Information on securing
CA Endevor SCM
To provide a comprehensive security program for
CA Endevor SCM
Change Manager, address security issues in two essential areas: data set security and functional security.
This figure depicts the relationship between
CA Endevor SCM
and functional and data set security.
This figure illustrates the available security options.
As previously illustrated,
CA Endevor SCM
uses one of the following functional security options: native security tables or External Security Interface (ESI).
Data Set Security Types
CA Endevor SCM
provide data set security. Data set security is performed by a site security package, such as:
  • CA ACF2 for z/OS
  • CA Top Secret for z/OS
  • RACF
Data set security involves preventing unauthorized access to the data sets that
CA Endevor SCM
uses. Two approaches are available for controlling access to your physical data sets:
  • Program path protection
    Gives the
    CA Endevor SCM
    system access to the data sets it maintains. Use this product to perform maintenance on these data sets.
  • Standard data set security
    Gives users direct access to data sets maintained by
    CA Endevor SCM
    . Although unauthorized access to data sets is prevented, authorized users can maintain these data sets without going through this product.
Implementing data set security in addition to functional security is recommended to control access to data sets by
CA Endevor SCM
Functional Security
Functional security involves protecting
CA Endevor SCM
inventory functions from unauthorized access. These functions include access to menu options, the ability to perform certain actions against certain inventory areas, and other secured
CA Endevor SCM
Functional security is provided by
CA Endevor SCM
, unlike data set security. Choose between one of two methods for providing functional security:
  • Native Security Tables
    Control environment access, primary and foreground menu options, and action authorization.
  • External Security Interface (ESI)
    Controls environment access, primary and foreground menu options, action authorization, package actions, and concurrent action processing authorization. This tool lets you store security rules under your site security package. In addition, ESI lets you customize your functional security capabilities.
Security Control Points
During processing,
CA Endevor SCM
performs security checks to allow or deny a user access to certain inventory areas and inventory actions. These checkpoints are referred to as
security control points.
The security control points listed determine the appropriate level of access to system inventories and functions:
  • Environment Selection
    Verifies your access to a requested environment.
  • Primary Options
    Verifies your access to operations appearing in the Primary Options menu.
  • Foreground Options
    Verifies your access to actions available on the Foreground Options menu.
  • Action Initiation
    Verifies your access to actions such as DISPLAY, ADD/UPDATE, RETRIEVE, or GENERATE.
  • Package Actions
    Verifies user access to package actions such as CREATE, CAST, DYNAMIC, REVIEW, and EXECUTE (applies to ESI only).
  • Concurrent Action Processing
    Verifies user access to request concurrent action processing.
When security control points are reached,
CA Endevor SCM
checks access privileges that are defined in one of the following security configurations:
  • Native security tables
  • ESI, interfacing with an external security product such as CA ACF2, CA Top Secret, RACF.
For example, when
CA Endevor SCM
reaches a security control point, the system reviews the native security tables. The system determines whether a user is allowed to perform certain inventory actions against a portion of the inventory.
CA Endevor SCM
hides inventory elements the user is not permitted to access and functions the user is not allowed to perform. In this way, ESI allows you to customize your functional security capabilities.
Native Security
Native security uses the following three security tables to record security rules for access to inventory levels and functions:
  • Access Security Table (one for an installation)
    Defines the environments to which you have access.
  • User Security Table (one for an environment)
    Defines the menu options available to you after access to an environment is obtained. Further, this table defines actions that are allowed within the environment, by user, for each system and subsystem.
  • Resource Security Table (one for an environment)
    Enforces naming conventions at the system/subsystem and element level.
The following figure shows how control points can control access to
CA Endevor SCM
processing functions by checking native security tables.
This figure shows how control points can control access to processing functions.
As previously illustrated, upon entry into the system, your access to
CA Endevor SCM
functions is controlled by
CA Endevor SCM
Security Tables or the
CA Endevor SCM
(ESI). Site security provides protection of system data sets.
External Security Interface (ESI)
ESI is an optional feature that lets you secure
CA Endevor SCM
 access and action functions through IBM System Authorization Facility (SAF), using the site security package on your system. ESI does so by letting you define the rules for functional security in your site security package (CA ACF2, CA Top Secret, RACF) rather than in the native tables that are supplied with
CA Endevor SCM
. For more information about how to enable and use ESI, see Enabling External Security Interface (ESI).
The following diagram shows how ESI interacts with site security packages:
This diagram shows how ESI interacts with site security packages.
If ESI is enabled, security rules must be defined to the site security package. In the previous diagram,
CA Endevor SCM
uses IBM's System Authorization Facility (SAF) calls to query the installed security package instead of using native security tables.
Selecting Your Security Option
To protect
CA Endevor SCM
and its data sets, install a security function that prevents unauthorized access to your system. You may need to choose from among a number of data set and functional security options.
Data Set Security Methods
Options for data set security:
  • Program path protection
    Allows authorized users access to a data set through an authorized program.
    Permits library updates only through
    CA Endevor SCM
    Provides secure preventative control.
  • Standard data set protection
    Allows authorized users direct access to data sets.
    Permits library updates outside of
    CA Endevor SCM
    Provides a measure of preventative control.
  • No data set protection
    Permits unlimited access to data sets.
    You can use
    CA Endevor SCM
    Footprint Exception Reporting to detect unauthorized updates.
Functional Security Methods
Functional security can be provided by implementing one of the two following
CA Endevor SCM
security methods.
  • Native security tables
    Provides basic functional security.
    Allows access to environments.
    Permits primary and foreground menu options.
    Requires authorization of actions.
  • ESI
    Provides basic functional security.
    Allows extension of functional security through customization.
    Integrates with existing security package, such as CA ACF2, CA Top Secret, RACF.
Implementing Security
We recommend a comprehensive approach to system security that ensures functional and data set security. A carefully planned security program ensures the proper levels of access and data set security.
Address security during the final testing of your first
CA Endevor SCM
application. The initial setup and testing steps for implementing a new application should not be disrupted by overly restrictive security rules.
How to Enable Data Set Security
Follow this process to implement data set access security and ensure your success.
  1. Lay out your data set access requirements in a simple, nontechnical form for review.
  2. Build your data set security profiles in Warning Mode.
  3. Test your security implementation and monitor any warnings that you receive.
  4. Set data set security profiles to Live Mode.
  5. Monitor security violations on an ongoing basis.
How to Enable Functional Security
Decide which means of functional security you want to use: native security tables or ESI. You can only use one method.
How to Implement Native Security
Follow this process to implement functional security using native security tables and ensure your success.
  1. Plan security for a pilot application.
  2. Define the three native security tables.
  3. Access Security Table.
  4. User Security Table.
  5. Resource Security Table.
  6. Activate the security tables.
  7. Test your security implementation, monitor violations, and correct tables.
How to Implement ESI Security
Follow this process to implement ESI security and ensure your success.
  1. Plan security for a pilot application.
  2. Customize the ESI Security Definition Table, BC1TNEQU.
  3. Lay out ESI security profiles.
  4. Build ESI security profiles in Warning Mode.
  5. Customize the C1DEFLTS Table
    ESI is activated.
  6. Test ESI security and monitor warnings.
  7. Set ESI security profiles to Live Mode and monitor violations.