SPARTA News

May 2020

SPARTA President’s Corner

contributed by Randy Springs

May is here, and it seems somewhat like “Groundhog Day – The Movie”. Our world is not the same as it was in January and February, when the economy was booming and everyone was looking forward to the new year. The new media buzzwords are “pandemic”, “social distancing”, and “flattening the curve”. Some businesses are giving up, others are adapting to the “new normal”, and for others, it is business as usual. When we do get over this crisis, our world will be different in many ways.

For our May meeting, we will have our second “virtual meeting”, only this time we are trying out the Zoom platform. So put on a shirt over your gym shorts and join us on Tuesday evening. Our speaker has not yet confirmed, so we may do an extended roundtable with each participant free to share work challenges and experiences. I thought it might be fun for each person also to tell about your first IT-related job and what hardware and/or software was used on it.

Your SPARTA group still needs a volunteer to replace Pam Tant as treasurer. This position would involve about two hours per month. Please consider serving and talk to me about the position.

Please plan to join your colleagues on Tuesday, May 5 via the internet. Look for an email that day with details for connecting to the meeting.

Randy Springs
Truist

Future Speakers

(subject to change)

May 5, 2020 - (Online Only) x by y of z

June 2, 2020 - TBA

We need ideas and volunteers for future speakers. Presentations don’t have to be fancy, just informative and interesting. Even a 5 or 10 minute talk can start an interesting interaction. Contact Ron Pimblett by phone as noted below.

2019-2020 SPARTA

Board of Directors

Randy Springs - President

Truist                  (919) 745-5241

3200 Beechleaf Court, Suite 300

Raleigh, NC 27604

Ron Pimblett - Vice President

MDI Data Systems

Land line 613 599 6970

Mobile 613 981 6919

190 Guelph Private

Kanata, ON K2T 0J7

Chris Blackshire - Secretary

Retired (Dell, Perot Systems, Nortel)  (919) nnn-nnnn

street

Durham, NC 27713

Randy Springs - (Acting) Treasurer

BB&T                  (919) 745-5241

see Randy

Springs earlier

Ed Webb -  Communications Director

Retired (SAS Institute Inc.)  (919) nnn-nnnn

street

Apex, NC 27523

Mike Lockey -  Web Master

Guilford Co. Information Services  336-641-6235

201 N. Eugene St.

Greensboro, NC 27401

Meetings

Meetings are scheduled for the first Tuesday evening of each month (except no meeting in January), with optional dinner at 6:15 p.m. and the meeting beginning at 7:00 p.m.

These monthly meetings usually are held at LabCorp’s Center for Molecular Biology and Pathology (CMBP) near the Research Triangle Park (see last page). Take I-40 to Miami Boulevard and go north. Turn right onto T.W. Alexander Drive. Go about a mile or so. Then turn right into LabCorp complex and turn Left to the CMBP Building (1912 T.W. Alexander Drive). In the lobby, sign in as a visitor to see Bill Johnson. Bill will escort you to the conference room.

Call for Articles

If you have any ideas for speakers, presentations, newsletter articles, or are interested in taking part in a presentation, PLEASE contact one of the Board of Directors with your suggestions.

Newsletter e-Mailings

The SPARTA policy is to e-mail a monthly notice to our SPARTA-RTP Group. The newsletter is posted to the website about five (5) days before each meeting so you can prepare. The SPARTA-RTP Group is maintained by Chris Blackshire; if you have corrections or problems receiving your meeting notice, contact Chris at chrisbl@nc.rr.com.

December 2019 “CBT Tape” Shareware Online

The directory and files from the latest CBT tape V498 (dated December 1, 2019) are available from www.cbttape.org.

If you need help obtaining one or more files, contact Ed Webb (see Board of Director’s list for contact info).

Minutes of the April 3, 2020 Meeting

• The meeting was called to order at 7:03 PM by Randy Springs, the SPARTA President.

• This first all-virtual SPARTA meeting was held via the GoToMeeting Software.

• Eight (8) people were present.

• Everyone introduced themselves, told where they worked, and briefly described their job functions or their job hunting challenges.

OLD BUSINESS

• The minutes of the March 3, 2019 meeting as published in the April 2020 Newsletter were approved.

