Tango/04 Security and Auditing Solutions

Transcripción

1 Tango/04 Security and Auditing Solutions 7 Keys to Help You Centrally control your entire company Protect your systems in real time Comply with regulations and audits easily Control special users and all others Add a security layer to your data Add customized controls Get ready for the future VSAL securitysuite

2 The Security Challenge

3 Computing Group Protecting your company has never been easy. f you are a CO, a CSO, an nformation Technology manager, or you are in charge of security, you will probably face the following difficulties Chaos and Complexity Multiple users, servers, operating systems, platforms, applications, and databases coexist in your company. verything is interconnected and now portable storage and communication vices abound. You have installed antivirus, firewalls, S, high availability and access controls. However, these protection layers are just as complex as your information systems, and you still have to tect a critical event among millions of log lines located in different places. s it possible to centralize and simplify security management? Auditing and Legal Requirements Laws get tougher and force you to comply with evermore manding auditing requirements. Regulations such as SOX, HPAA, 21 CFR Part 11, Basel and uropean privacy laws put pressure on T partments. n addition, you want to protect your corporate data against accints and fraud. Programming the required controls inhouse proves to be inefficient, may gra systems, and requires too much maintenance. At the same time, adlines are rapidly approaching and more and more fines are being imposed. Can auditing controls be established in an easy, fast, effective, and profitable way? llegal use of applications is increasing and now affects 56% of the companies surveyed. Losses caused by illegal accesses to information and data theft have increased significantly in comparison to the previous year. CS/FB Survey Computer Crime and Security, 2005 The nemy Within ntrusion etection Systems (S), firewalls, and even the best access control systems fail to tect suspicious activity of those who have a legitimate right to use the applications the internal users. How to control malicious users? How to tect problems caused by negligence or carelessness immediately? How to control special users and programmers? How to tect suspicious activity immediately? Lack of Commitment from Management Management wants to avoid sanctions and fines imposed for not complying with regulations, but is reluctant to invest in T security. You find it difficult to justify the investment required, but be aware that if something goes wrong it will be your responsibility. How to get a security project approved?

4 1 Simplify Security Management VSAL Security Suite SmartConsole consolidates security events from your entire infrastructure in a centralized console, from where you can manage your security policies and activate alerts, reports and automatic actions. iscover VSAL Security Suite Tango/04 VSAL Security Suite is the only multiplatform, extensible, and multilayer security management solution combining powerful protection features, such as real time and historical auditing, with an extraordinary ease of use. VSAL Security Suite is composed of different modules that allow you to implement an inpth security strategy, integrating everything from the external layers (firewalls, Ss) to the core of your business your corporate data. asily Capture the nformation You Need The monitoring engine offers agents and monitors for your different network components, logs and computers. n many cases, monitors can run remotely (agentless), reducing the ployment time and avoiding interference with other applications. ach monitor will only retrieve the information you are interested in and filter all irrelevant data, minimizing process and network overhead to the bare minimum.

5 Multiplatform Management and Centralization VSAL Security Suite allows you to centralize in a single console the management of all the security controls of your T infrastructure so you can instantly visualize all your systems and applications. SmartConsole, the VSAL Security Suite main console, consolidates events and parameters from all your T infrastructure components, regardless of their format or location, standardizing and correlating data from different sources Our extranet is composed of 000 users plus 500 company employees using SAP R/. Tango/04 proved to be a very positive answer to our exhaustive monitoring needs. atabases Transactions Applications Reports Victor Lizarraga CO Helvetia nsurance Security Components VSAL securitysuite Business Views RealTime Alerts Programs Automatic Actions Networks Operating Systems vent Synchronization, Correlation, Standardization and Prioritization VSAL Security Suite solves the problem of the lack of standardization of log files. n addition, it automatically correlates and synchronizes events coming from different sources (for instance, from the application server, the Web server, the database server and the backend server). vents are filtered and important problems are highlighted using easy to unrstand and immediately recognizable color coding. Furthermore, they can be prioritized according to the impact on the critical applications affected. Auditing of Logs, Syslogs, XML, HTML, SNMP traps, event logs and security components Automated universal control of logs and alerts coming from firewalls, antivirus, S, Web servers, applications, network components and much more. Servers Management of security policies, access control, passwords and parameters on Windows, Linux, NX, AX, HPX, Sun Solaris and iseries systems. Tango/04 software allowed us to implement efficient compliance controls in record time. t surpassed our expectations. We are very happy. Ricardo Martin Systems and Security irector SR Geopost sers Accounts, roles or profiles, superusers, passwords, user resetting and management (adding, leting, and modifying users), with a complete user activity log. Applications Values, parameters and data coming from Web client/server and conventional applications to verify their integrity and availability, including transaction simulation. atabases Auditing of security, users, accesses and SQL queries on Microsoft SQL Server, Oracle and BM B2 B for iseries databases. Recordlevel and fieldlevel auditing You can even capture the before/after values of and later values of individual fields in sensitive tables that are inserted, leted or updated on Microsoft SQL Server, Oracle and BM B2 B for iseries tables. Computing Group

