DOCSLIB.ORG

IBM Security Access Manager for Enterprise Single Sign-On Version 8.2 with IMS Server Interim Fix 4 and Accessagent Fix Pack 22 Security Target

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
IBM Security Access Manager for Enterprise Single Sign-On Version 8.2 with IMS Server Interim Fix 4 and Accessagent Fix Pack 22 Security Target IBM Security Access Manager for Enterprise Single Sign-On Version 8.2 with IMS Server Interim Fix 4 and AccessAgent Fix Pack 22 Security Target Version: 1.19 Status: Released Last Update: 2014-03-05 International Business Machines, Corporation IBM Security Access Manager for Enterprise Single Sign-On Version 8.2 with IMS Server Interim Fix 4 and AccessAgent Fix Pack 22 Security Target Trademarks IBM and the IBM logo are trademarks or registered trademarks of International Business Machines Corporation in the United States, other countries, or both. The following terms are trademarks of International Business Machines Corporation in the United States, other countries, or both: ● DB2® ● WebSphere® The following terms are trademarks of Oracle Corporation: ● Java® ● Oracle® The following terms are trademarks of Microsoft Corporation: ● Active Directory® ● SQL Server® ● Windows® ● Windows Server® Legal Notice This document is provided AS IS with no express or implied warranties. Use the information in this document at your own risk. This document may be reproduced or distributed in any form without prior permission provided the copyright notice is retained on all copies. Modified versions of this document may be freely distributed provided that they are clearly identified as such, and this copyright is included intact. Revision History Revision Date Author(s) Changes to Previous Revision 1.19 2014-03-05 Scott Chapman Initial ST. Version: 1.19 Page 2 of 46 Last update: 2014-03-05 Copyright © 2009 - 2014 by atsec information security and IBM International Business Machines, Corporation IBM Security Access Manager for Enterprise Single Sign-On Version 8.2 with IMS Server Interim Fix 4 and AccessAgent Fix Pack 22 Security Target Table of Contents 1 Introduction .................................................................................................... 7 1.1 Security Target Identification ......................................................................................... 7 1.2 TOE Identification .......................................................................................................... 7 1.3 TOE Type ....................................................................................................................... 7 1.4 TOE Overview ................................................................................................................ 7 1.4.1 Required non-TOE software .................................................................................. 7 1.4.2 Intended method of use ........................................................................................ 8 1.4.3 Major security features ......................................................................................... 8 1.5 TOE Description ............................................................................................................. 8 1.5.1 Introduction ........................................................................................................... 8 1.5.2 Architecture .......................................................................................................... 9 1.5.2.1 Communications ........................................................................................... 9 1.5.2.2 The IMS Server ........................................................................................... 10 1.5.2.3 AccessAgent ............................................................................................... 11 1.5.2.4 AccessAdmin .............................................................................................. 12 1.5.2.5 AccessAssistant .......................................................................................... 12 1.5.2.6 IMS Configuration Utility ............................................................................. 13 1.5.3 TOE boundaries ................................................................................................... 13 1.5.3.1 Physical ...................................................................................................... 13 1.5.3.2 Logical ........................................................................................................ 14 1.5.3.3 Evaluated configuration ............................................................................. 14 1.5.4 Security policy model .......................................................................................... 15 2 CC Conformance Claim ................................................................................... 16 3 Security Problem Definition ............................................................................ 17 3.1 Threat Environment ..................................................................................................... 17 3.1.1 Threats countered by the TOE ............................................................................ 17 3.2 Assumptions ................................................................................................................ 18 3.2.1 Environment of use of the TOE ........................................................................... 18 3.2.1.1 Physical ...................................................................................................... 18 3.2.1.2 Personnel .................................................................................................... 18 3.2.1.3 Logical ........................................................................................................ 18 3.3 Organizational Security Policies ................................................................................... 19 4 Security Objectives ........................................................................................ 20 4.1 Objectives for the TOE ................................................................................................. 