Your Browser is Out of Date

Nytro.ai uses technology that works best in other browsers.
For a full experience use one of the browsers below
Dell PowerMax and DLm: Cyber Security for Mainframe Storage
Executive summary Cyber essentials—Dell style Cyber security, cyber resiliency, and cyber recovery Disk Library for mainframe and cyber protection Cyber architecture designs Cyber Intrusion Detection for z Systems (zCID) overview zCID terminology and programs zCID implementation strategy
zCID implementation strategy
zCID communications for atypical access Summary References

zCID implementation strategy

Home > Storage > PowerMax and VMAX > Mainframe > Dell PowerMax and DLm: Cyber Security for Mainframe Storage > zCID implementation strategy

zCID implementation strategy

  • Here is a zCID implementation strategy to provide customers increased awareness on atypical access rates for z/OS resources.

    1. The customer runs zCID in a Live Run over a “long” period (collection).
    2. The customer stops the Live Run and runs zCID Batch Mode to create reports - (analyze).
    3. The customer uses information from the Batch Run (analyze) to code and test control statements to warn the customer of access anomalies.
    4. The customer runs zCID in Live Run with warn control statements.

    Let’s review the details of each of these steps.

    First, when giving zCID z/OS resources to monitor (in the form of JCL control statements DEVICE_LIST, SMS_GROUP, SELECT DSN), it is important to give zCID only the resources you would want to monitor.

    • Pro Tip: Start monitoring with SMS_GROUP, then DEVICE_LIST and last SELECT DSN. Monitoring all z/OS datasets can cause increased memory usage with zCID and MFE 10.1.0 processing.

    For step one, the goal is to capture access rates over a long period of time which will be used to deduce what access rates are normal within your z/OS environment. Allow zCID to collect data for one month.

    • Pro Tip: Monitor z/OS resources during a quarter end closing to capture access rates over any significant business processing on z/OS.

    For step two, take the data collected in step one, create the zCID reports, and begin to identify normal and abnormal access rates for the resources monitored. After you identify normal and abnormal access rates from the reports, start with step three to code and test your WARN statements. WARN statements generate WTOR or SYSLOG zCID warning messages about atypical behavior.

    • Pro Tip: Test the warning statements against the zCID output created in step one. This allows you to calibrate what you will be warned on for atypical behavior.

    The last step is to run zCID continuously with the warning statements tested in step three. This now enables zCID to monitor the specified resources in your z/OS environment for atypical access rate behavior.