6 2 Act in Real Time Without RealTime Monitoring, There is No Protection VSAL Security Suite allows you to quickly react to threats and vulnerabilities. nstead of discovering suspicious activity in forensic reports several hours (or days) later, our technology automatically and immediately analyzes any breach of the security policies that you have established, whether malicious or due to carelessness. This significantly reduces risk and gives you total control, even if you are not at your sk at the time the incint occurs. asily Prevent Risk and Resolve ncints t is a solid product, essential for Security Administrators today Giuseppe Re CO Soluzioni P, taly The SmartConsole's advanced automation features can react immediately disabling a suspicious user, stopping a service that is unr attack, starting a backup or replication process, or performing other preset actions. f the problem cannot be solved automatically, SmartConsole will send in real time an alert via or SMS to your cell phone or Blackberry vice. The alert will provi you with all the information need so you, or the person in charge, can quickly troubleshoot it. Advanced escalation features guarantee that no critical event is left unattend. f you prefer, SmartConsole can perform other automatic actions, such as showing the user a visual reminr of the security policy or initiating a prefined program. VSAL Security Suite can automatically solve recurring or simple problems using easily configured actions. n case of a complex or serious incint, you can receive a customized alert via or SMS including all the information you need to react and solve the problem immediately. The SmartConsole advanced escalation features guarantee that no message is left unattend.

7 The status of the business services involved can be easily viewed in a Webbased management console, which only requires that you have a Web browser installed. You can drilldown to view the vices, servers, applications and SAROS SRS SOX Audit ashboard ouble click on the icons for more info iseries SRVOR SRVR computers involved. Contraseñas Authentication usuarios SRS iseries Cambios Sensitive Commands politica seguridad Authorization Cuentas lists ventos Object Access l sistema Profiles/Changes Perfiles Grupos Auditoría System Values QSCOFR nicio Batchsesión Processes dominio ser inactivity NTWORK WNOWS nicio Network sesión Attributes Local Backup OBJCTS Windows SRVR Security Cambios politica RecordLevel Policy seguridad Changes ata Changes ventos System vents l sistema SQL Activity NTWORK Cambios politica seguridad Auditoría enied Access ventos l sistema nicio Start omain sesión dominio Session FTP Client Access Change Owner Auditoría nicio Start Local sesión Session Local OBC Firewall nicio sesión dominio Backup Web Based ashboards Security administrators of each platform, as well as the Security irector or CSO, the CO, or operations managers can count on customized management consoles to evaluate the current risks and how they relate to critical business areas. These consoles allow browsing from a highlevel view down to the event tails, if necessary. Also, they can be protected based on the information each user needs, or can be linked to customized reports. o you have enough time to read thousands of lines on hundreds of reports? Tango/04 realtime technology alerts you automatically of critical events and conditions. nstead of reading page after page of auditing reports, only receive alerts about truly relevant incints and security breaches. Avoid reading hundreds of reports, and react when it is still possible to prevent damages. Servers Accesos Backup Sistema asily configure customized dashboards to represent your T infrastructure and business services. For the first time, you can graphically view your entire security policy status and assess its effectiveness on a single screen, drillingdown to the tails of each event with just one click. Computing Group

