Why Do I Need z/Assure® VAP?
Key Resources created its z/Assure® Vulnerability Analysis Program (VAP) to support you in your effort to maintain security and data integrity on the mainframe. Up to 70% of a corporations financial data might reside on the mainframe – and it might be among the least secured systems.
Many companies suffer mainframe vulnerabilities due to a common myth, that the mainframe cannot be breached. This myth keeps organizations from taking the actions necessary to fully secure their mainframe. Also, most organizations do not understand what a z/OS integrity vulnerability is, and therefore, mainframe vulnerability testing is not generally included in a mainframe audit.
Every z/OS operating environment has vulnerabilities, and once a hacker has exploited one of these vulnerabilities, the exploitation can lead to undetected access to any data on that system.
It is your responsibility to ensure the integrity of any configuration based modifications and vendor software that you add to your z/OS mainframe. This is why we created z/Assure® VAP, so that you can quickly and efficiently identify vulnerabilities and protect your organization from hackers, denial of service (DDOS) attacks and more.
What Can Organizations Do to Protect Themselves?
Since scanning programs manually is impractical and costly, KRI recommends an automated interactive approach to identifying code vulnerabilities. Our interactive approach to vulnerability scanning includes the following steps:
- Initial scan to base line the production systems using a hardening environment
- Review of the Vulnerability Detail Reports(VDRs) for each code vulnerability
- Provide VDR’s to vendors
- Apply code vulnerability patches obtained from vendors
- Rescan to verify the code vulnerability has been addressed
- Scan every time maintenance is applied