20 4.2 Objectives for the Operational Environment ................................................................ 20 4.3 Security Objectives Rationale ...................................................................................... 21 4.3.1 Security objectives coverage .............................................................................. 21 4.3.2 Security objectives sufficiency ............................................................................ 22 5 Extended Components Definition .................................................................... 26 6 Security Requirements ................................................................................... 27 6.1 TOE Security Functional Requirements ........................................................................ 27 Version: 1.19 Page 3 of 46 Last update: 2014-03-05 Copyright © 2009 - 2014 by atsec information security and IBM International Business Machines, Corporation IBM Security Access Manager for Enterprise Single Sign-On Version 8.2 with IMS Server Interim Fix 4 and AccessAgent Fix Pack 22 Security Target 6.1.1 Security audit (FAU) ............................................................................................ 28 6.1.1.1 Audit data generation (FAU_GEN.1) .......................................................... 28 6.1.1.2 User identity association (FAU_GEN.2) ...................................................... 28 6.1.1.3 Audit review (FAU_SAR.1) .......................................................................... 28 6.1.1.4 Restricted audit review (FAU_SAR.2) ......................................................... 28 6.1.1.5 Protected audit trail storage (FAU_STG.1) ................................................. 29 6.1.2 User data protection (FDP) .................................................................................. 29 6.1.2.1 Subset access control (FDP_ACC.2) ........................................................... 29 6.1.2.2 Security attribute based access control (FDP_ACF.1) ................................ 30 6.1.3 Identification and authentication (FIA) ................................................................ 30 6.1.3.1 User attribute definition (FIA_ATD.1) ......................................................... 30 6.1.3.2 Verification of secrets (FIA_SOS.1) ............................................................ 30 6.1.3.3 User authentication before any action (FIA_UAU.2) ................................... 31 6.1.3.4 User identification before any action (FIA_UID.2) ...................................... 31 6.1.3.5 User-subject binding (FIA_USB.1) .............................................................. 31 6.1.4 Security management (FMT) ............................................................................... 31 6.1.4.1 Management of security attributes (FMT_MSA.1) ...................................... 31 6.1.4.2 Static attribute initialisation (FMT_MSA.3) ................................................. 32 6.1.4.3 Management of TSF data (FMT_MTD.1) ..................................................... 32 6.1.4.4 Specification of management functions (FMT_SMF.1) ............................... 32 6.1.4.5 Security roles (FMT_SMR.1) ....................................................................... 32 6.2 Security Functional Requirements Rationale ............................................................... 33 6.2.1 Security requirements coverage ......................................................................... 33 6.2.2 Security requirements sufficiency ....................................................................... 33 6.2.3 Security
Load more

Recommended publications
  • Mysql Enterprise Monitor 2.0 Mysql Enterprise Monitor 2.0 Manual
    MySQL Enterprise Monitor 2.0 MySQL Enterprise Monitor 2.0 Manual Copyright © 2005, 2011, Oracle and/or its affiliates. All rights reserved. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing. If this software or related documentation is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, the use, duplication, disclosure, modification, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle USA, Inc., 500 Oracle Parkway, Redwood City, CA 94065.
    [Show full text]
  • Enhance Your COBOL Applications with C-Treertg COBOL Edition
    COBOL Edition Enhance Your COBOL Applications with c-treeRTG COBOL Edition c-treeRTG COBOL Edition is a plug & play option that empowers COBOL applications by replacing the native file system of COBOL compilers with a more robust, comprehensive, solution. • FairCom's c-treeRTG COBOL Edition • Implementing RTG COBOL Edition modernizes record-oriented COBOL requires no changes to existing COBOL applications by providing a bridge code, no duplication of data, and no between COBOL and SQL standards, significant architectural changes. Existing thereby opening up their COBOL data to applications benefit from a new file system the web, cloud, and mobile devices. offering transaction processing, enhanced scalability, and recoverability while greatly • RTG COBOL Edition allows users to expanding data availability. leverage and preserve their investments in COBOL by integrating their existing • RTG COBOL Edition brings instant value COBOL applications with a modern and lowers risk by enabling users to database that preserves the performance immediately start a phasing migration and benefits of COBOL, while conforming project to a new COBOL platform instead to industry standards. of a "big bang," high risk, all-or-nothing conversion Seamless Solution for COBOL Applications This plug & play solution allows your COBOL applications to immediately benefit from the following: • Robust data management: c-treeRTG • User access: Control user access and COBOL Edition Server provides several high- permissions, view current connections, and availability features, such as full transaction see files that are being accessed by specific log, automatic recovery, and limited dynamic users to prevent ghost locks. dump for integrated backup capabilities. • Security: Natively implemented data • Full administrative tools set: Allows you to encryption ranges from simple masking to monitor, manage, configure, and fine-tune advanced encryption.