8 Add a Control Layer Protect Your ata The ata Protection Problem Companies have an increasing need to protect their data because they store and use information that is sensitive for competitive reasons (for example, customer lists), confintiality (such as personal or medical data), legal reasons (financial data regulated by SOX), or simply because it is the core of their business. However, manually managing database security is inefficient and sometimes even impossible. Advantages of ata Monitor Moreover, many auditing tools provid by the databases themselves and created to be used by a BA, generate a large amount of data and, in some cases, can negatively! No triggers used, which guarantees impact performance. an optimum performance when logging changes into databases! To improve security, the auditing log can be kept in remote systems (even in other types of databases)! To increase confintiality, sensitive fields can be masked A Traditional S is Not ffective ntrusion etection Systems (S) have not been signed to protect databases beyond very basic controls. For example, the variations of an SQL injection attack can be endless, which makes them untectable by means of pattern recognition. very! Reports can be generated by a large number of parameters that day, new vulnerabilities are published for the best known databases, which would allow are configurable and can be a skilled user to obtain more control than you would sire. automatically refreshed And if a malicious employee fraudulently alters data, this activity would go untected even for the best of firewalls or PSs (ntrusion Protection Systems). The focus of the fense in pth1 is shifting towards a new level of protection the database itself. This requires solutions specially signed for this problem, such as Tango/04 ata Monitor, a new component of VSAL Security Suite. After Ho ur Camb s Changes ios fu er d evua elve e hora n fech by xter bio rio as 01/0 nal scam ías heros 6/ la ers s a fic sem Seleccióana 000e nivel alt Tod hasvu n ta 01/0 elve o orn ías fechaos 6/20 ca05m25 s ados po Cambios 01/ bios la sem ev fuera 5a 06/ uelv horario Referen 2005e14 r fecha ana cambios fiche Chr Selec cia Tod 0000 ha a fichero ciónono log s l ata fechas ica os s niveros ni sta 01/ 01/06/2005 Change ías la semaref l alto ord ve Fecha 06/ hasta l altdos s er ena 5 na o orpor reporte02/ 255 ensci evuelve cambios 01/06/2005 pd Todo a ficheros Ch Selean cció ges fech ate (Mo as 06/2005 na 255 nivel alto ornados por fecha dosa po Hubo cam dificación). r fech Re Returns all kind bios en Selección a fer a repo fechas enc01/06/2005 FechaFech reporte02/06/2005 la hasta informa ias pda /06/ of data chan rte02/06/00000 te ate selection ges orred ías Hubo (Modificación ción un reg la semana Todos Fecha by data cam14000 istro. 005 rep ). nsert01/06/2 Weekdays bios en0 to 01/06/2 orte02/0 pdan All(Alta). la inform te (Mod Clear (li 6/2005 nuevoificac minar tod ión). ación Repor reg Hubo t ate istr Fue un Referenciascambns 02/06/ o). o fue agr eliminad erten(alla infor registro. egado. 0 p.m. o todo el ta). maci Help Topics niosnu ón un regis contenido tro. elete (li evo regist la tabl Clear (limcle minació ro fue nsern pdate a. (Modificación). inarartodo Tab ro t (Alta agregad n). (lim ). ). ina registr Fue Clear (liminar elimilenado (Bo todo). o. n cambios Hubo rrad más fuer nuevoe enolao información todarch eptodo La o r elimina un registro. tablfu pdate o). ivo) let el do cont atodo. Theregis on elim etro fue Fue enido fue record (linform eliminado elim agre el contenido im tabla. la gado. inad la. tabla. inadatod ina ation n reg os.ed. o elame físic chang conte istro o ción). was nte.nido Table roptab más fue la tab elete (lim nsert (Borr Clear. nd le ro ron elim adop arch ntire (Alta). Jou la. inación). La tabla rnaling conten Table (Bo ivo). rop (Borrado inados. t was Latable (e archivo). fue nnuevo n rrado cleare registro registro elimi tablanada La aud C fuera agregado. d. tenc Trab NT nsert. ión ajo itor fuefísicamente. más física A new orecord e.arc ía par La tabla fue ment elim eliminada la aud hivo). n elimi RH.nado was L/R BSfuero a este ina add H/Ns. itoría). daivo arch OMNA C_01 físfue icame / (SA Program C_P te C nd Journ ntenida NTZRA / 25 LAROS).. a nalin elete d Jo Table rop. g QS (ete su(liminación). L/R urn Q Grup B 81 nción The ario La audit file was alingphysic X01 RHH/ o SC nd Journaling La au laauditoría). M (etención oría auditoría) n (e laally registro para Tabla fueron Progra o másc_ dit _01 Bibli eliminados. ten MP este CA HH d.. M*RR orí elete ciólete arch otecno P a / NA ma. CN One ivo a C_ n La O pa auditoría or fue para TRA more este Clas ra (S archivo *PR P tenlaida. Traba L/RRHH/ estefue e job szwere leted.z / OGAL au VArecord RAAR Q *SCO arctenida. Número B QS LOX0 M OS) hivo fue ditoría). 258 R 1M Grupo(SALAR sua FR CAMPC_P SC OFrio 1) / C_PNA CN Ped_01 01/0 OS Código secuencia A O ro Mar ten6/20 *RRH Bib nd Journa Z liote ida Progr / 258 tínez cont NO SALama lling. Journa ca 1 MadZVA ARMB QSQX0 Nº Rela rid LO Grupo 505 *PRO H 080this Clave Clase tivo Reg lling for *RRHH OFCONA 8 file has end. SNC GR 2.001M /NA 0,00 RBiblio ATO CNTRAL/RRHH AM istro 20 (S) Clase teca *PR Pe *SC Número Núm CAM BSC_01 Table *SCOF OGRAM secue 01/06/2005 PO 2 Ma dro/ Ma 01/06/2005 rtínez País S ero R OFCódig ncia R / 2581 TablSN RAL/F dri VAL 1405 a C CNT NAN secuen d Job Número OR o 05 cont Cód secuencia B igo Grupo POR cia BS ,00 C/R TNG (SALClase Trab C_0 NT OCPedr *SCOFR cont Nº ajo AT RA OFC 01/06/200 / Relat ser Código JOAN o S) cont Nº Martí L/R NA ivo / ativ 258 Rel RHH/N Biblioteca Regis BMadr País 2 nez S 1 sutab SC la JOAN ario o trore20002 País S SALA Program id _01 / Group Nº Relativo Registro RO OMNA gist QSQ 05 C_2.000 *RRH (SA Tra C_ Prog C ro P X01M H baj P LA ram Sequen 2 01/06/2 NT SN ROS) Class *SC,00RA Z L/RLibrary Z*PRO ce Number CAMPO / 25GRAM Oao VALOR su 05 Paí OFR ClavCAT Q 81 2 e ario QSB Accounting Co S X01 FL s S M_0 RHH/NO C Pro Pedro Tabla Martínez C_ CA NSR 1 / Bibli MPgra P oteca M Relative Record T C_P CSTN OmaCNQS NA (SAL Clase Country S AM TRA Number 2000 Z CO Cla R Traba L/RR ve jo AR Q AN Z*PR HH/ 2 *SCO Corp. B Número / 2OG T CSTC BACM X0S1M MOS) GruNA SC 58RA po (SA FR CA sua _01 1 OF rioo 56 MP LAR / C_P Ana Rod CN Código secuencia OS SALS A O C_P *R 01/06/20 Bibliote ) YT RH Z rígu 2 Progr / NO 258 Z cont ez 05 H ca 2.000,0 SAL ama MBO QSQ BarAN T AR Nº Relativo ACCTC nas O ROGR Clase X0celo Clave *RR*P 1M Registro SNOF C 2 HH 2.00 C NA CNTRAL/RRHH AM Biblio An0,00 ATO *SC /NA Clase teca *PR(S) a NúmeNúm SA CAM País14000 Table *SCOF ro ero LA OGRAM BarceRodrígu PORO CNT 01/06/2005 secue 01/06 BSC_01 R MBO ez / ROFCA ncia S sec /2005 Tabl RAL/F ac SN ANT lon 140 Cód NAN uen Job o igocont a C/POR/ 2581 Número 00 AnaCódig B ATO BS 2.0S C secuencia Trab 00,00 TNG NT cont cia C_0 Clase 01/06/200 ajo NºRod (SALS) RA Ana Nºrígu *SCOFR Relat 1RH OFC / C_PGrupo ser L/R Código Rel ivoez Barcelo NA ocont íguez Z / 258 Rodr Tab Regis B JOAN País su País 5 14S H/NBiblioteca la tro 200 na ativ S 08 Reg 1 ario Barc OM C 08 SALA Program elona 01 _01 / C_Group Nº Relativo Registro istro S000 RO NA*RRH Tra C_ (SALA C QSQ Prog baj CA P /06/2 P CAM X01M H ROS) Class NT o ram MBO Sequen BO SN ao QS Key RA Z L/R Library,00 ce Z 005 CAT Numbe / su 140 CAMPO *SC 25 r B *PRO ANTS Clav Paí 00 OFR AnaAn Q 81 RHGrup GRAM SX01 eario a Roíguez Accoun Rodr H/ o s S CM ting FL CAMBO drí Pro _0 C_P guco MNA Tabla Ana 1 / C_ Ba Rodríguez ez BibliNO CA Barc grao ma CN BFO rce otec MP Relative elona lon a (S P Record CSTN Z Rodríguez a ALAR Clase Number 2000 QSQ TRA Country S *PROG 2.5Ana Traba L/RR 00,00 jo AM B SOXY AN RA O 1,00 *SCO B Núm & X0 T Grupo Z / 258 CSTC ero secu S Co.HH/ 1M CAMP SC O FR 1 M S) sua (SA _01 OF rio 5862 Ana LAR CHAN CN / C_PBiblioteNA O C_P CódG *RRH Rod OS) AYT 01/06/10 igo cont encia 11 SALS NO Z / 258 Progr ca ríguez Z MB SAL ama 2.000,0 AN SOXY AR *P 1H Nº&Rela celo 0S OO QSQBar ACCTC Co.tivo T Cla na OF X0 Clave CNA *RRRO 1M SN Registro 2.00 a0,00 HHGRAMClasese C An 5862 *S ATO CNTRAL/RRHH 2002 Rodrígu Biblioteca /NA SA (S) Númroero *PROGR Núme OFRCA LARO CAM *SC Table Ba ez / PO COF CNT 01/06 MB 01/06/1005 rce AM 0O secue BSC_ R 2.500,0 TablC ncia 11 /1005País secuen lona NAN SN S / 2581 a RAL/F Cód ANT 1410 igo Job onúmero S 41 cia cont Ped 2.0 ATO C C/R rocódig B secuencia 00, POR SBSP con Mar NT Grupo 00 01/ TNG Nº JM0 tíne t RA Nº Ana 06/ (SAL Clase Relat / JOAN / 4158 *SCOFR OFC L/Ríguez Rodr RelCódigo S) ivozo ativ Tabser NA cont RH B Regis la su JOAN H/Biblioteca1 S País tro 200 ario País Registr Barc Celona 1041 S SALA _01 / C_ Group Program 2.50 NA 2 Tra Nº Relativo S RO o C 0,00 Registro C_ (SA baj CA 2002 Prog QSQ 2 P *RRH NT o a PZ LAH CAM MB ram RAX01M ROS) Sequen 01/06/1 Z,00 BO SN Key su Library / 25 Class *SCOFR 005Paí CAT BS ario O QS Pedro O ce Number Clav RHH/Grup *PRO QX01L/R 81GRAM ANTS 11 e CAMPO Pedr s S Accoun Martín NOoM Martí M Pro ting _0 FL C_PC CAMBO nez grama 1 / C_ Barceolon ez Co Tabla Bibli CA NA*RR HH Barc BFO MP Relative (SAL elona Potec Rodríguez Z Ana ClaCSTN a Martínez CN Record Number QS Clase az / *PR Pedro ve joo 2.5 TRA AR Country AM Q Traba OG 00, L/RR S 2002 O SOXY 00 ero X0 *SCO Gru B,00 Núm HH/ 1M & Co. po NA2581 RAMS) CA CSTC FR secuenci SC O B MP sua OF _01 CHAN 5862 CNrio Ped *R(S) / Bib Cód AO a 14 ro Mar 01/06/20 igog NO SALS cont ca Z / RHH tíne C_Pliote YT C_P MB Progr SAL ama Mad 2.500,0 AR 1 Nº Rela ACM ROGR rid Z 0 z *P258 Clase O O QSQ Corp. OF ACCTC tivo Reg C X0 Clave SN NAATO 1M AM 2.00 Pe 56 istro 20 0,00 dro Biblioteca /NA CNTRAL/RRHH SALAC Clase *SCOFR Núm Martín *PROGR(S) 02 Núme País eroro secue ROPO Ma CAM *SCOFR 2.500,0 Table 2dridBSC_01 ez 01/06 AM S /06/ secuen ncia 14 SN CNT /2005 Tabl Cód / / 2581 C a Códig 1411 igo onúmero cia 14 RAL/FNANC/R ATO Job 00 cont con CNT POR 01/06/200 SBSP NºNºRel B t secuencia Grupo TNG 14 JM0 RA (SALS) Clase Relat / JOAN / 4158 OFC ativoivo 2 Pedr ser *SCOFR L/R o Martí Tab NA 5 14 Código 08 RHnez cont laario BS Regis 08 JOAN su H/N 1 Registr tro País S Biblioteca País C_01 Madr SALA Program id / C_ OM o Tra NA Group Nº Relativo S RO 2Registro C baj (SA C_NT QSQ Prog /06/2 o *RRH P PLibrary LARO X01M ram H RA Sequen SN a Z,00 Key su L/R Z Class *SCOFR ce Number B Paí S) 005 / 25*PRO ario CATO QS RHH/ Grupo CAMPO S Clav Q2 81 GRAM s X01 S 0 Accounting Co Progra e _0M C_P C FL 1 / C_ *RR NA ma Bibli CA HH Tabla Pedro Martínez oteca (SAL ATO P Relative Record Z S BORR MP O QS CSTN CN ARO Clase Number 2002 Country S Q AOS Z / 2*PROG Traba X0TRA L/RR VA Gru RAS) ACM jo AM *SCO B Número LO 1M 58 HH/ po Corp. M CA CSTC R 1 B MP FR NA OF sua OArio O *RRH (S _0.000,00 Bib LuisSC 56 Código secuencia / C_P lioteca 01/06/20 BCN Lóp SALS C_P H ) YT *P cont Z RO SALProgr VABar / 258 Zez 2 Grupo AR LO celo 1 Clase Nº Relativo Oama OQSQ na 0 ACCTC R2.000,0 GRAM X0 SNC Clave Registro Lu***R *RR 1M *S 2ingi is Ló HH estr ATO Número pez Clase COFR do*** *PR /NA País Barce lon CNTRAL/RRHH rosec *SCOFR Cód Núme Table OGR (S) uen PO SNCCAM secuencia 01/06 S a RAL/F /200501/06/2005 BSC_01 igo / /AM cia ***RCNT ATO Códig ocon NANC/R OR Job estval tcont B Número rin JM0 secuencia Nº Rel POR 01/06/200 TNG o*** / JOAN SBSP Luisgid Nºativ (SALS) Clase OFCser Relat 5 Lópe o ivo *SCOFR NA / 4158 z Código 08 cont Regis08 Reg 11 País S JOAN 14 1 tro Biblioteca istr Barce 200 País 5 o SALA lona Program Group 20002Registro RO QSQ S Nº Relativo X01M ***Restring SNKey Sequence Numbe 01/06/2 CATO CAMPO Class *SCOFR País ido*** Library r VALOR S Accounting Co FL Luis López NSRT Relative CSTNAM Record COR Country S Number 2000 SOXY 2 & Co. CSTC C C C C F CF F F F With Tango/04 ata Monitor you can save the original value of any field or set of fields in a database record, in addition to the modification ma, giving you maximum control to tect fraudulent activities. Table Job ser Program Key FL CSTNAM CSTCO SALSYT ACCTCO CNTRAL/FNANC/PORTNG (SALS) / 2581 BSC_01 / Class *SCOFR Group JOAN Library Sequence Number Accounting Co Relative Record Number BFO SOXY & Co O 5862 ***Restringido*** SALSYT ** ***Restricted* ACCTCO CHANG SOXY & Co /06/ Country S