• The March 31, 2020 Treasurer's report was approved as published in the April 2020 Newsletter. As of March 31, 2020, the current balance was $1,429.66.

• Call For Articles: Articles are needed for this newsletter. If you would like to write an article for this newsletter, please contact Ed Webb. Keep in mind that you don't really need to write the article, it can be an article that you read that you would like to share with the membership.

• The SPARTA Web page is available. To access the SPARTA Web page, point your Web browser to this site: http://www.spartanc.org. Please send any comments or suggestions about the Web page to Mike Lockey. Be sure to check the Web page every once in a while to see any new or changed information.

• Randy Springs reminded everyone to leave the LabCorp conference room clean.

• 2020 meeting dates, Future Speakers and Topics (subject to change based on internal politics, budget, the weather):

If you have suggestions about speakers and topics, contact Ron Pimblett.

• The next SPARTA monthly meeting will be held virtually on Tuesday, May 5, 2020.

• The 2020 membership fee are due ($30) starting in February 2020. Please pay Randy Springs.

• Thanks to Colin van der Ross of SDS for virtually hosting the meeting.

• There are currently 95 people on the SPARTA-RTP e-mail list.

• Send any e-mail address changes to Chris Blackshire so he can update the SPARTA-RTP Listserv. You will be added by the moderator (Chris = SPARTA-RTP-owner@yahoogroups.com) sending you an invitation to Join the list.

• Randy Springs is looking for a new Treasurer volunteer. He projects about 2 hours per month is needed.
- The treasurer position duties are:
- - Collect dues and pay expenses at each monthly meeting.
- - Deposit income at the BB&T bank monthly.
- - Make an updated monthly Excel income-expense list for the monthly newsletter.
- - Give a Treasurer report at each meeting.
- - One Time: Be added to the checking account authorization.
- Contact Randy Springs if you are interested.

• LabCorp Meeting Place Update from Bill Johnson: no update.

NEW BUSINESS

• None.

• The Business portion of the meeting ended about 7:20 P.M.

Security Solutions for the Mainframe

By Colin van der Ross of Software Diversified Services (SDS)

• Agenda (Part 1)

• Introductions and Company Overview
• Why is FTP so Vulnerable ?
• Live Demo of migrating to SFTP without any JCL changes
• Options available to Secure FTP
• Questions

• Agenda (Part 2)

• What is a SIEM?
• Demo of SMF events being sent to QRadar / Splunk
• Demo of Granular Filtering
• Suggested SMF 80 - Events to monitor (as per SDS customers input)
• Questions

The presentation ended about 8:30 P.M.

• Presentation Access - See Below for a full outline of the presentation. See the SPARTA webpage for the complete presentation.

• Contact Info:
Speaker: Colin van der Ross
Senior System Engineer
Software Diversified Services (SDS)
Phone: 800-443-6183 or 763-571-9000
http://www.sdsusa.com/support
Work: 763-450-9107
Email: colin.support@sdsusa.com
Email: cvanderross@sdsusa.com

• The April 7, 2020 monthly meeting ended about 8:30 P.M.

Treasurer’s Report for April 2020

contributed by Randy Springs

The balance in the account is $1429.66 as of April 30, 2020. There's been no change since March 31.

SPARTA Financial Report
04/01/2019 through 04/30/2020

Items of Interest

SPARTA Schedule and Menu for 2020

contributed by Chris Blackshire

May 5, 2020 - Pizza

June 2, 2020 - Chicken

July 7, 2020 - Subs 

Aug 11, 2020 - BarBQ (date changed to avoid SHARE 135, Aug 2-7, 2020 in Boston)

Sept 1, 2020 - Pizza

Oct 6, 2020 - Chicken

Nov 3, 2020 - Subs

Dec 1, 2020 - BarBQ

SHARE in Boston is still a Go! For Now

contributed By Ed Webb

Book Your Hotel Now and Register before June 19 for Best Discount!

From the SHARE Boston home page:

"Like you, we at SHARE Headquarters are closely monitoring the developing news surrounding the Coronavirus (COVID-19) from both the World Health Organization (WHO) and Centers for Disease Control (CDC). We want you to know that we are placing the highest priority on the health and safety of all of our delegates and event attendees and will make decisions moving forward with the input of public health officials.

