Security / Governance, Risk & Compliance

IBM Security zSecure RACF and SMF Auditing

This course describes the audit problems reported by IBM® Security zSecure™ Audit. The course explains auditing the RACF® database and z/OS subsystems such as CICS, IMS and DB2. You can measure your security and z/OS settings against the security requirements of your chosen policy level. You will also learn about the Access Monitor dataset containing historical statistics of RACF access decisions. This information is used to find profiles, permissions or connections that are unused and can be removed from the RACF database. In addition, you will learn how to review general SMF and RACF audit settings. This course explains how to use and interpret predefined SMF reports and how to create custom SMF reports. Finally, the functions of analyzing library status and changes and the sequential data set are explained.

Issues

Describe and explain the flow of calling security from z/OS and resource managers to RACF
Perform an audit analysis of user IDs and passwords
Audit confidential user IDs and z/OS resources and create audit reports on those authorized to define RACF profiles
Create audit reports for CICS, IMS and DB2 subsystems
Review system-wide audit settings, select and process predefined SMF reports, and define custom SMF reports
Using Access Monitor reports to clean up the RACF database
Audit changes to system confidential libraries and sequential data sets

Who is this training for?

The training is designed for RACF security administrators and auditors who are responsible for administering RACF, generating audit reports and auditing RACF and z/OS security

RACF and z/OS compliance specialists will also benefit from attending this training

Prerequisites

Basic knowledge and experience with z/OS, RACF and zSecure platform
Ability to log in to TSO and use ISPF panels
IBM Security zSecure Admin Basic Administration and Reporting TK263
Basics of RACF z/OS ES19G administration
Successful administration of the RACF BE87G

Training program

Introduction to RACF auditing — security call flows from z/OS and resource managers to RACF
Auditing user IDs and passwords — privilege analysis, password policies, special accounts
Auditing sensitive resources — authorization reports, who can define RACF profiles
Subsystem auditing — generating audit reports for CICS, IMS and DB2
Exercises: identifying excessive privileges and sensitive accounts

SMF auditing — review of system audit settings, predefined SMF reports
Creating custom SMF reports — defining criteria, filtering events
Access Monitor and RACF-Offline — analyzing historical access decisions, identifying unused profiles
RACF database cleanup — removing unnecessary privileges and connections based on Access Monitor data
Library and sequential dataset analysis — monitoring changes in system-critical libraries

Delivery Methods

Online

Convenience of participating from anywhere
Interactive live sessions with trainer
Materials available for 30 days
No travel costs

On-site

Direct contact with trainer and group
Intensive hands-on workshops
Networking with other participants
Full focus on learning

Frequently asked questions

What are the prerequisites for this training?

For IBM Security zSecure RACF and SMF Auditing we recommend: Basic knowledge and experience with z/OS, RACF and zSecure platform; Ability to log in to TSO and use ISPF panels; IBM Security zSecure Admin Basic Administration and Reporting TK263.

What is the format and duration of this training?

The training lasts 2 days and is available in online and on-site format. Sessions run from 9:00 AM to 4:00 PM. We can also customize the schedule to fit your team's needs.

Who is this training designed for?

This training is designed for: The training is designed for RACF security administrators and auditors who are responsible for administering RACF, generating audit reports and auditing RACF and z/OS security; RACF and z/OS compliance specialists will also benefit from attending this training.