9 1 Know Who, Where, When, How, and What n addition to logs for policy changes, users and roles, SQL sentences executed and typical database events monitored by the VSAL Security Suite agents, the new 2 Tango/04 ata Monitor captures, in real time, the date and time of access, the type of access, the actual user, and even as an option the current and previous values for the accessed record. This way you have total control over who updates sensitive tables and how, even at field level including those accesses performed from outsi the applications to avoid frauds and comply with the most manding audits. Comply with SOX, HPAA, 21 CFR Part 11 and Other Regulations Without the appropriate tools, it is extremely difficult to comply with regulations such as the SarbanesOxley Act (sections 02, 404 y 40), HPAA or 21 CFR Part 11 (prescribing the need to save an audittrail log of access to sensitive tables). With Tango/04 ata Monitor, you will have total control and no problem to comply with current and future regulatory requirements, such as those rived from Health nsurance Portability and Accountability Act (HPAA) GrammLeachBliley Act of 1 (GLBA) SarbanesOxley Act of 2002 (SOX) California's Senate Bill 186 (SB 186) SA Patriot Act of 2001 Feral nformation Security Management Act of 2002 (FSMA) FA Mornization Act of 17 (21 CFR Part 11) uropean nion Privacy irective on ata Protection Basel the new capital accord Know the answer to these questions What did the BA do this week? What data has been leted from PAYMNTS? Who has modified NVOCS at night? What changes have been ma to permissions and roles? What changes to sensitive tables has JOHNSON ma in the past month? What fields have been changed in PAYROLLS over the last quarter? What changes have been ma without using the official company application? How many additions and terminations have been ma to a given table? Who has modified the SALAS table without being part of the Human Resources group? What records have been inserted, altered, or leted from a highly sensitive file? And many others ata bases ata bases Without Tango/04 ata Monitor A malicious user (or a disgruntled employee) who has bypassed generic controls can access confintial data, lete, or alter vital information. With Tango/04 ata Monitor atabases are protected since any modification is immediately logged, including those ma by BAs and legitimate users. Also called layer fense. 2 Optional module that can be licensed separately or together with the suite. Available for Microsoft SQL Server, Oracle (from 2006Q), and BM B2 for iseries databases. Some controls pend on the version, service pack, distribution, and/or release of the operating system, application and database, and may not be available in some cases. Computing Group