At this time, we have no plans to modify, postpone, or cancel SHARE Boston. As this is an evolving situation, we will continue to provide updates and post information on our website.

In addition, we will be incorporating best practices recommended by WHO, CDC, and other health professionals at our upcoming event in an effort to keep event attendees safe and healthy. ...."

Read more about SHARE's plans and follow links to Register and make hotel reservations at this SHARE Boston Home Page.

Our Mainframe podcast's new home away from home

Contributed by Ed Webb

From SHARE's Marna's Musing's blog:

"Martin Packer and I have decided that we are moving podcast publishers. After much planning and many reviews, we've decided to move off the IBM location to another home - hopefully our last. We have selected:

https://anchor.fm/marna-walle (our new podcast is called "Mainframe, Performance, Topics Podcast")

This post is a plea for all old subscribers to subscribe to our "new" podcast. And, if you are not a podcast subscriber, maybe you'd like to give us a listen!? If you don't know our format, we cover one mainframe topic, one performance topic, and then one dealer's choice topic. I like to keep the episode to less than 30 minutes, and Martin, well, he is fine going a little over that.

Learn more in this SHARE blog entry by Marna Walle and Martin Packer of IBM.

IBM and the Invisible Mainframe Brand!

Contributed by Ed Webb

Marc Smith of ProTech explains why and how he's staying Z relevant in "retirement":

"Over the past few years, companies that use the IBM mainframe (IBM Z) to run their business-critical applications have been facing a skills shortage as their employees start to look to retirement. Though graduates in the computer science discipline are increasing, there is a lack of familiarity among students of both IBM as a brand and the mainframe as a career path to pursue.

Beginning in 2006, while working on the IBM System Z Marketing team, I became an employee volunteer with the Academic Initiative Team for Z, working to make colleges and universities in Texas aware that the mainframe was out there, and emphasizing the importance of highlighting mainframe career paths to students, and ultimately getting them to teach some mainframe content in their curriculum. ....

When I learned that an IBM conference was going to be held in my hometown of Austin, Texas [in 2007], I decided to work with the conference teams to develop a Career Day to bring high school and college students in to hear about the mainframe, and to go out onto the exhibit hall floor to meet vendors, see the running hardware, and meet customers and hear their stories. My first Career Day included about 200 students, both high school and college, and several classes of students traveled more than two hours to attend the program."

Read the rest of Marc's story in this excellent article from the Enterprise Executive 2020: Issue 2.

Humor

Be Careful!

contributed by Chris Blackshire

Just be careful because people are going crazy from being in lock down! Actually I've just been talking about this with the microwave and toaster while drinking coffee and we all agreed that things are getting bad. I didn't mention anything to the washing machine as she puts a different spin on everything. Certainly not to the fridge as he is acting cold and distant. In the end the iron straightened me out as she said everything will be fine, no situation is too pressing. The vacuum was very unsympathetic... told me to just suck it up, but the fan was more optimistic and hoped it would all soon blow over! The toilet looked a bit flushed when I asked its opinion and didn’t say anything but the door knob told me to get a grip. The front door said I was unhinged and so the curtains told me to ........yes, you guessed it .....pull myself together.

Returned from Walmart with the wife. Took our masks off. It turned out it was the wrong wife! Bee attentive!

Some people only write “lockdown” because they can't spell kwarinteen.

If you wear your jeans 5 days in a row, they become all baggy and it looks like you're losing weight. Follow me for more quarantine life pro tips.

The buttons on my jeans have started social distancing from each other.

Fact: In 4 weeks 88% of all blondes will disappear from the earth.

What is the difference between Bird Flu and Swine Flu?
For bird flu you need tweetment and for swine flu you need oinkment.

My weekly quarantine budget:
Gas $0
Entertainment $0
New shoes $0
Food $1,000

When swimsuit season hits, I just want y'all to remember the gyms were closed during Reese's Peanut Butter Eggs season.

