MQSeries.net :: View topic - MQ Infrastructure and SOX compliance

MQSeries.net

Tech Exchange

Education

Certifications

Library

Info Center

SupportPacs

FAQÂ Â

Usergroups

RSS Feed - WebSphere MQ Support

RSS Feed - Message Broker Support

MQSeries.net Forum Index » IBM MQ Installation/Configuration Support » MQ Infrastructure and SOX compliance

MQ Infrastructure and SOX compliance

« View previous topic :: View next topic »

Author

Message

ivanachukapawn

Posted: Mon Feb 05, 2007 8:16 am Post subject: MQ Infrastructure and SOX compliance

Knight

Joined: 27 Oct 2003
Posts: 561

I'm thinking that MQSeries Infrastructure SOX compliance should consist of eliminating clear channels and having an effective authentication scheme. If there is more to MQ SOX compliance that this, please correct me on this point.
I worked on a project where authentication was provided (via one-way SSL/self-signed certificates) with channel exits. The client-side exit provided the user-ID and password and the server-side exit authenticated the user-ID/password via LDAP.
In your opinion, could authentication have been provided satisfactorily without the security exits had two-way SSL (with client authentication) been implemented?

jefflowrey

Posted: Mon Feb 05, 2007 8:31 am Post subject:

Grand Poobah

Joined: 16 Oct 2002
Posts: 19981

If you need to authenticate the actual user, you need a client exit.

You can create role-based security without an exit by setting an MCA user on client channels, and giving each individual their own cert. Then the cert ensures that the user is trusted, and allowed to connect to the channel, and the MCA User ensures that anyone who is allowed to connect to the channel can only do certain things.

Then your only problem is controlling access to the certs.

You should also make sure to control access to the production environments at the network level using a real firewall. Strongly consider disallowing any direct connection from any personal desktop machines, and require all access through an authenticating proxy or a shared console machine.
_________________
I am *not* the model of the modern major general.

Display posts from previous:

Page 1 of 1

MQSeries.net Forum Index » IBM MQ Installation/Configuration Support » MQ Infrastructure and SOX compliance

Jump to:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum

Protected by Anti-Spam ACP