    [Show full text]
  • Wwpass External Authentication Solution for IBM Security Access Manager 8.0
    WWPass External Authentication Solution for IBM Security Access Manager 8.0 Setup guide Enhance your IBM Security Access Manager for Web with the WWPass hardware authentication IBM Security Access Manager (ISAM) for Web is essentially a "reverse Web-proxy" which guards access to a number of enterprise Web services. In its basic form, users authenticate into ISAM protected resources with login / password pairs. This kind of authentication is vulnerable to multiple well-known attacks. At the same time user names and passwords are always a compromise between simplicity and security. ISAM comes with rigorous password policy, thus insisting on secure and hard to remember passwords. WWPass External Authentication Solution (EAS) provides strong hardware authentication and at the same time removes username/password pairs completely. WWPass EAS is a Web service which utilizes ISAM External Authentication Interface (EAI) and is to be installed and configured as an ISAM External Authenticator junction. -- When user authenticates at ISAM server, the request is transparently rerouted to WWPass Web application. On success, ISAM gets user DN (distinguished name) and forwards user to destination Web resource. ISAM / WWPass external authentication architecture WWPass Corporation 1 ISAM / WWPass external authentication message flow 1. User tries to access protected resource 2. ISAM WebSeal intercepts and redirects user request to WWPass authentication server. User is presented WWPass web page. 3. User clicks on "Login with WWPass" button and starts WWPass
    [Show full text]
  • Mysql Storage Engines Data in Mysql Is Stored in Files (Or Memory) Using a Variety of Different Techniques
    MySQL Storage Engines Data in MySQL is stored in files (or memory) using a variety of different techniques. Each of these techniques employs different storage mechanisms, indexing facilities, locking levels and ultimately provides a range of different functions and capabilities. By choosing a different technique you can gain additional speed or functionality benefits that will improve the overall functionality of your application. For example, if you work with a large amount of temporary data, you may want to make use of the MEMORY storage engine, which stores all of the table data in memory. Alternatively, you may want a database that supports transactions (to ensure data resilience). Each of these different techniques and suites of functionality within the MySQL system is referred to as a storage engine (also known as a table type). By default, MySQL comes with a number of different storage engines pre-configured and enabled in the MySQL server. You can select the storage engine to use on a server, database and even table basis, providing you with the maximum amount of flexibility when it comes to choosing how your information is stored, how it is indexed and what combination of performance and functionality you want to use with your data. This flexibility to choose how your data is stored and indexed is a major reason why MySQL is so popular; other database systems, including most of the commercial options, support only a single type of database storage. Unfortunately the 'one size fits all approach' in these other solutions means that either you sacrifice performance for functionality, or have to spend hours or even days finely tuning your database.
    [Show full text]
  • Introduction to DISAM & Migration Guidelines
    COBOL-IT Compiler Suite Getting Started with DISAM Migration Guidelines Version 4.1 COBOL-IT® Compiler Suite Enterprise Edition Introduction to DISAM & Migration Guidelines Version 4.1 Page 1 COBOL-IT Compiler Suite Getting Started with DISAM Migration Guidelines Version 4.1 Contents ACKNOWLEDGMENT ........................................................................................................ 3 COMPILER, RUNTIME, AND DEBUGGER TOPICS .......................................................... 4 Introduction ...................................................................................................................................................................... 4 COBOL-IT License terms ................................................................................................................................................ 4 INTRODUCTION TO DISAM & MIGRATION GUIDELINES ............................................... 7 Overview ............................................................................................................................................................................ 7 CONVERSION GUIDELINES .............................................................................................. 7 Using COB_EXTFH to manage your conversion .......................................................................................................... 8 Data used in our examples ..............................................................................................................................................
    [Show full text]
  • Systems OS/VS Virtual Storage Access Method (VSAM) Planning Guide
    GC26-3799-0 OS/VS Virtual Storage Access Method (VSAM) Systems Planning Guide First Edition (July 1972) This edition applies to release 2 of OS/VS1, to release 1 of OS/VS2, and to all subsequent releases until otherwise indicated in new editions or technical newsletters. Changes may be made to the information in this publication at any time; before using this publication in connection with the operation of IBM systems, consult the System/360 and System/370 Bibliography~ GA22-6822, and the latest System/360 and System/3 70 SRL Newsletter~ GN20-0360, for the editions that are applicable and current. Requests for copies of IBM publications should be made to your IBM representative or to the IBM branch office serving your locality. Forms for readers' comments are provided at the back of this publication. If the forms have been removed, comments may be addressed to IBM Corporation, Programming Publications, Department D78, Monterey and Cottle Roads, San Jose, California 95114. Comments become the property of IBM. © Copyright International Business Machines Corporation 1972 USING THIS PUBLICATION This publication is intended to enable prospective users of VSAM (virtual storage access method), an access method of OS/VS (operating system/virtual storage), to prepare for using VSAM. The intended audience is data-processing managers whose decisions will influence the use of VSAM, system and application programmers who will make detailed preparations, and others seeking an introduction to VSAM. This planning guide has six chapters: "Introducing VSAM" outlines how VSAM meets the requirements of an access method in today's data-processing environment.
