NGA International Data Security and Forensic Practice, in partnership with PentaSafe, have launched a security, auditing and intrusion detection solution for JD Edwards (JDE) enterprise software on the AS/400.
"Application security alone is not enough. Strong security policies needs to be in place at the operating system, library and file levels. In other words, object level security, which means business-critical data are at risk to exposure or corruption. This comes into play especially when users open their AS/400 with ODBC, FTP or other TCP/IP features," explained NGA partner Dennis Germishuys.
PentaSafe`s JD Edwards Software Application Module (JDE-SAM) is designed to help secure JDE data both from outside and inside the organisation.
"Menu level security is not sufficient in today`s computing environment because unauthorised users can gain access to confidential data, functions or production objects. IBM has recently specified that the only proper security is operating system level security," he said.
"JDE-SAM enables management to audit user access, the menus or functions they can access and discover which users have inappropriate rights. It extends the functionality of the Pentasafe PSAudit and PSSecure modules so management can quickly and conveniently check and control the accessibility of the JD Edwards data down to the object level," noted Germishuys.
Inconsistencies between AS/400 security settings and JD Edwards settings can also be identified. For example, users may gain command line access through JDE that they would not normally have through AS/400 settings.
JDE-SAM manages access to JD Edwards files, providing control over access to JDE application files or databases when used outside of the JDE application. PentaSafe`s Object Authority Templates will allow management to quickly and easily put controls in place that will prevent unauthorised or accidental access or changes to these types of files that could cost money and damage employee moral.
JDE-SAM also tracks and secures all remote accesses to JD Edwards files down to object level. The option is available to track or restrict the access of any user, including those who have authority to production data.
Jorge de Campos, marketing executive for TCM, the largest AS/400 supplier in the country, said security concerns are magnified because so much is at stake. "One only has to look at the recent and much publicised security violations that have occurred in government and corporate installations."
"With the advent of e-commerce and e-business solutions, administrators will find it increasingly difficult to ensure that all `back doors` and access keys and/or passwords are monitored and adequately controlled.
"The PentaSafe software works inside the system, beyond the firewall and continuously monitors system security features, programmer access, critical files and files for unauthorised tampering," he added.
Share
