IAM and ACF2 collection considerations

Edit online

IBM® Security Guardium® S-TAP® for Data Sets can capture IAM data set activity and ACF2 access failures. Learn how to enable IBM Security Guardium S-TAP for Data Sets to collect this information, and be aware of the following collection considerations. These products implement the collection of SMF data in a nonstandard way and require special consideration.

Innovation Access Method (IAM) from Innovation Data Processing provides capabilities beyond standard VSAM. IAM replaces VSAM access with a proprietary non-VSAM access that simulates VSAM. Because the underlying data sets are non-VSAM, accesses to the IAM-simulated VSAM data sets do not generate VSAM SMF records, such as the SMF type 62 (VSAM OPEN) and SMF type 64 (VSAM CLOSE).

For IAM data sets, IBM Security Guardium S-TAP for Data Sets does not report the following items:
  • Context records for OPEN and UPDATE for IAM data sets (because of the lack of the SMF type 62 records).
  • IAM simulation of alternate index and path processing (because of the lack of an IAM SMF CLOSE record).
The CLOSE record counters will report IAM data sets differently from native VSAM processing. Although the IAM CLOSE SMF record offers an extensive array of counters, those corresponding to the VSAM SMF Type 64 record are included in the accumulated counts within the CLOSE context record.

Broadcom CA ACF2 considerations

Unlike some security products, ACF2 does not offer a unique authorization failure code to identify a CONTROL access failure. Instead, it reports these as UPDATE access failures. In ACF2 facilities, no CONTROL context records will be reported.