DOCSLIB.ORG

CICS TS for Z/OS: CICS Security Guide Chapter 1

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
CICS TS for Z/OS: CICS Security Guide Chapter 1 CICS Transaction Server for z/OS 5.6 CICS Security Guide IBM Note Before using this information and the product it supports, read the information in Product Legal Notices. This edition applies to the IBM® CICS® Transaction Server for z/OS®, open beta (product number 5655-YV15655-BTA ) and to all subsequent releases and modifications until otherwise indicated in new editions. The IBM CICS Transaction Server for z/OS, open beta may be referred to in the product and documentation as CICS Transaction Server for z/OS, 6.1 . © Copyright International Business Machines Corporation 1974, 2021. US Government Users Restricted Rights – Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp. Contents About this PDF.......................................................................................................v Chapter 1. What does security mean for CICS?....................................................... 1 Chapter 2. CICS security is a team sport.................................................................7 Chapter 3. How it works: identification in CICS.......................................................9 Identity propagation.................................................................................................................................. 15 Chapter 4. How it works: authentication in CICS...................................................19 Which authentication method can I use with CICS access methods?..................................................... 25 Passwords and passphrases..................................................................................................................... 26 PassTickets.................................................................................................................................................27 Multi-Factor Authentication (MFA)............................................................................................................28 ICRX (Extended Identity Context Reference)........................................................................................... 30 Certificates................................................................................................................................................. 30 JSON Web Token (JWT) ............................................................................................................................ 33 OAuth 2.0................................................................................................................................................... 39 OpenID Connect.........................................................................................................................................39 Kerberos.....................................................................................................................................................40 Lightweight Third-Party Authentication (LTPA).........................................................................................42 SAML...........................................................................................................................................................44 Chapter 5. How it works: authorization................................................................ 47 Transaction security...................................................................................................................................47 Resource security...................................................................................................................................... 49 Command security.....................................................................................................................................51 Intercommunication security.................................................................................................................... 53 Role authorization......................................................................................................................................56 Application-specific security (QUERY SECURITY)....................................................................................57 Surrogate security......................................................................................................................................60 Chapter 6. How it works: auditing........................................................................ 63 Chapter 7. Security for SOAP web services........................................................... 67 How it works: SOAP message security .....................................................................................................71 How it works: authentication for CICS with SOAP message security.................................................74 How it works: signing SOAP messages ............................................................................................... 75 How it works: SOAP message encryption ...........................................................................................77 Designing security for CICS web service providers.................................................................................. 79 Example: Designing a secure direct request with TLS client authentication..................................... 85 Example: Designing to assert an identity to the CICS web service provider......................................86 Example: Designing to propagate a distributed identity to the CICS web service provider.............. 87 Designing security for CICS web service requesters................................................................................ 88 Example: Designing a secure web service request with TLS client authentication........................... 90 Example: Designing to assert an identity to the CICS web service provider......................................91 Configuring SOAP message security for CICS web services.....................................................................91 Installing the prerequisites for WS-Security support..........................................................................92 Configuring the pipeline for WS-Security............................................................................................ 93 iii Configuring provider mode web services for identity propagation.....................................................95 Configuring RACF for WS-Security....................................................................................................... 98 Invoking the Trust client from a message handler..............................................................................99 Writing a custom security handler.....................................................................................................100 Chapter 8. Security for IPIC (IP interconnectivity).............................................. 103 How it works: CICS IPIC Security............................................................................................................103 How it works: IPIC connection security ........................................................................................... 103 How it works: IPIC transport security .............................................................................................. 105 How it works: IPIC link security ........................................................................................................106 How it works: IPIC user security....................................................................................................... 106 Designing security for IPIC......................................................................................................................107 Example: Designing CICS-to-CICS with an IPIC connection within a sysplex.................................109 Example: Designing CICS-to-CICS with an IPIC connection that uses TLS.....................................110 Example: Designing client-to-CICS with a trusted IPIC connection................................................ 111 Example: Designing client-to-CICS with an IPIC connection that uses TLS....................................112 Configuring security for IPIC................................................................................................................... 113 Chapter 9. Security for CICS Liberty................................................................... 115 How it works: CICS Liberty security........................................................................................................115 How it works: Securing Liberty web applications............................................................................. 119 How it works: Securing Link to Liberty applications......................................................................... 125 How it works: Securing Liberty message driven beans (MDBs)........................................................126 Designing security for CICS Liberty.........................................................................................................128 Example: Designing to secure an application with basic authentication......................................... 133 Example: Designing to secure an application with TLS client authentication..................................134 Example: Designing to secure an application with a JWT................................................................ 135 Chapter 10. Auditing CICS................................................................................
