Analyzing security definitions using security discovery in CICS Explorer

The CICS Security Discovery perspective in CICS Explorer® allows you to view security definitions for CICS, improve and rearrange the grouping of users, transactions, and other resources, and potentially identify anomalies in your existing security definitions.

It is assumed that you already have some transaction security definitions set up, which allow users to access the transaction they need for their job. There is no assumption about whether your users are in groups, or your transactions are in member lists. The process enables you to create or improve your user groups (roles) and member lists, and by using the security discovery data (SDD), to identify anomalies, including unused permissions. If you currently use universal access permissions (UACC), which are not recommended for a zero-trust strategy, these can also be identified and resolved with this analysis process.

This process is likely to take several days, and can be done in a number of stages. You can save your work at any stage. Also, it is possible to export your data for review and implementation in stages. For example, you might have multiple application owners who need to review their application's security definitions, before you process them into your ESM.

Choose a route depending on your scenario:

Analyzing security definitions for a single application in multiple regions

Table 1. Workflow of analyzing security definitions for a single application
Stage Input Definitions analyzed Result Roles responsible
Analyzing security definitions based on similarity Security metadata containing RACF definitions (.esm file)
  • Roles
  • Transactions (XTRAN)
  • Users grouped into roles based on the similarity pattern
  • Transactions grouped into member lists
  • All security definitions are for a single application
 System programmer
Initial review of security definitions for transactions with SDD
  • Security definitions from the previous stage
  • SDD
  • Roles
  • Transactions (XTRAN)
  • Users removed from or added to roles based on usage
  • Transactions in member lists
  • All security definitions are for a single application
 System programmer
Understanding and improving security definitions for resources with SDD
  • Security definitions from the previous stage
  • SDD
  • Roles
  • Other resources, such as files (XFCT)
  • Roles (refined)
  • Resources in member lists
  • All security definitions are for a single application
  • System programmer
  • Application owner

At each stage, you can export the security definitions from CICS Explorer as security metadata (.esm). The exported data can be reviewed by application owners or converted back into RACF definitions to make use of whatever changes were made. See Exporting security metadata for review.

Analyzing security definitions for several applications in multiple regions

In this case, you need to identify your transactions and resources associated with each application to work on a subset of data at a time. The Security Discovery editor in CICS Explorer provides an application filter function for you to define an application as well as its associated transactions and resources, making it easier to manage security definitions per application. This allows you to enable additional command and resource security (CMDSEC, RESSEC) for one application at a time.

The workflow is as follows:
Table 2. Workflow of analyzing security definitions for multiple applications
Stage Input Definitions analyzed Result Roles responsible
Analyzing security definitions based on similarity Security metadata containing RACF definitions (.esm file)
  • Roles
  • Transactions (XTRAN)
  • Users grouped into roles based on the similarity pattern
  • Transactions grouped into member lists
  • No application segmentation
 System programmer
Initial review of security definitions for transactions with SDD
  • Security definitions from the previous stage
  • SDD
  • Roles
  • Transactions (XTRAN)
  • Users removed from or added to roles based on usage
  • Transactions in member lists
  • No application segmentation
 System programmer
Defining applications to process work in segments
  • Security definitions from the previous stage
  • SDD
  • Roles
  • Transactions (XTRAN)
  • Applications defined by:
    • A set of origin transactions
    • A set of associated transaction member lists
  • Transactions in member lists
  • Roles (refined)
  • System programmer
  • Application owner
Defining security for resources associated with each application
  • Security definitions from the previous stage
  • SDD
  • Roles
  • Other resources, such as files (XFCT)
  • Applications defined by associated transactions and resources
  • Resources in member lists
  • Transactions in member lists
  • Roles (refined)
  • System programmer
  • Application owner

At each stage, you can export the security definitions from CICS Explorer as security metadata (.esm). The exported data can be reviewed by application owners or converted back into RACF definitions to make use of whatever changes were made. See Exporting security metadata for review.