10 4 Control Special sers and All Others The nemy is nsi As mentioned before, Ss, firewalls, and the best access control systems are useless when it comes to tecting struction and fraud attempts performed by legitimate users. Moreover, security regulations and certain laws mand that the activities of power users as well as the access to sensitive tables can be audited. Total Control Over sers Tango/04 is an excellent technical and professional team who supports its customer in each and every opportunity. VSAL Security Suite offers a wi range of monitors to efficiently control users, combining log and event collection technology, good operating systems and applications access auditing practices, with extraordinary database access auditing features. Ruben Villaver CocaCola Femsa, Argentina Typical Controls Over sers Companies using VSAL Security Suite normally use these type of controls* Adding, leting and modifying users Changes of passwords and policies Valid and invalid logins Any access to certain files and folrs Any access outsi work hours or work days Commands executed SQL sentences executed Any alteration to data in tables Attempts to block, change or lete auditing data nusually high number of additions or changes ma to user accounts in a given period of time Control of profiles that have not been used for some time ntegration with HR applications to prevent access from users that are no longer employed with the company, or during temporary terminations Logic controls on business data (for example, discounts to clients should not exceed a maximum) Other customized controls Controls can be executed in real time, and it is also possible to get a list of all the activities performed by a user over a given period of time (for instance, all the commands executed, or all the records changed in a sensitive table). You can get specific data relevant to each platform or database in each system. (*) Some controls pend on the version, service pack, distribution, and/or release of the operating system, application and database, and may not be available in some cases.