Load more

Recommended publications
  • Release 0.0.2 Hypothes.Is Project and Contributors
    The h Documentation Release 0.0.2 Hypothes.is Project and contributors Sep 27, 2021 Contents 1 Contents 3 Index 25 i ii The h Documentation, Release 0.0.2 h is the web app that serves most of the https://hypothes.is/ website, including the web annotations API at https: //hypothes.is/api/. The Hypothesis client is a browser-based annotator that is a client for h’s API, see the client’s own documentation site for docs about the client. This documentation is for: • Developers working with data stored in h • Contributors to h Contents 1 The h Documentation, Release 0.0.2 2 Contents CHAPTER 1 Contents 1.1 The Hypothesis community Please be courteous and respectful in your communication on Slack (request an invite or log in once you’ve created an account), IRC (#hypothes.is on freenode.net), the mailing list (subscribe, archive), and GitHub. Humor is appreciated, but remember that some nuance may be lost in the medium and plan accordingly. If you plan to be an active contributor please join our mailing list to coordinate development effort. This coordination helps us avoid duplicating efforts and raises the level of collaboration. For small fixes, feel free to open a pull request without any prior discussion. 1.2 Advice for publishers If you publish content on the web and want to allow people to annotate your content, the following documents will help you get started. 1.2.1 Generating authorization grant tokens Warning: This document describes an integration mechanism that is undergoing early-stage testing.
    [Show full text]
  • Hybrid Mobile Application for Project Planning System
    Master Thesis Czech Technical University in Prague Faculty of Electrical Engineering F3 Department of Computers Hybrid mobile application for project planning system Bc. Jan Teplý Supervisor: Mgr. Miroslav Blaško May 2017 ii Acknowledgements Declaration I would like to thank Mgr. Miroslav I declare that this work is all my own work Blaško and Ing. Jindřich Hašek for guid- and I have cited all sources I have used in ance in work on this thesis. And finally the bibliography. I would like to thank the CTU in Prague Prague, May 25, 2017 for being a very good alma mater. Prohlašuji, že jsem předloženou práci vypracoval samostatně, a že jsem uvedl veškerou použitou literaturu. V Praze, 25. května 2017 ..................................................... Bc. Jan Teplý iii Abstract Abstrakt Plantac is the proprietary web application Plantac je proprietární webová aplikace for project time and cost planning. Cur- pro plánování času a nákladů projektů na rently written on Java EE framework with platformě Java EE a grafickým uživatel- ZK framework for graphical user interface. ským rozhraním v frameworku ZK. Cí- The goal of this thesis is to explore the lem práce je prozkoumat možnosti pro vy- possibility of the creation of alternative tvoření alternativního multiplatformního multi-platform user interface, that enables uživatelského rozhraní, které zpřístupní chosen functions of Plantac on mobile de- vybrané funkce systému Plantac na mobil- vices even without internet connection. ních zařízeních i bez přístupu k internetu. Keywords: web, mobile, hybrid, offline, Klíčová slova: web, mobil, hybridní, Angular, Progressive apps, Cordova offline, Angular, Progressive apps, Cordova Supervisor: Mgr. Miroslav Blaško Překlad názvu: Hybridní mobilní aplikace pro systém plánování projektů iv Contents 1 Introduction 1 4.2.9 Development .