    [Show full text]
  • Isam to Sql Migration
    Contents Introduction ISAM TO SQL MIGRATION A Case for Relational Databases Enabling ISAM-based Applications to work Dilemma for Developers and Users with relational databases without source level Mertech’s Solution changes Benefits of Using Mertech’s Solution Contact Information © 2013 Mertech Data Systems, Inc. All Rights Reserved. This document is for informational purposes only. Mertech makes no warranties, expressed or implied, in this document. Btrieve and Pervasive.SQL are registered trademarks of Pervasive Software Inc. IBM is a registered trademark of International Business Machines Corporation. Magic is a registered trademark of Magic Software Enterprises. Mertech Data, BTR2SQL, and ISDBC are trademarks of Mertech Data Systems, Inc. Microsoft, Windows, and SQL Server are registered trademarks of Microsoft Corporation. Oracle, SQL*Net, and MySQL are registered trademarks of Oracle Corporation. PostgreSQL is a registered trademark of PostgreSQL Global Development Group. Other trademarks and trade names mentioned herein are the property of their respective owners. Introduction The objective of this white paper is to familiarize the reader with Mertech Data Systems’ product offering, BTR2SQL, a set of data migration tools and high-performance database drivers that allow quick and efficient migration of applications developed around Pervasive Software’s Btrieve® transactional engine to an SQL Server backend. Background The Internet revolution has underscored the importance of making data available reliably and at a high speed to an ever-growing user base. Corporations continue to consolidate their data into single, corporate-wide databases so that information about its customers, products, and market can be easily extracted and manipulated and at the same time allow customers and their mobile workforce to update and retrieve information anytime, anywhere.
    [Show full text]
  • ISAM ODBC Driver the Easysoft ODBC-ISAM Driver Makes Your ISAM Data Fully Accessible from SQL, Making It Easy for End Users to Retrieve, Update and Analyse Their Data
    Easysoft Limited is the leading supplier of data access middleware solutions PRODUCT DATASHEET ISAM ODBC Driver The Easysoft ODBC-ISAM Driver makes your ISAM data fully accessible from SQL, making it easy for end users to retrieve, update and analyse their data. Our customers have found that our ISAM ODBC Driver offers them the very best solution for formatting and analysing data, and delivering it into a vast array of applications. Key Points FREE Trial ODBC Driver for C-ISAM and D-ISAM Files 14-Day (no obligation) trial The Easysoft ODBC-ISAM Driver provides relational, real-time, read/write access to C-ISAM available. and D-ISAM data for ODBC-enabled applications on Windows, UNIX and Linux. Updates The Easysoft ODBC-ISAM Driver makes your ISAM data fully accessible from SQL, making it We deliver platform updates to easy for end users to retrieve, update and analyse the data. our Drivers faster than any other third-party developer. Uses for our ISAM ODBC Driver With your business in mind Our customers have successfully used the Easysoft ODBC-ISAM Driver to: When it comes to meeting data demands while facing ✓ Analyse, format and deliver ISAM data in MS Excel, Crystal Reports and BusinessObjects. tighter IT budgets, and ✓ Provide a user friendly, graphical interface to ISAM data by developing custom front exponential data growth, you ends in programming languages such as Microsoft Visual Basic, C++, C# and Borland could use some help from Delphi. Easysoft Limited. ✓ Publish ISAM data in web pages by accessing ISAM files through ODBC from PHP/Perl/ASP running under a web server.
    [Show full text]
  • MVS JCL User's Guide
    z/OS Version 2 Release 3 MVS JCL User's Guide IBM SA23-1386-30 Note Before using this information and the product it supports, read the information in “Notices” on page 261. This edition applies to Version 2 Release 3 of z/OS (5650-ZOS) and to all subsequent releases and modifications until otherwise indicated in new editions. Last updated: 2019-02-16 © Copyright International Business Machines Corporation 1988, 2017. US Government Users Restricted Rights – Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp. Contents List of Figures....................................................................................................... xi List of Tables.......................................................................................................xiii About this document............................................................................................xv Who should use this document..................................................................................................................xv Where to find more information................................................................................................................. xv How to send your comments to IBM.................................................................... xvii If you have a technical problem............................................................................................................... xvii Summary of changes........................................................................................
