Using Your Security System › The z/OS External Security Manager › How CA@BES Works

How CA@BES Works

Use the CA@BES resource class to manage the tape encryption process and provide security protection as the following points outline:

• Define the CA@BES resource class, you only need to do this one time.
  • For IBM Security Server RACF, use the RDEFINE command.
  • For CA ACF2 and CA Top Secret users CA@BES is predefined.
• Activate the CA@BES resource class to your security system and refresh any cached security profiles.
  • For IBM Security Server RACF, use the SETROPTS command.
  • For CA ACF2 and CA Top Secret users CA@BES is already activated.

  Note: The CA@BES class must be defined and activated for any security processing to take place.

• Add CA@BES to your security manager fast access, caching list.
  • For IBM Security Server RACF, use the following commands:

    SETROPTS RACLIST(CDT) REFRESH 
    SETROPTS GENERIC(CA@BES)      
    SETROPTS GENCMD(CA@BES)       
    SETROPTS CLASSACT(CA@BES)     
    SETROPTS RACLIST(CA@BES)
    SETROPTS RACLIST(CA@BES) REFRESH     
    

  • For CA ACF2 use the following commands:

    ACF
    SET CONTROL(GSO)
    CHANGE INFODIR TYPES(R-RBES) ADD
    QUIT
    

    Refresh CA ACF2 by entering the following console commands:

    F ACF2,REFRESH(INFODIR)
    F ACF2,REBUILD(BES)
    F ACF2,REBUILD(BES),CLASS(RBES)
    

• Create security profile control statements to define the command protection profiles, key protection profiles, and utility protection profiles using the TBESAF99 utility or the native control statement format of your security system.
• Edit the TBESAF99 resource definition profiles by adding or modifying user access and defining data set selection profiles.
• Import the profiles into your external security manager to populate the CA@BES resource class. Sample JCL is available in CTAPJCL members: TBEACF00, TBERAC00, or TBETSS00.

Note: CA Tape Encryption does not verify whether a user has access to a specific tape data set. z/OS performs this check during data set open processing.