    [Show full text]
  • Top 10 Vulnerabilities OWASP
    OWASP Top 10 Vulnerabilities 2019 The de facto list of critical threats to your website. Learn what they are and how to protect your website.* *Based on the latest OWASP Top Ten list from 2017 2 The Top 10 OWASP vulnerabilities are OWASP stands for the Open Web Application 1. Injection 3 Security Project, that produces articles, 2. Broken Authentication 4 methodologies, documentation, tools, and technologies 3. Sensitive data exposure 5 4. XML External Entities (XXE) 8 in the field of web application security. 5. Broken Access control 9 6. Security misconfigurations 11 OWASP Core Purpose: Be the thriving global 7. Cross-Site Scripting (XSS) 13 community that drives visibility and evolution in 8. Insecure Deserialization 15 the safety and security of the world’s software. 9. Using Components with Known Vulnerabilities 16 10. Insufficient Logging and Monitoring 17 © 2019 Sucuri. All Rights Reserved. This ebook, “OWASP Top Ten Vulnerabilities 2019”, cites information and examples found in “Top 10-2017 Top Ten” by OWASP, used under CC BY-SA. 1. Injection An injection of code happens when an attacker sends invalid data to the web application Here is another example of an SQL injection that affected over half a million websites. with the intention to make it do something different from what the application was This code is part of the function get_products(). If attackers set arbitrary values for the designed/programmed to do. variable $limit they can modify the query in a way that can lead to a full compromise on some servers. Perhaps the most common example around this security vulnerability is the SQL query consuming untrusted data.
    [Show full text]
  • Eclipse: Разработка RCP-, Web-, Ajax- И Android-Приложений На Java
    Тимур Машнин Санкт-Петербург «БХВ-Петербург» 2013 УДК 681.3.06 ББК 32.973.26-018.2 М38 Машнин Т. С. М38 Eclipse: разработка RCP-, Web-, Ajax- и Android-приложений на Java. — СПб.: БХВ-Петербург, 2013. — 384 с.: ил. — (Профессиональное программирование) ISBN 978-5-9775-0829-2 Книга посвящена разработке в среде Eclipse широкого круга Java-приложений. Рассмотрены основы работы в среде Eclipse, использование инструментов отладки, тестирования и рефакторинга кода. Описана командная разработка приложений, их интернационализация и локализация, создание GUI-интерфейса на основе биб- лиотеки SWT и набора Java-классов JFace. Показаны особенности разработки при- ложений RCP и Android, а также Web- и Ajax-приложений на основе Eclipse- проектов RAP, GWT, Riena, SCA, Scout, WTP, DTP, BIRT. Материал книги сопро- вождается большим количеством примеров с подробным анализом исходных кодов. Для программистов УДК 681.3.06 ББК 32.973.26-018.2 Группа подготовки издания: Главный редактор Екатерина Кондукова Зам. главного редактора Игорь Шишигин Зав. редакцией Екатерина Капалыгина Редактор Анна Кузьмина Компьютерная верстка Ольги Сергиенко Корректор Зинаида Дмитриева Дизайн серии Инны Тачиной Оформление обложки Марины Дамбиевой Подписано в печать 30.09.12. 1 Формат 70 100 /16. Печать офсетная. Усл. печ. л. 30,96. Тираж 1200 экз. Заказ № "БХВ-Петербург", 191036, Санкт-Петербург, Гончарная ул., 20. Первая Академическая типография "Наука" 199034, Санкт-Петербург, 9 линия, 12/28 ISBN 978-5-9775-0829-2 © Машнин Т. С., 2013 © Оформление, издательство "БХВ-Петербург",
    [Show full text]
  • Software Engineer – Wt and Jwt
    Software Engineer – Wt and JWt Emweb is a software engineering company specialized in the development of innovative software. We are located in Herent (Leuven, Belgium) and serve customers all over the world. Emweb's major products are Wt, an open source library for the development of web applications, and Genome Detective, a software platform for microbial High Throughput Sequencing analysis. Our solutions excel in quality and efficiency, and are therefore applied in complex applications and environments. As we continuously grow, we are currently looking for new colleagues with the following profile to join our team in Herent. Your responsibility is to develop our own products, as well as to work on challenging customer projects and integrations. We are active in multiple applications domains: Web applications Bio-informatics, computational biology and molecular epidemiology Embedded software development Data Analysis, Modeling, Statistical Analysis, Digital Signal Processing Your responsibilities are: The design, development and maintenance of Wt and JWt You will regularly participate in development of our own software products, as well as projects for our customers Maintaining the quality, performance and scalability of the software Provide support and training to customers with respect to the use of Wt and JWt in their own applications (architectural questions, security analysis, bug reports, new features, …) With the following skills, you are the perfect match to complete our team: Master degree in informatics or computer