    [Show full text]
  • An Experiment: a File Management System That Simulates ISAM (Indexed Sequential Access Method)
    Proceedings of Student/Faculty Research Day, CSIS, Pace University, May 5th, 2006 An Experiment: A File Management System that Simulates ISAM (Indexed Sequential Access Method) Roy Baksh and Dr. Ronald Frank Computer Science Department, Pace University 1 Martine Avenue, White Plains, NY 10606, USA [email protected] Abstract The Microsoft Access database consists of eight Indexed Sequential Access Method (ISAM) is a tables. These tables are as follows: management system created by IBM to efficiently retrieve information. There are two 1. ARCHIVED_FILES – Stores all modes of operation: random access and archived file information. sequential access. Random access of 2. ARCHIVED_LOCATIONS – Groups information is retrieved with an index that is all archived files by drawer number. defined by different records and sequential 3. CATEGORIES – Groups all files by access retrieves information in the order category. entered [1].” ISAM is essential in creating 4. FILES – Stores all file information. filing systems, because of the important 5. LOCATIONS – Groups all files by functions that it provides: 1) searching, 2) drawer number. editing, 3) deleting, and 4) inserting records. 6. PASSWORD – Stores the current This system gives insight into the functions and database maintenance module password. capabilities of a program that transforms a 7. TEMP – Used to store search results and labor intensive operation into an efficient way then perform narrow search. Table of storing and retrieving information. It also TEMP is the same as table provides information on the relevance, TEMP_COPY. usefulness, and methodology of ISAM. 8. TEMP_COPY – Used to store search results and then perform narrow search. Keywords Table TEMP is the same as table TEMP_COPY.
    [Show full text]
  • CONNX for C-ISAM
    CONNX for C-ISAM DATA SHEET C-ISAM CONNX DB Adapter for C-ISAM The CONNX for C-ISAM module provides secure, real-time, read/write access to C-ISAM data sources on Windows, Solaris, HP-UX, AIX, Linux and other UNIX flavors. In conjunction with other CONNX modules, you can perform seamless joins between C-ISAM and most other databases. Join C-ISAM with Multiple Data Conversions CONNX, CONNX for C-ISAM has been Data Sources tested with Microsoft Excel, Microsoft Visu- CONNX supports over 600 data types and al Studio, including Visual Basic/C++, etc., In conjunction with other products in the performs bi-directional data conversions for Delphi, PowerBuilder, Impromptu, Report- CONNX suite, you can perform seamless data updates and retrieves. NET, Lotus Approach, Crystal Reports and joins between two or more supported dis- vendors such as Cognos and Business parate databases using ODBC, OLE DB, Metadata Import Objects. CONNX for Access also supports .NET and JDBC. CONNX for C-ISAM ac- CONNX for C-ISAM imports C-ISAM ADO and ASP.NET, and JDBC is used cess is fast and efficient. With CONNX, a metadata directly from COBOL copybooks, with Websphere and Apache Tomcat. single metadata model can be created that Powerhouse PDLs, and a CONNX Text spans all enterprise data sources and ap- Specification fi le format into a CONNX Compliance plications requiring data access. The result Data Dictionary file (CDD). is an enterprise-wide view of data that pro- ODBC Full Compliance (level 2) ; JDBC Type 3 Driver; OLE DB 2.5 Driver; NET 2.0 vides a reusable standards-based frame- Occur Clauses Driver and above work for information access.
    [Show full text]
  • Progress Data Sheet
    DATA SHEET www.progress.com ACCESS ISAM FILE DATABASES INTRODUCTION Open Database Connectivity (ODBC) compliant access to data has become a primary HIGHLIGHTS: requirement by end users for vendors supplying applications containing data. It is Quickly implement an becoming even more crucial as corporate organizations accelerate the deployment of interface to Indexed client/server computing. Widely used tools such as word processors, spreadsheets and Sequential Access database application development tools are ODBC enabled and they provide means of Management (ISAM) Files building powerful end-user applications quickly through ODBC access. Execute SQL statements Many vertical applications use ISAM (Indexed Sequential Access Management) type of Formulate queries in the files for the storage and management of data. These applications require all data access language of your tool to be performed using customized programs and tend to exist on SCO UNIX, VAX/VMS, Alpha/ OpenVMS or Windows NT type of platforms. End users are interested in accessing Implement business rules this information from the desktop for reporting and application. More recently, the ability to make this information available on the web provides a new paradigm for data access and distribution. In order to make this information easily accessible and usable, one needs a software infrastructure that: Supports access to information stored in proprietary databases from standard desktop tools like Microsoft Access, PowerBuilder, Visual Basic, Crystal Reports and many other tools. Today this means ODBC and JDBC compatible access. Allows you to quickly develop client applications for the PC environment using any of the hundreds of desktop tools. Can be developed in a very short time without becoming an ODBC, JDBC, OLE DB or SQL expert.
    [Show full text]