Using Your Security System › The z/OS External Security Manager › Deactivate the SAF Interface (BES.SECURITY)

Previous Topic: How You Define Protection Profiles to Your External Security Manager

Next Topic: How CA Tape Encryption Works with Your External Security Manager

Deactivate the SAF Interface (BES.SECURITY)

To deactivate the SAF Interface or prevent the SAF Interface from being activated during CA Tape Encryption initialization or reload processing, the BES.SECURITY control profile must be defined with INACTIVE specified on the APPLDATA field of the PERMIT command.

This definition can be used to alter the existing BES.SECURITY control profile to disable the SAF Interface:

TSS REVOKE(STCDEF) CA@BES(BES.SECURITY)
TSS PERMIT(STCDEF) CA@BES(BES.SECURITY) ACCESS(READ) APPLDATA('INACTIVE')

Note: You can dynamically activate or inactivate the SAF Interface by replacing the BES.SECURITY APPLDATA parameter and refreshing CA Top Secret and CA Tape Encryption storage profiles.