    [Show full text]
  • Jsp and Spring Mvc Skills
    edXOps BOOTCAMP edXOps.COM JSP AND SPRING MVC SKILLS 04 WEEKS PROGRAM Production-like Project 18 January 2021 Effective Date Version Change Description Reason Author Sep 18 2019 1.0.0 First version New Sato Naoki Jan 18 2021 1.0.1 Revised version Update Alex Khang Production-like Project edXOps® Bootcamp WEEK ➂ - INTEGRATION OF FRONT-END AND BACK-END DAY ➊ - INTEGRATE FRONT-END TO BACK-END CODE Move the Front-End Web pages and the Framework to the Spring MVC project. Integrate the Front-End Web pages to the Spring MVC Project. GWT and JWT Programming - Ajax Toolkit - Json Web Token - Google Web Toolkit OUTCOME: Knows how to install and use the Web toolkit of at least one of above kits and proficiency to integrate them to the front-end project. DAY ➋ - IMPLEMENTATION OF REPORT FUNCTIONALITY Install and Design Report by one of following the report platform. - JasperReport Design and Viewer. - CrystalReport Design and Viewer. Create and Run smoke test: All test cases are accepted for the the Reporting functionalities. OUTCOME: Knows how to design the Web Reports with at least one Report platform such the JasperReports software or the Crystal Reports software and integrate reports into the Web Application. DAY ➌ - IMPLEMENTATION OF EXPORT FUNCTIONALITY Design and Programming to Export the data to one of following format. - Excel Format / PDF Format / CSV Format. Create and Run smoke test: All test cases are accepted for the the Exporting functionalities. OUTCOME: Knows how to define code to export data from the Web Reports or the Web Pages to Excel or PDF format and integrate these functionality on online hosting server.
    [Show full text]
  • Hacking JSON Web Token (JWT) - 101-Writeups
    Hacking JSON Web Token (JWT) - 101-writeups ... https://medium.com/101-writeups/hacking-json... Hacking JSON Web Token (JWT) Rudra Pratap Follow May 3, 2018 · 5 min read Hey, Well this is my first writeup and there might be ton of mistakes as i go along writing it out so please give me feedback so that i can work over it. So lets start! JWT ... 0x01 JWT work�low Starting with JWT, it is a very lightweight specification 1 of 13 8/21/19, 10:35 AM Hacking JSON Web Token (JWT) - 101-writeups ... https://medium.com/101-writeups/hacking-json... This specification allows us to use JWT to pass secure and reliable information between users and servers. JWT is often used for front-end and back-end separation and can be used with the Restful API and is often used to build identity authentication mechanisms. Take an example of vimeo.com , which is one of the biggest video hosting companies as per my knowledge. ... Figure 1 2 of 13 8/21/19, 10:35 AM Hacking JSON Web Token (JWT) - 101-writeups ... https://medium.com/101-writeups/hacking-json... Figure 2 When a user enters his/her credentials, a post request is sent (check Figure 1) after which the credentials are validated. If they are a correct combo then the user is presented with response having a JWT token as seen in Figure 2. ... Example JWT : eyJraWQiOiJrZXlzLzNjM2MyZWExYzNmMTEzZjY0OWRjOTM4OW RkNzFiODUxIiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYifQ.eyJzdWIiOi JkdWJoZTEyMyJ9.XicP4pq_WIF2bAVtPmAlWIvAUad_eeBhDOQe2 MXwHrE8a7930LlfQq1lFqBs0wLMhht6Z9BQXBRos9jvQ7eumEUF WFYKRZfu9POTOEE79wxNwTxGdHc5VidvrwiytkRMtGKIyhbv68du FPI68Qnzh0z0M7t5LkEDvNivfOrxdxwb7IQsAuenKzF67Z6UArbZE8 odNZAA9IYaWHeh1b4OUG0OPM3saXYSG- Q1R5X_5nlWogHHYwy2kD9v4nk1BaQ5kHJIl8B3Nc77gVIIVvzI9N_ klPcX5xsuw9SsUfr9d99kaKyMUSXxeiZVM-7os_dw3ttz2f- TJSNI0DYprHHLFw Now whenever a user accesses something, the request which are made are slightly different having a new header authorization: jwt 3 of 13 8/21/19, 10:35 AM Hacking JSON Web Token (JWT) - 101-writeups ..