Self isolation diary:
Day 1 – I Can Do This!! Got enough food and wine to last a month!
Day 2 – Opening my 8th bottle of wine. I fear wine supplies might not last!
Day 3 – Strawberries: Some have 210 seeds, some have 235 seeds. Who knew??
Day 4 – 8:00pm. Removed my Day Pajamas and put on my Night Pajamas.
Day 5 – Today, I tried to make Hand Sanitizer. It came out as Jello Shots!!
Day 6 – I get to take the Garbage out. I’m So excited, I can’t decide what to wear.
Day 7 – Laughing way too much at my own jokes!!
Day 8 – Went to a new restaurant called “The Kitchen”.
You have to gather all the ingredients and make your own meal. I have No clue how this place is still in business.
Day 9 – I put liquor bottles in every room. Tonight, I’m getting all dressed up and going Bar hopping.
Day 10 – Struck up a conversation with a Spider today. Seems nice. He’s a Web Designer.
Day 11 – Isolation is hard. I swear my fridge just said, “What the h___ do you want now?”
Day 12 – I realized why dogs get so excited about something moving outside, going for walks or car rides. I think I just barked at a squirrel.
Day 13 – If you keep a glass of wine in each hand, you can’t accidentally touch your face.
Day 14 – Watched the birds fight over worms. The Cardinals lead the Blue Jays 3–1.”

My husband purchased a world map . . . gave me a dart and said “throw this and wherever it lands I'm taking you for a holiday when this pandemic is over”.
Turn out we're spending two weeks behind the fridge.

This is the longest something made in China has ever lasted.

My mom was always telling me I wouldn't accomplish anything by laying in bed all day.
But look at me now, I'm saving the world.

Grocery shopping has become a real life version of PAC-Man.
Avoid everyone, get the fruit, and take any route to avoid contact.

You can either have a nice day or you can help your child with their math homework.
You can't have both. - Coronalations 03:30

You think it's bad now?
In 20 years our country will be run by people home schooled by day drinkers!

Mon.... my other teacher never drinks wine during class.

January was 6 months long, February had that 29th day, and now we are in the YEAR of March. 2020 is going well!

For those who have lost track, today is Blursday, the fortyteenth of Paprilay.

I hope the weather is good tomorrow for my trip to Puerto Backyarda.
I'm getting tired of Los Livingroom.

9 PM is the time to remove your day pajamas and put your night pajamas on.

How messed up is it that Cinco De Mayo finally falls on Taco Tuesday and will get messed up by a virus with the same name as a Mexican beer?

Every time I finish a roll of toilet paper, it feels like a petal falling off the enchanted rose in Beauty and the Beast.

As we end week 2 of the lockdown, I've been thinking about Osama Bin Laden. He was stuck in his house with three wives for five years. I'm beginning to wonder if he called in those Navy Seals himself.

Today the devil whispered in my ear “you aren't strong enough to withstand the storm”.
I whispered “get 6 feet back idiot.”


Never Travel with Tom Hanks:
His ship got hijacked,
His plane crashed,
He got stuck at an airport,
He got stranded on an island,
And now had COVID-19

You thought dogs were hard to train?
Look at all the humans that can't sit and stay

Once the Coronavirus emergency is over, every American needs to do 3 things:
1. Buy American made products.
2. Support your local farmers market.
3. Support locally owned and operated “mom and pop” businesses and eateries.

Membership Information

Don’t Forget the Next SPARTA Meeting

Tuesday, May 5, 2020

7 p.m.

Location: Online

Information about access to our online meeting will be sent to our e-mail list by Tuesday, May 5.

Free Food before meeting: Your Food at Your Home

Program:

x

Speaker: y of z

SPARTA Corporate Sponsors:

April Presentation Outline

Security Solutions for the Mainframe

By Colin van der Ross of Software Diversified Services (SDS)

• Agenda (Part 1)

• Introductions and Company Overview
• Why is FTP so Vulnerable ?
• Live Demo of migrating to SFTP without any JCL changes
• Options available to Secure FTP
• Questions

