Db2 for z/OS: Using RACF

Today more and more organisations are using RACF to control all aspects of Db2 security, not just the system as in the past. Now all internal security needs at both the system and data levels, such as access to Db2 for z/OS objects and data, are managed via RACF.
This intensive, one-day course shows exactly how this can be achieved.

The course is available for exclusive, one-company presentations and for regularly scheduled live presentations over the Internet, via the Virtual Classroom Environment service.

Virtual Classroom Environment dates - click to book!

UK Start Times

21 June 2024 20 September 2024

USA/Canada Start Times

1 August 2024 21 November 2024 20 March 2025 24 July 2025

What is a 'Virtual Classroom Environment'?

What do I need?

webcam
headphones with microphone
sufficient bandwidth, at least 1.5 Mb/s in each direction.

What you will learn

On successful completion of this course you will be able to:

describe Db2 security
understand terminology used with Db2 security
use and structure Db2 security tables
use primary, secondary, and CURRENT SQLID authorisation IDs used by Db2
use SQL to control security using the GRANT and REVOKE statements
describe the meaning of explicit, implicit and system privileges and administrative authorities
explain ownership considerations with regard to Db2 objects
control Db2 address space and data set authorisation using RACF
use RACF to control access to Db2 objects
describe the RACF classes for Db2 objects
create RACF profiles for Db2 objects
understand the additional considerations when using Db2 in a distributed environment.

Who Should Attend

All Db2 or RACF security administrators wishing to gain further insight into controlling Db2 security using RACF.

Prerequisites

A working knowledge of RACF and an understanding of Db2 for z/OS at a conceptual & terminological level.

Duration

1 day

Fee (per attendee)

£660 (ex VAT)

This includes free online 24/7 access to course notes.

Hard copy course notes are available on request from rsmshop@rsm.co.uk

at £50.00 plus carriage per set.

Course Code

DSR

Introduction to Db2 Security

Security overview; Sign-on security; Connection security; Db2 internal security; Other options; Security strategy (Transaction Manager or Db2); Security strategy (centralised or decentralised); Using remote applications.

Internal Db2 Security

Db2 security; Db2 security mechanism; Db2 security tables; Security terms; Authorisation ID; Privilege; Resource; Primary and Secondary Authorisation IDs; Maintaining security; Data Control Language; Grouped privileges; Explicit & implicit privileges; Ownership considerations; Static and Dynamic SQL; Static SQL considerations; Dynamic SQL considerations; Db2 security disadvantages.

Data Control Language & Privileges

SQL GRANT and REVOKE statements; Cascading REVOKE; Package, plan & collection privileges; Database, table, & view privileges; Other object privileges; System privileges; DCL examples: application development, Bind, program execution; Insufficient authority.

Db2 Security Reporting and Auditing

Db2 catalog security tables; Common table columns; Security tables 1 - 4; Auditing tables; Audit trace.

RACF Security Overview

What is RACF?; Identifying and verifying users; Checking authorisations; Recording and reporting; Terminology - users and groups; Terminology - resources and classes; Terminology - profiles; User profile; Resource Profile; Discrete and generic profiles; Creating Generic Profiles; Maintaining RACF Security.

Defining the Db2 Subsystem to RACF

Address space authorisation; Protected access profiles; RACF router table; Db2 address spaces; Permitting RACF access; Protecting Db2 datasets - create profiles; Protecting Db2 datasets - permitting access.

Defining Db2 Objects to RACF

Native Db2 security; Db2 with RACF; RACF / Db2 external security module; Installation; Mapping Db2 authorisation checks; Scope of RACF classes; Multi-subsystem scope classes; Single subsystem scope classes; Customisation; Db2 objects and RACF classes; Profiles; Privileges - buffer pools, storage groups & tablespaces; Privileges - Db2 system; Privileges - database and schema; Privileges - tables, views, indexes and user-defined functions; Privileges - collection, plan and package; Privileges - distinct types, sequences and stored procedures; Privileges - administrative authorities; Insufficient authority.

Row & Column Level Access Control

The traditional approach; Multi-level security overview; Security labels; Row level granularity; Multi-level security and SELECT; Multi-level security and INSERT; Multi-level security and UPDATE; Multi-level security and DELETE; Multi-level security and utilities; Row permissions & column masks; Defining row permissions; Using row permissions; Defining column masks; Using column masks; SYSIBM.SYSCONTROLS.

Distributed Data Considerations

Distributed Data overview; DDF components; Communications tables; Security actions (client); Security actions (server with SNA client); Security actions (server with TCP/IP client).