Ransomware, gaps in SMF records, and detection options

---

Presentation

Many sites connect their SMF data to a security console (Splunk, QRadar, and other SIEMs) so that an alert can be triggered the moment that there is a security issue. But what if SMF hasn't recognized the problem? What can be done to overcome problems such as:

• Time bombs, multiple back doors and persistent malicious software
• Early warning that uncharcteristic nehaviour is taking place by users (internal and external)
• Sorting wheat from the chaff - the volume of SMF records makes identification difficult and malicious activity is missed.
• Addition of APF libraries giving authorization
• Unix System Services attacks - gaining z/OS authorization by using the the +A option
• Compromised backups
• Events not recorded.
• Exits in Key 0 state.

Attachments

GD Attachments

Speakers

---

Trevor Eddolls at iTech-Ed Ltd

A popular speaker and blogger, Trevor Eddolls is CEO of iTech-Ed Ltd, an IT consultancy firm. Trevor currently chairs the Virtual IMS, Virtual CICS, and Virtual Db2 user groups. He’s editorial director for the Arcati Mainframe Yearbook, and for many years edited Xephon’s Update publications. Trevor has an extensive 40-year background in mainframes and IT, and has been recognized as an IBM Champion from 2009 to 2022 for his leadership and contributions to the Information Management community. He's written numerous technical articles and published three mainframe-related books.

Email: trevor@itech-ed.com

Feedback

Click here to give some Feedback so we can make it even better next year!