11 5 se an xtensible Solution Add Your Own Controls Some tools are signed to easily perform a specific control, but they fail when trying to add a more complex control that truly reflects security policies. Others are signed for a single platform, but are not capable of expanding those controls to the rest of the company's infrastructure. Some of these tools may even comply with your current needs, but, what will happen when your needs change, or when you need to cover more platforms or applications? nlimited xtensibility VSAL Security Suite is a unique solution when it comes to extensibility and scalability. t guarantees an excellent return on investment since you will be able to add more and more controls as you need them, and this will prevent the solution from becoming obsolete every time your control needs change. Tango/04 solutions have adapted to our needs so well that now we cannot imagine working without them. Tibor Herzo T irector K&H Bank, Hungary Total Control VSAL Security Suite provis the following Graphic rule editor (without programming) ntegration with existing company applications Support of multiple operating systems Support of industry standards such as ynamic Link Libraries (LLs), Windows Management nstrumentation (WM), Simple Network Management Protocol (SNMP) versions 1 to, Windows vent Logs, Common vent Base (CB) format, LAP, (Lightweight irectory Access Protocol), XML (xtensible Markup Language), Python scripting language, PHP (PHP Hypertext Preprocessor), Apache, sending as well as receiving Short Message Service (SMS), text files, SAMBA, relational databases based on OBC (including B2), (POP), etc., plus elements that are typical of each platform (such as data areas and message queues on i5/os, Oracle events, etc.) se of any variable or value embedd in an event as a parameter for an automatic action Generic agents (userfined) Support of multiple scripting languages Although many actions and rules do not require programming, for the more complex cases VSAL Security Suite incorporates an open language based on pseudoco very easy to learn and extensible called ALV, including a graphic rule editor with syntax assistance and a JustinTime interactive bugger. t also supports Python by fault in the monitoring engine and can interact with scripts, LLs and programs written in virtually any language. ntegration with Active irectory ntegration with Help esk products And much more Critical Services nternet Online Store New York Office nfrastructure Status LAN LAN Network Network Printer Pools iseries London Availability Line LAN Network Corporate Router Customers Performance Security VPN Pointtopoint line LAN Network WAN Network Line Chicago Office Line Operating Health SQL Server Windows Call Center Servers Computing Group

12 6 Comply with Laws and Audits VSAL Security Suite has allowed us to quickly establish the Sarbanes Oxley controls. on Keating T Manager Henry Schein, SA asily Comply with the Laws of Today and Tomorrow The SarbanesOxley (SOX) financial information disclosure law, the 21 CFR Part 11 rule (food and drug sector), the HPAA rule (health sector), financial and banking regulations, the Basel agreement The number of laws and regulations manding that companies guarantee the accuracy, integrity, and confintiality of their data is increasing. Most of these are also accompanied by sanctions and fines that your company may be exposed to. How can you comply with the needs of today and foresee the threats and legal requirements of tomorrow? Pass Any Audit n addition to powerful realtime auditing features, VSAL Security Suite reports can help you prevent frauds, perform forensic analyses, review policies and be compliant with different laws. Get tailed reports instantly in different formats (OC, RTF, PF, HTML, XLS, etc.). Choose from more than 200 preset reports or create your own report by selecting critical fields. Get these reports periodically via or automatically post them in a protected area of your ntranet. etect suspicious activities; analyze events based on work time and work days, system, user, etc. se these reports to pass audits, comply with legal requirements, and document the implementation of information system management standards and methodologies, such as TL, COBT, BS77, SO 177 and the upcoming SO ser activity auditing ate selection Weekdays 01/01/ to 1// All Windows users activity Report ate 06/0/ p.m. Groups manipulation sername HO1106\HO1106 Group Manipulation Local Group Member Add (65) 02/0/ p.m. sername HO1106\HO1106 System NTAPLC Security nabled Local Group Member Add Memer Name Member %{S } Target Account Name _AAS_CTRLSGO_CHANG Target omain NTAPLC Target Account % {S VSAL Security Suite Reporting System allows you to instantly generate historical reports in orr to simplify forensic analyses and prove the efficiency of your security strategy. sername SSTMA\GAR10826 Group Manipulation Global Group Member Add (62) 02/0/ a.m. sername SYSTMA\GAR10826 System NTBC4 Global Group Member Add Member S Target Account Name omain sers Target omain SSTMA Target Account S Caller ser Name GAR1082 Group Manipulation Global Group Member Add (62) 02/0/ a.m. sername SYSTMA\GAR10826 System NTBC4 Global Group Member Add Member S Target Account Name G_Sistemas Target omain SSTMA Target Account S Caller ser Name GAR10826 Total SSTMA\GAR

