RE: Source migration from CMS to ICCF

New Message Reply Date view Thread view Subject view Author view Other groups

Subject: RE: Source migration from CMS to ICCF
From: Tim Joyce (TJoyce@alexlee.com)
Date: Wed Oct 01 2008 - 16:36:28 EDT 

Good question! It is not actually the Source being on CMS that is the
issue. The issue is that VM (without a security package) stores the
userid and password in the clear. The auditor says that this could
enable someone to use privileged signon information that could be used
to gain access to PCI sensitive data. I know .. I know! But this is what
Auditor has told us! So we came up with the idea to isolate our VSE
containing the PCI sensitive data by: 

1) Having the users secure telnet directly to the VSE. Disable all Cross
domain VTAM access to the VSE.

2) Migrate all source code and JCL to ICCF. Disable VM virtual readers.



The auditor has (so far) signed off on our plan.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Tim Joyce
Sr. Systems Programmer / Project Leader 
Alex Lee, Inc. 
Email : tim.joyce@alexlee.com 
Phone: (828) 725-4448  



-----Original Message-----
From: owner-vse-l@Lehigh.EDU [mailto:owner-vse-l@Lehigh.EDU] On Behalf
Of Frank Swarbrick
Sent: Wednesday, October 01, 2008 3:49 PM
To: VSE Discussion List
Subject: Re: Source migration from CMS to ICCF

I am curious as to what exactly the PCI requirement is that says that
the
source code must be stored on a PCI compliant operating system.  As far
as I
know, source code does not generally contain card numbers, PINs, track
data
or CVV data!

Frank

n 10/1/2008 at 7:02 AM, in message
<872B804BF70BBF4D8A7FA0891917FBAE031E8DFC@ALIEXSVR.ali.alexlee.corp>,
Tim
Joyce<TJoyce@alexlee.com> wrote:
> Hey Guys,
> 
>  
> 
> For PCI reasons, we have created an isolated VSE machine that will
have
> no virtual reader connection to VM/CMS. We need to migrate our source
> (JCL and Programs) from CMS to the VSE/ICCF libraries. Anyone have
> recommendations as to the best way to do this?
> 
>  
> 
> Thanks, Tim
> 
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> 
> Tim Joyce
> Sr. Systems Programmer / Project Leader 
> Alex Lee, Inc. 
> Email : tim.joyce@alexlee.com <mailto:tim.joyce@alexlee.com>  
> Phone: (828) 725-4448  
> Fax: (828) 725-4800
> 
>

New Message Reply Date view Thread view Subject view Author view Other groups

This archive was generated by hypermail 2b25 : Mon Oct 13 2008 - 08:50:07 EDT