Implementing CA Top Secret › Security Modes

Security Modes

CA Top Secret uses the following security modes:

Dormant Mode

Use this mode to introduce yourself and your organization to CA Top Secret implement DORMANT mode first. Although CA Top Secret is installed, it is not actively validating access.

Warn Mode

Use WARN mode to:

• Determine which users are accessing which resources
• Test the access definitions you made in DORMANT mode

You can set WARN mode by facility, profile, user, resource, or event.

Some applications make RACROUTE calls with the LOG=NOFAIL parameter. In WARN mode, these types of calls are written to the audit file if the check fails, but no message displays. This procedure is normal.

Signon Violations

In WARN mode, define all users to CA Top Secret or CA Top Secret generates and records signon violations. WARN mode does not prevent an undefined user from signing on or gaining access to a protected resource.

Password Violations

WARN mode does not prevent a defined user from signing on with an incorrect password, but this action generates a password violation.

To force a defined user to supply a correct password in WARN mode, set the WARNPW sub-option of the FACILITY control option.

CA Top Secret administrators must always supply a correct password, even in DORMANT mode.

Resource Violations

If you give default protection to specific resource classes by attaching the DEFPROT attribute, WARN mode generates violations for all defined resources.

Global Warn Mode

Use Global WARN mode to test segments of the implementation, or to back off from FAIL mode when an implemented segment of the organization is in trouble. Your organization could choose an implementation strategy that includes installation-wide use of WARN mode.

Implement Mode

IMPLEMENT (IMPL) mode treats defined users in FAIL mode and undefined users in DORMANT mode. This mode lets you combine DORMANT and FAIL modes easily in your implementation strategy. All resources defined to CA Top Secret are protected and cannot be accessed by undefined users unless permissions have been defined to the ALL record. Unauthorized access attempts by defined or undefined users are failed. Resources not defined to CA Top Secret are generally not protected.

Many organizations use a global IMPLEMENT mode strategy during implementation and override that mode where appropriate by facility, profile, user, resource, or event.

Fail Mode

CA Top Secret is in full control of access requests. All users must be defined and resources protected by being owned or by DEFPROT protection. Unauthorized access requests fail. Using a phased approach, your implementation strategy may include a gradual migration by segment to FAIL mode. Your implementation goal should be to have your entire installation operating in FAIL mode.

Phased Implementation

In a typical security environment, the entire installation gradually moves from DORMANT to FAIL mode. This phased implementation allows you to:

• Introduce your users to how CA Top Secret impacts their daily job performance
• Customize your security database and security environment as the need arises

Security modes can be assigned to a site, facility, profile, user, resource, or event.

Using Concurrent Security Modes

Security modes can be assigned with:

• The MODE control option and sub-options of the FACILITY control option
• The TSS PERMIT command

When the security mode is set through a control option, that mode applies to the entire installation or, in the case of the FACILITY/MODE sub-option, to a specific facility (for example, TSO).

Examples: security modes

In this example, the MODE control option places the entire installation in WARN mode:

TSS MODIFY MODE(WARN)

In this example the TSO facility is in IMPL mode:

TSS MODIFY FACILITY(TSO=MODE=IMPL)

In this example, USER01 is put in WARN mode regardless of what mode the rest of the site is in:

TSS PERMIT(USER01) MODE(WARN)

Migrating to FAIL Mode

To migrate to FAIL mode:

• If you used WARN mode implementation, add the DEFPROT attribute just before migrating to FAIL mode. This tells CA Top Secret that users are not allowed to access data sets which are not defined. This gives an opportunity for last minute definition of data sets overlooked during implementation. For information on DEFPROT, see the chapter "Maintaining Special Security Records".
• If you chose an IMPLEMENT mode implementation strategy, gradually migrate your users to FAIL mode to ensure that they are not accessing undefined data sets. Once you have ascertained that a group of users is properly defined and has access to the appropriate data sets, you can migrate those users to FAIL mode by permitting the mode to the user or to the group profile.