Z-TAP Pre-Installation

This section contains information that you should review before you install or update the Guardium for Mainframes Z-TAP component.

• Verifying the Product Package

• Roles and Assignments for Z-TAP Installation and Configuration

• Mainframe Software Requirements

• Security Requirements

• Optimizing Performance

• Supported Attach Facilities

• Information Needed for Installation

• Preparing for Disaster Recovery

• Allocating the ADMIN Library

• Back to top

Verifying the Product Package

Verify that you have the following items:

• Current version of the Z-TAP component. The z/OS components are distributed electronically.

• Guardium license key. The Guardium license key enables a specific set of features and options. Each key is generated for a single Guardium system, which may be a standalone unit or a Central Manager, and it will not work on any other system. Guardium license keys are distributed on .txt files, and may be provided to you on a removable disk or attached to an email.

• Z-TAP license key. Separate from the Guardium license key, which is installed on the Z2000 appliance, is a similar license key for the Z-TAP component which must be installed on the host z/OS mainframe.

If any of these items are missing, please contact Guardium Technical Support.

• Back to top

Roles and Assignments for Z-TAP Installation and Configuration

Depending on the size and distribution of your system, several people might contribute to the Z-TAP installation and configuration process. Use the information in the table below to help plan the installation process. If more than one person will participate in the installation, consider meeting with all participants in advance to communicate the product requirements.

In addition, the Z-TAP started task must be granted appropriate security authorizations before the product can be run successfully. For more information about security requirements, see the Security Requirements section of this guide.

Roles and Tasks for Installation Process

• Back to top

Mainframe Software Requirements

Before unloading and installing Z-TAP, verify that you have the following software installed on your z/OS system:

• Back to top

Security Requirements

For Z-TAP to run successfully, you must provide the product with adequate access to operating system and database resources. By using a security administration product (such as RACF), you can establish application profiles for Z-TAP started tasks.

DB2 Security Considerations

Verify or change the following DB2 settings:

• Authorize the Z-TAP started task to access the DB2 Catalog of any DB2 instance being audited.

RACF Security Considerations

Verify or change the following RACF settings:

• RACF should be used to protect the Z-TAP rules datasets so that it can not be modified by anything other than the Z-TAP started task. The rules datasets are defined by the customizable parameter ”r;Local Rules Dataset Name”.

• The Z-TAP started task uses TCP to communicate with the Guardium Z2000 appliance. The z/OS user ID associated with the Z-TAP started task must have an OMVS RACF segment.

APF Authorization

The library that contains the Z-TAP load modules (?guardiumhlq.LOAD) must have Application Program Facility (APF) authorization.

Z-TAP uses dataspaces, cross-memory services, and other functions that require APF authorization. These are common and necessary requirements of system-level software.

To APF-authorize the load library, your system programmer will issue an APF command similar to the following examples:

• If the load library data set is managed by the IBM System Management Service (SMS):

SETPROG APF,ADD,DSNAME=?guardiumhlq.LOAD,SMS

• If the load library is not managed by SMS:

SETPROG APF,ADD,DSNAME=?guardiumhlq.LOAD,VOLUME=volume

• Back to top

Optimizing Performance

Z-TAP will run faster and more reliably if the following configuration settings are made:

• Set the Z-TAP started task priority equal to or higher than that of the DB2 instances being audited.

• Back to top

Supported Attach Facilities

Z-TAP supports the following local attach facilities for DB2 on z/OS:

• Call Attach (CAF)

• Resource Recover Services (RRSAF)

• CICS

• TSO

• IMS

Z-TAP supports the following facilities for distributed connections:

• DRDA

• Back to top

Information Needed for Installation

Guardium for Mainframes is an enterprise product that comprises components that run on the z/OS source DBMS platform (Z-TAP) and components that run on a network based appliance (Z2000). Administrator and user tasks are done using the Guardium interface, which runs in your web browser. For Z-TAP to communicate with the Z2000 appliance, you must have TCP/IP network connections between the LPAR where auditing is performed and the appliance.

Before installing Z-TAP, you will need to know the IP port numbers that will be used by the product. Your network administrator may need to establish these for you.

Preparing for Disaster Recovery

Guardium for Mainframes is an important piece of your database security strategy and to ensure business process continuity, you will want to recover Z-TAP at the same time you recover your z/OS hosted databases. To fully recover Z-TAP, you must include the following resources in your disaster recovery plan:

• Back to top

Allocating the ADMIN Library

The Z-TAP component uses an administration (ADMIN) library to manage and maintain product keys and the associated product load libraries. You must allocate and catalog this administration library. Use the following steps to allocate the library:

1. Locate the ALLOCATE sample JCL in the ?guardiumhlq.CNTL data set.

2. Edit the JCL to include a valid job card and meet your site requirements.

3. Submit the job to allocate the library. The job allocates a data set with the format shown in the following table.

Role Allocation Requirements for the ADMIN library

• Back to top