    [Show full text]
  • Openair XML API Reference Guide
    XML API Reference Guide April 10, 2021 Copyright © 2013, 2021, Oracle and/or its affiliates. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error- free. If you find any errors, please report them to us in writing. If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, then the following notice is applicable: U.S. GOVERNMENT END USERS: Oracle programs (including any operating system, integrated software, any programs embedded, installed or activated on delivered hardware, and modifications of such programs) and Oracle computer documentation or other Oracle data delivered to or accessed by U.S. Government end users are "commercial computer software" or "commercial computer software documentation" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, the use, reproduction, duplication, release, display, disclosure, modification, preparation of derivative works, and/or adaptation of i) Oracle programs (including any operating system, integrated software, any programs embedded, installed or activated on delivered hardware, and modifications of such programs), ii) Oracle computer documentation and/or iii) other Oracle data, is subject to the rights and limitations specified in the license contained in the applicable contract.
    [Show full text]
  • Add Header to Request Ajax
    Add Header To Request Ajax Roughish and teenier Rolando evidence his perisperm restrings alining taperingly. Harwell still ached molecularly while undelaying Linoel blinker that effortlessness. Swallowed Ransell pauperizing or stub some bewitchery reposefully, however English Toby dramatise famously or dissolve. The content type and customize ajax request headers indicating the ajax to request header sent message to the proper cors Controlling AJAX calls Breeze JS. If can Accept header has powerful set using this appeal Accept header with expenditure type is consecutive with the paper when virtue is called For security. I am superior to cater custom header to my jquery ajax call this pure html it works fine to add the when in aspnet project it instead working header not. This site uses internally, asynchronous computer programming and add authorization header be transmitted through monkey patch or adds cors. So we create through that specific on hand call parsing that deaf and set it in comparison easy-to-use object embedded to the jqXHR ajaxPrefilterfunction. How do airline get Ajax response? Custom jQuery AJAX Headers Zino UI. How each override the adapter headers that link sent now the ajax. Readonly attribute unsigned short readyState request undefined open. The world to add a practical advice to add condition checks if asynchronous. How we captured AJAX requests from a website tab with a. AJAX No 'Access-Control-Allow-Origin' header error despite. How both add something custom HTTP header to ajax request with. A bad check to collect custom methods in the adapter since my article. If counsel want to plague a custom header or lens of headers to an individual request body just left the headers property Request with custom header ajax url 'foobar' headers 'x-my-custom-header' 'some value' false you anytime to yield a default header or privacy of headers to every crime then use.
