandates or regulations, you still have corporate and ethical responsibilities to your clients, customers, and employees.

The easiest way to meet your obligations is to implement and maintain a robust security infrastructure. Ongoing compliance checks help you maintain your high security levels.

Your initial assessment helped shape your security policy and subsequent server configuration; compliance checks should verify that you are doing what your policy states. Find the causes of non-compliant items, and take steps to prevent them from recurring.

In addition to compliance checks, use security tools to stay abreast of important events. Don’t wait until the end of the month to discover you had a non-compliance situation three weeks earlier. A good security solution makes constant analysis less daunting.

PT Product Chart

The Powertech suite of products.

Habit 7: Plan for the Future

In the tech world, things are never the same tomorrow. Consider the technologies of ten years ago, and the ways in which we secured them.

Since then, we’ve experienced great technological innovation, challenges, and change. Your business must react to change to stay competitive,  and do it while complying with changing standards, laws, and regulations.

Compliance requirements will evolve, but they won’t go away. For example, privacy laws that began in California quickly rolled into forty other states, and a federal law may follow. Always keep your eyes on the horizon.

Master the 7 Habits

By reviewing and mastering the seven habits I’ve presented to you over the past few months, you can become and remain secure, no matter what the future brings.

—————————————————————————————-

Q & A with Paulie Culin

Dear Paulie,
I upgraded to Network Security version 6 and imported my security rules. How do I remove the old product libraries?

A: First, locate the old product library(s):

WRKOBJ OBJ(POWER*) OBJTYPE(*LIB)

Next, check for any object locks:

WRKOBJLCK OBJ(POWER5XX) OBJTYPE(*LIB)

If there are NO locks, you are OK to delete the old product libraries.

If there are locks, DO NOT DELETE THE OLD LIBRARY.

You may need to activate the new exit programs in Network Security 6. The activation process will recycle the server jobs, release the locks, and allow you to continue.

image001[2]

Learn more with PowerTech Webinars and online training.

Request a demo.

Q & A: November 2010

Posted in Audits, Q and A, Security, Uncategorized on November 10th, 2010 by Will – Be the first to comment

Q: How can I use PowerTech Network Security to globally prevent users from updating data via Open Database Connectivity (ODBC)?

Note: Before implementing global rules, run audit reports against the server to make sure you do not prevent necessary access.

A: From the Work with Security by Server screen, locate the SQL server (*SQLSRV) and place UA in the field to Edit User Authorities.  Add your user ID, and set the CAPTURE flag to YES (Cap = Y). Perform an update.

From the Main Menu, select the Work with Captured Transactions option. Then, locate the UPDATE transaction you performed. Place a 1 next to it to MEMORIZE the transaction. This opens the transaction for you to edit.

1.    Change the User to *PUBLIC.
2.    Change the Authority to *REJECT.
3.    Change the Transaction to UPDATE%.

To add users or groups who are exempt from this rule, give them an authority of  *OS400. Also, we recommend that you change the Send Messages option to *YES.

Q&A Image

This configuration prevents users from updating data via Open Database Connectivity (ODBC).

Learn more with PowerTech Webinars and online training.

Request a demo.

September Questions and Answers

Posted in Q and A on August 19th, 2010 by bob.balderson – Be the first to comment

Q: We license several PowerTech products and sometimes I have a hard time remembering the various product commands. Can I put them on a menu?

We’ve already created one for you. It’s called the PowerTech Products Menu, and it’s available FREE from our Web site. It has everything you need to access your licensed products, start and end Compliance Monitor system monitors, and display product information.

Just follow the simple steps below and you’re ready to go.  Enjoy!

  1. Download the PowerTech Products Menu from our Web site (you must be logged in to the site).
  2. Create a save file on the System i using the following command:CRTSAVF QGPL/P1PTUT01
  3. FTP the product menu save file to the System i and execute the following command:
  4. RSTLICPGM LICPGM(1PTUT01) DEV(*SAVF) SAVF(QGPL/P1PTUT01)

  5. Enter the command GO POWERTECH from a command prompt to display the menu.
PowerTech Product Menu

PowerTech Product Menu

Paul “Paulie” Culin is a Senior Security Engineer with the PowerTech Group. As a product expert, his role at PowerTech includes managing client training and implementation services, as well as hosting security presentations, Webinars, and product demonstrations. Paul has thirteen years of experience in the security field.

August Questions and Answers

Posted in Q and A on August 3rd, 2010 by bob.balderson – Be the first to comment

Q: Compliance Monitor has some product user profiles that are set to never expire. Can they be changed to meet our password requirements?

A: Compliance Monitor has four profiles: PLCMOWN is the object owner for the Endpoint; PLCM2OWN is the object owner for the Consolidator; PLCM2ADM is the profile used to sign on to the product for the first time; PLCMADM is used for communication between the Consolidator and the Endpoint.

The object owner profiles are set to *DISABLED and have the suffix “OWN” to denote their use, so they don’t attract attention. However, PLCM2ADM and PLCMADM might.

PLCM2ADM can be set to *DISABLED if you sign on to the product under an alternate authorized profile. If you set the password expiration interval at *SYSVAL and the password expires, you must use the command PTCMT2/CHGPCM2PWD to reset it. This encrypts the password in a special password store.

PLCMADM must be set to *ENABLED. We recommend that you leave the password expiration interval set to *NOMAX because if you have multiple Endpoints and you change the password on one Endpoint, you must change it on all your Endpoints to match. Plus, each Compliance Monitor user must enter the password in each PC GUI installation, so that could be a problem for large deployments. We recommend leaving PLCMADM as is—the password is securely maintained in the triple-DES encrypted password store on the Consolidator.

Paul “Paulie” Culin is a Senior Security Engineer with the PowerTech Group. As a product expert, his role at PowerTech includes managing client training and implementation services, as well as hosting security presentations, Webinars, and product demonstrations. Paul has thirteen years of experience in the security field.