13 7 Find a Tool asy to se and Justify Goodbye to Traditional Frameworks Large system management frameworks have proven to be especially inefficient in resolving the problem of security. Their reputation has been significantly affected due to project lays, high consulting costs and the poor results obtained. This is a direct result of their extreme complexity and the fact that they inclu abundant functionality that is not truly required for monitoring processes. f a solution is too difficult and complex, you cannot make the most of it, and the tool specialist becomes the person in control, not you. Show Results Quickly n contrast, VSAL Security Suite has been signed exclusively as a monitoring solution, with ease of use as one of its main characteristics. A lot of effort was dicated to signing the interface and simplifying its features. As a result, VSAL Security Suite can be implemented in days, instead of months. sers are truly satisfied because, without being T specialists, database administrators or programmers, they have total control of the solution and get results quickly. Configuring the Tango/04 software was very easy, even for security audits and monitoring applications. This was very pleasant, consiring the complexity of our TL project. Rob Freeling Consultant Capgemini, Netherlands A Tailored Security Project Step by Step VSAL Security Suite's modular architecture allows you to establish security requirements in successive stages, solving the most critical problems first, or organizing its implementation by platform, application or business service. n a few days, you and your team will be able to learn all the skills need to implement all kind of controls from simple to powerful ones. Count on s Safeeploy Whether you prefer to implement controls yourself, or you choose to have our consultants implement your project in part or in its entirety, remember we are here to provi you with advice and guarantee your success. Our Safeeploy methodology, based on over 10 years of experience implementing monitoring projects around the world, guarantees an effective transfer of the knowledge you need to feel comfortable with the initial results as well as with future challenges. You don't have to be a security expert! Adding controls is very easy thanks to the graphic wizards. Additionally, there are hundreds of fault reports with the most common controls. When a problem arises, multimedia help (documents, sound, and vio) can be displayed containing tailed instructions so that an assistant can solve it when you are not present. Computing Group

14 One Solution, Many Futures Tango/04 solutions will be very helpful when implementing TL processes to manage incints, continuity and service levels. Business Services and Operational Monitoring Though VSAL Security Suite can be used exclusively as a security solution, it shares a number of modules and agents with VSAL Message Center, Tango/04's solution for T infrastructure and operations monitoring, and Business Service Management (BSM). This allows you to expand the scope of your solution now or in the future and reuse many of the modules. t also allows you to create dashboards to see the impact of security problems on the different business applications, which will enable you to better communicate the business impact of problems, prioritize incints and show the actual status of services to the T partment and to final users. Availability management is essential The primary objective of security is to guarantee the confintiality, integrity and availability of information systems. Our monitoring solution can help you achieve the sired availability and performance levels, adding an extra control dimension to your security project. Monitoring a platform or application Simple automation Simple notification Operations Security Monitoring distributed processes KPs Monitoring other platforms and services ser experience control Complex automation Console of consoles Guaranteed notification / Complex escalation ntegration with Help esk Business impact analysis Management of SLAs (Service Level Agreements) Continuous improvement plan Highlevel executive dashboards nternal and external auditing requirements Record level and field change management ata auditing Automation of replies to events BSM vent consolidation and centralization Security logs monitoring Application logs monitoring Automated policy control Auditing reports Realtime control Simple notification T management console Many Tango/04 clients were able to increase the project scope within the assigned budget for complying with laws (for example, SOX), regulations and audits. With the same budget, not only do you cover these audits, but you also get a realtime control solution, in addition to creating the basis of an integral monitoring solution with a great future.