    [Show full text]
  • PHP and LARAVEL MVC SKILLS 04 WEEKS PROGRAM Production-Like Project 18 January 2021
    edXOps BOOTCAMP edXOps.COM PHP AND LARAVEL MVC SKILLS 04 WEEKS PROGRAM Production-like Project 18 January 2021 Effective Date Version Change Description Reason Author Sep 18 2019 1.0.0 First version New Jesse Torres Jan 18 2021 1.0.1 Revised version Update Alex Khang Production-like Project edXOps® Bootcamp WEEK ➂ - INTEGRATION OF FRONT-END AND BACK-END DAY ➊ - INTEGRATE FRONT-END TO BACK-END CODE Move Front-End Web pages and Framework to Laravel MVC project. Integrate Front-End Web pages to Laravel MVC Project. GWT and JWT Programming - Ajax Toolkit (AJT) - Json Web Token (JWT) - Google Web Toolkit (GWT) OUTCOME: Knows how to install and use Web toolkit of at least one of above kits and proficiency to integrate them to front-end project. DAY ➋ - IMPLEMENTATION OF REPORT FUNCTIONALITY Install and Design Report by one of following report platform. - JasperReport Design and Viewer. - CrystalReport Design and Viewer. Create and Run smoke test: All test cases are accepted for the Reporting functionalities. OUTCOME: Knows how to design Web Reports with at least one Report platform such JasperReports or Crystal Reports and integrate reports into Web Application. DAY ➌ - IMPLEMENTATION OF EXPORT FUNCTIONALITY Design and Programming to Export Data to one of following format. - Excel Format / PDF Format / CSV Format. Create and Run smoke test: All test cases are accepted for the Exporting functionalities. OUTCOME: Knows how to define code to export data from Web Reports or Web Pages to Excel or PDF format and integrate these functionality on online hosting server. DAY ➍ - PAGING AND NAVIGATION Implementation of Navigation with Paging on Back-Code.
    [Show full text]
  • Precompiler Session 01 - Tuesday 8:00 Machine Learning: Taking Your ML Models to Android and Ios Wes Eklund
    PreCompiler Session 01 - Tuesday 8:00 Machine Learning: Taking your ML Models to Android and iOS Wes Eklund Once you've developed a kickass Machine Learning model, you need a way to get that model to your computing devices (phones) to start doing your predictions! Most Machine Learning projects in production will 'train' the model on cloud servers, then 'deploy' the model to an API server or mobile device. This session will introduce the attendee on using TensorFlow Serving and Apple CoreML to deploy Machine Learning models to a mobile app. Prerequisites: Download Here Build a Natural Language Slack Bot for your Dev Team Michael Perry Many project teams use Slack as a means of communication with one another. Why not also use it to communicate with your infrastructure? Invite a helper into your conversation that can perform routine tasks tirelessly, conversationally, and interactively. In this 4 hour workshop, you will build a Slack bot that understands natural language and integrates with your DevOps pipeline. You will use the Slack Events API to receive messages, and the Slack Web API to send them. You will use LUIS to interpret language and extract intent. You will execute actions against the Visual Studio Team Services Web API in response to user requests, and subscribe to Webhooks to notify your team of important events. In the end, you will have a new member of your team who can help you with your build and release pipeline. Workshop outline: Slack API Authorization - OAuth and API key verification Events API - respond to posts Web
    [Show full text]
  • On the Security of Single Sign-On
    On the Security of Single Sign-On Vladislav Mladenov (Place of birth: Pleven/Bulgaria) [email protected] 30th June 2017 Ruhr-University Bochum Horst G¨ortz Institute for IT-Security Chair for Network and Data Security Dissertation zur Erlangung des Grades eines Doktor-Ingenieurs der Fakult¨atf¨urElektrotechnik und Informationstechnik an der Ruhr-Universit¨atBochum First Supervisor: Prof. Dr. rer. nat. J¨org Schwenk Second Supervisor: Prof. Dr.-Ing. Felix Freiling www.nds.rub.de Abstract Single Sign-On (SSO) is a concept of delegated authentication, where an End- User authenticates only once at a central entity called Identity Provider (IdP) and afterwards logs in at multiple Service Providers (SPs) without reauthenti- cation. For this purpose, the IdP issues an authentication token, which is sent to the SP and must be verified. There exist different SSO protocols, which are implemented as open source libraries or integrated in commercial products. Google, Facebook, Microsoft and PayPal belong to the most popular SSO IdPs. This thesis provides a comprehensive security evaluation of the most popular and widely deployed SSO protocols: OpenID Connect, OpenID, and SAML. A starting point for this research is the development of a new concept called malicious IdP, where a maliciously acting IdP is used to attack SSO. Generic attack classes are developed and categorized according to the requirements, goals, and impact. These attack classes are adapted to different SSO proto- cols, which lead to the discovery of security critical vulnerabilities in Software- as-a-Service Cloud Providers, eCommerce products, web-based news portals, Content-Management systems, and open source implementations.
    [Show full text]