The IBM large-scale mainframe system software, although one of the most stable and certainly the most long-lived of such systems, undergoes constant change and continuous updates. It was known as MVS for many years, until recently it was OS/390 and now is z/OS. The need for security and audit professionals to update their knowledge to correspond to the current hardware and software levels is more pronounced than ever before. This publication deals with those concepts, components and functions of OS/390 and z/OS that are deemed to be of primary relevance in terms of the security and audit issues. The publication provides a detailed focus on issues such as: * Business drivers and technology considerations * System initialization, security functions, audit tools and methods * Detailed descriptions of new components and functions * Recently added functions, mainly those that permit the use of the Internet, and UNIX functions in the OS/390 environment * Detailed table listings and suggested approaches for testing * The suggested framework for properly controlled and successful implementation * An Internal control questionnaire and detailed audit program. Call +1.847.253.1545 ext. 401, visit www.isaca.org/bookstore or e-mail [email protected] for more information.

Every organization has a core set of mission-critical data that must be protected. Security lapses and failures are not simply disruptions—they can be catastrophic events, and the consequences can be felt across the entire organization. As a result, security administrators face serious challenges in protecting the company's sensitive data. IT staff are challenged to provide detailed audit and controls documentation at a time when they are already facing increasing demands on their time, due to events such as mergers, reorganizations, and other changes. Many organizations do not have enough experienced mainframe security administrators to meet these objectives, and expanding employee skillsets with low-level mainframe security technologies can be time-consuming. The IBM® Security zSecure suite consists of multiple components designed to help you administer your mainframe security server, monitor for threats, audit usage and configurations, and enforce policy compliance. Administration, provisioning, and management components can significantly reduce administration, contributing to improved productivity, faster response time, and reduced training time needed for new administrators. This IBM Redbooks® publication is a valuable resource for security officers, administrators, and architects who wish to better understand their mainframe security solutions.

IBM® DB2® 9 and 10 for z/OS® have added functions in the areas of security, regulatory compliance, and audit capability that provide solutions for the most compelling requirements. DB2 10 enhances the DB2 9 role-based security with additional administrative and other finer-grained authorities and privileges. This authority granularity helps separate administration and data access that provide only the minimum appropriate authority. The authority profiles provide better separation of duties while limiting or eliminating blanket authority over all aspects of a table and its data. In addition, DB2 10 provides a set of criteria for auditing for the possible abuse and overlapping of authorities within a system. In DB2 10, improvements to security and regulatory compliance focus on data retention and protecting sensitive data from privileged users and administrators. Improvements also help to separate security administration from database administration. DB2 10 also lets administrators enable security on a particular column or particular row in the database complementing the privilege model. This IBM Redbooks® publication provides a detailed description of DB2 10 security functions from the implementation and usage point of view. It is intended to be used by database, audit, and security administrators.

Considered the bible of the IBM zSeries and S/390 world, this new edition closely examines the role large computers will play in the new century. All the new hardware models and operating system products—Linux, VSE, MVS, VM, AIX, and Open Edition—are now available for the zSeries and are fully explained, as are critical business issues such as cost justification, lease versus purchase, support, security, and maintenance. Hypothetical small, medium, and large businesses are described and then outfitted with the appropriate zSeries solution. This replaces 1885068700.

This document, which focuses on the Linux security issues for one of the more popular versions of Linux, Red Hat version 9/Fedora, provides a standard reference for Linux security controls and their audit for security administrators, security professionals and information systems auditors. It provides the following guidance to IT management: * The business and technology drivers for Linux * The vulnerabilities of the Linux operating system * Risk management issues with an action-oriented perspective * Linux security software * How to secure Linux installations to fulfill the control objectives of two well-known standards-COBIT and ISO 17799 * Detailed internal control questionnaires. Call +1.847.253.1545 ext. 401, visit www.isaca.org/bookstore or e-mail [email protected] for more information.