• Introductions
- Speaker: Colin van der Ross, Senior System Engineer
- Software Diversified Services
- - Proudly Serving Enterprise Customers for Over 36 Years
- - Financially Rock Solid
- - Several Hundred Satisfied Licensed Customers Worldwide
- - Over 20 z/OS, z/VSE and z/VM Mainframe Systems and Distributed Products
- - World Class Support
- - - Full Time Development / Support Staff / USA
- - Partner Solutions - Virtel Web Solutions, ConicIT, SSH Tectia for z/OS (Secure FTP)
- - VitalSigns SIEM Agent for z/OS
- - IronSphere and FIM+
- HQ in Minneapolis - (800) 443-6183 or (763) 571-9000
- HYPERLINK "http://www.sdsusa.com/"www.sdsusa.com

• Why is FTP so Vulnerable
- FTP
- Ubiquitous
- - Readily available on most platforms. Client side is always ready to go, and the Server requires some configuration and can be available
- Common Knowledge
- - Been around for such a long. Easy to use. Command Syntax is simple. Almost everyone has used FTP
- Included in the OS
- Very Little Security
- - X FTP is a CLEAR text protocol.
- - - That means any eavesdropper can see the User IDs, password and data with the appropriate tools
- - X Not Firewall Friendly
- - - X Strange” protocol–designed around having 2 connections
- - - - X One for commands
- - - - X and the second one for the data transfers
- - - X No Native compression
- - X Lacks Integrity Validation

• Options available to secure FTP
- FTPS - FTP over SSL
- - Similar to FTP
- - Included in the Base OS
- - Supports x.509 certificates
- - X Not Firewall Friendly
- - X Can’t assume its available on the other end
- FTP over SSH Tunnel
- - Same FTP familiarity
- - Firewall Friendly
- - Compression of data
- - Good data checksums
- - X More parts need to be choreographed
- - X Requires SSH and FTP on both ends
- Secure FTP (SFTP)
- - Satisfies the SFTP requirement
- - Point to Point Encryption
- - Compression / Integrity built in
- - X May not be part of your operating system
- - X May not be familiar to users
- - X Only protects the data in transit
- PGP (Pretty Good Privacy)
- - Secures data at Rest not in motion
- - Full control of sensitive data
- - Compression and integrity built in
- - Not Just for transfers
- - X Requires staging
- FTP to SFTP Conversion
- - Satisfies the SFTP requirement
- - Can still use the FTP client on the z/OS side
- - X Not a perfect match
- FTP to SFTP Conversion – Demonstration
- - Tasks already completed
- - - VFTP and SSH installed
- - - Uploaded the remote servers public key
- - - Configured the SSH Proxy to convert FTP to SFTP
- - - Configured VFTP to route batch job ZFTPJOB to the SSH Proxy

• FTP to SFTP Takeaways
- Surprising to see how many customers still use FTP
- Many options to consider
- Not a “one size” fits all
- Could be one solution of a combination of solutions presented here this evening
- What is the end goal ?

• Agenda (Part 2)

• What is a SIEM?
• Demo of SMF events being sent to QRadar / Splunk
• Demo of Granular Filtering
• Suggested SMF 80 - Events to monitor (as per SDS customers input)
• Questions

• What is SIEM ? – Security Information & Event Management
- Security Management provides a holistic view of an organization’s information technology security
- SIEM combines SIM (Security Information Management) and SEM (Security Event Management) functions into ONE Security Management System
-SIEM
- Asset Discovery
- Vulnerability Assessment
- Threat Detection
- Event Collection
- Correlation
- Event Management
- Log Storage

• SIEM - Security Information & Event Management System
- Security Event Management (SEM)
- - Provides
- - - Event Management
- - - Real Time Threat Analysis
- - - Incident Detection & Response
- - - Basic ticketing capabilities
- - - Security operations
- Security Information Management (SIM)
- - Provides -
- - - Centralized log collections
- - - Long term log collection
- - - Log search and reporting

• Why SIEM?
- Security Requirement
- - SIEM is the core of a defense in-depth strategy
- - Attackers leave behind a trace – Logs
- - Security Events provide insight into
- - - When the event occurred
- - - Why it happened
- - - What happened

• Why integrate z/OS into SIEM ?
- Compliance Requirement
- - PCI, SOX, HIPAA,GLBA, etc
- Mainframe contains Sensitive data
- - Large corporations have 70% of data on Mainframes
- z/OS is not invulnerable
- You already have a SIEM, why not use it for your mainframes ?

• SIEM – One view of your entire Enterprise
- A Enterprise SIEM collects / aggregates logs from heterogeneous sources
- - Databases
- - Routers
- - Switches
- - Other SYSLOG devices
- All in ONE central location
- Makes searching easy
- - Exact Time
- - Corresponding Security Event
- - Who
- - When
- - Location
- Configure Rules
- Kick off scripts
- - Based on thresholds
- - Conditions
- - Violations
- - Anomalies
- Historical Data
- Compliance Requirements
- Logs are tamper-proof

• VSA Integration
- VSA Agent - - - Firewalls - - Routers
- - Atlanta                      |          |
- - ACF2                       V         V
- VSA Agent - - - - - - - > SIEM - - - > Graphics, Text, Reports
- - New York                    ^      ^
- - RACF                          |       |
- VSA Agent - - - - Windows - Unix
- - Los Angeles Top Secret

• SMF Types Monitored by VSA
- Record Type 14 (0E) – INPUT or RDBACK Data Set Activity
- Record Type 15 (0F) – OUTPUT, UPDAT, INOUT, or OUTIN Data Set
- Record Type 17 (11) – Scratch (delete) of Data Sets
- Record Type 18 (12) – Rename of Data Sets
- Record Type 30 (1E) – JOB/STEP TERMINATION (BATCH, TSO, STARTED TASK)
- - TYPE30_1: Job Initiation
- - TYPE30_4: Step Termination
- - TYPE30_5: Job or Session Termination
- - TYPE30_6: System Address Space
- - TYPE30_D: DD Segment Detail
- - TYPE30_V: Interval Accounting
- Record Type 32 (20) – Termination of TSO Session (Often = 30)
- Record Type 42 (2A) – System Managed Storage (SMS) PDS/E activity
- - Subtype 20 – STOW initialization (delete all members)
- - Subtype 21 – Delete member
- - Subtype 24 – Add or Replace member
- - Subtype 25 – Rename member
- Record Type 62 (3E) – VSAM OPEN
- Record Type 80 (50) – RACF Security (Events 1-89; DataTypes 1-438)
- Record Type 81 (51) – RACF Initialization and SETOPTS
- Record Type 83 (53) – RACF Security Audit Records
- Record Type 90 (5A) Changes to APF Authorized Library List(z/OS 2.2)
- Record Type 92 (5C) – Open/MVS File System activity
- - Subtype 1 - when a file system is mounted
- - Subtype 2 - after the file system is quiesced or suspended
- - Subtype 4 - after the file system is unquiesced or resumed
- - Subtype 6 - when the file system is remounted
- - Subtype 7 - when the file system is moved
- - Subtype 10 - when a file is opened
- - Subtype 11 - when a file is closed
- - Subtype 12 - MMAP subtype information
- - Subtype 13 - MUNMAP subtype information
- - Subtype 14 - File/directory delete
- - Subtype 15 - Security attributes changed
- - Subtype 16 - Socket/char spec close (same as 11)
- - Subtype 17 - File accesses
- Record Type 102 (66) - DB2 Database Audit (Classes 1-11; Admin actions)
- Record Type 109 (6D) - SyslogD
- Record Type 119 (76) - TCP/IP, Telnet,FTP, FTP Client, UDP Close, TN3270
- - TCPTerm 2 - TCP Connection Termination
- - FTPClient 3 - FTP Client Transfer Completion
- - StackSS 8 - TCP/IP Stack Start/Stop
- - UDPClose A - UDP Socket Close
- - TNSvrTerm 15 - TN3270 Server SNA Session Termination
- - TSOCTerm 17 - TSO Telnet Client Connection Termination
- - FTPServer 46 - FTP Server Transfer Completion
- - FTPLogonF 48 - FTP Server Logon Failure

• Demonstration of SMF Events sent to QRadar and Splunk AND SMF Granular Filtering

• Suggested SMF Events to Monitor (PDF List Provided)
- Input from existing SDS VSA customers

The presentation ended about 8:30 P.M.