15 No isponible 4,87% isponible 65,1% VSAL securitysuite Maximize Your Return on nvestment Training time, agent installation, license costs all this can be reused to monitor the status of services, SLAs, user experience, availability, etc., just as easily and effectively. Operators, auditors and Security administrators can have different consoles, and if sired operator access to security events can be restricted through a secure subscription system. This way, each user will see what they need to know, and nothing else. Get the Approval from Management Visual Security Suite is a solution that you can expand according to your monitoring needs. se the SmartConsole technology to easily create business service and operations management consoles. Give each partment the information they need with the appropriate tail level. VSAL Security Suite is easy to justify, as the solution has a proven trackrecord in different sectors for complying with legal regulations, and it allows automating the controls necessary to pass audits, reduce the risk of fraud, avoid fines and significantly increase control. f you add the possibility to reuse components, impact analysis and business services monitoring capabilities, as well as its quick implementation and modular license fees, this will allow you to get a quick approval from your company's Financial Management. Application Call Center BSM Application Overview Period October 2005 Calendar Workday Availability Pie Availability Percentages in Time Number of Failures in Time Most Problematic Components BSM Application Overview Report am to pm 100,00% 5,00% 0,00% 85,00% 80,00% Application Status (Management View) Billing Logistics Manufacturing Warehouses Online store Availability Report ate 0/0/ p.m. Failures.21% 16 ( SLA 0.00 % ) ( SLA 15 Failures ) Total navailability Time 1d 15h 24m 4s MTBF Meen Time Between Failures 1d 15h 24m 4s Longest Failure Time 5h 14m s MTTR Meen Time To Repair 5h 14m s Ranking Component Affectation Time # Failures MTTR MTBF % Affec. 1 Timeout nternational Visa 1h 15m 24s 4 1h 15m 24s 1h 15m 24s 24 % 2 Timeout Store Visa 1h 5m 44s 5 1h 5m 44s 1h 5m 44s 5 % Process LSTN m 24 s 1 48 m 24 s 48 m 24 s 11 % CRM Purchasing SOX Click the icon to view root cause Human Resources Call Center n addition to auditing and security reports, the Reporting System module allows you to instantly generate availability and responsetime reports of your applications, actual user experience of Web applications and hundreds of operating health parameters of your information systems. se them to comply with SLAs, justify hardware updates, or feed your ntranet, and extend the power of VSAL Security Suite to Operations and Business Service Management. Reference Customers ABX Logistics AT Agfa Arneg Auchan Aviva Bacardi Bayer BBVA Bank BankBoston Banque Luxembourg Banque Rotschild Boehringer ngelheim becom nformatiesystemen Bridgestone Firestone Cajastur CapGemini CB Bank CelTel Certegy CCG (talian Stock xchange) CocaCola Carrefour ole Fresh Fruit S FootLocker Fortis Bank Fritz Meyer General Optica Genesis MetLife Hispamer NG KBC Securities K&H Bank Kühne & Nagel L'Oréal Luxottica Manpower Mapfre nsurance Nationale Nerlann Nestlé Nike Nissan Norge Gruppen Office epot Pierre Fabre Prada Pfizer Raiffeisenbank Ros Casares Salvesen Logistics SCH Bank Seur Shell Stratapult Sligro Telmex niversal Music Zodiac Zurich BSM Application Overview Page2of2 Computing Group

16 xamples of VSAL Security Suite RealTime Controls General Controls* Centralizing and filtering security events Backup monitoring river and software installation monitoring File systems monitoring Cryptography and authentication events Logic Controls (business and risk mitigation) Health management for services such as FTP, Web, NetLogon, Remote Access, RAS, among others Control whether transactions have been completely processed in distributed processes Health management for firewalls, Ss, antivirus, Active irectory, domain controllers, etc. Business discount, credit risk, payment terms monitoring Health management for business applications Critical indicators of business applications (to ensure their availability and performance) Specific bank controls (transactions in dormant accounts, etc.) nventory controls (transactions validation, etc.) ser (see tail), role, privileged user monitoring Application, database, and server security monitoring ata monitoring (see tail) Human Resources controls (reading and modifications to salary tables, etc.) Timely completion of critical process controls nactive user monitoring Monitoring controls specified by COBT and relevant to SOX Read access to critical tables And many more Port, bandwidth, and network service monitoring Startups and shutdowns se of banned services and processes Connection to removable drives and portable vices Password Changes ate selection Weekdays 01/06/ to 01/06/ ser password changes sorted by date Report ate02/06/ Realtime collection of event logs in any format Customized controls by user, system, type of event, P address, date/time, work days, type of user, user tasks, etc. Crosscheck data from HR applications vent repetition, correlation, filtering, and scaling management vent omission monitoring Web page content monitoring (facement tection) Specific risk monitoring by suspicious or unusual activity pattern Other automatic controls recommend by SO 177 (SO in the future) SOX financial data protection controls, according to CoBiT Web Application Servers Advanced realtime log monitoring, HTML content monitoring and transaction simulation, Java and ARM (WebSphere) metric verification, etc. SNMP event collection, operating health and control metrics of any SNMPv1 to SNMPv vice. And many more Referencias Blocked ser Accounts pdate (Modificación). Hubo cambios en la información un registro. nsert (Alta). n nuevo registro fue agregado. ate selection Weekdays Referencias elete (liminación). n registro o más fueron eliminados. CNTRAL/RRHH/NA (S) BSC_01 / /2581 CAMPO ATOS NSRTAOS 2 CNTRAL/RRHH/NA (S) BSC_01 / / 2581 C F CAMPO ANTS CAMBO pdate (Modificación). Hubo cambios en la información un registro. CNTRAL/RRHH/NA (S) BSC_01 / / 2581 Clear (liminar todo). Fue eliminado todo el contenido la tabla. Table rop (Borrado archivo). La tabla fue eliminada físicamente. nd Journaling (etención la auditoría). La auditoría para este archivo fue tenida. 01/06/ Clase *SCOFR Código cont País S Nº Relativo Registro /06/ Clase *SCOFR Código cont País S Nº Relativo Registro CAMPO ANTS CAMBO nsert (Alta). n nuevo registro fue agregado. 01/06/2005 elete (liminación) hasta 01/06/ Todos n registro o más fueron eliminados. CAMPO CNTRAL/RRHH/NA (S) BSC_01 / /2581 CNTRAL/RRHH/NA (S) BSC_01 / / 2581 CAMPO ATOS NSRTAOS 01/06/ hasta 01/06/ Todos CNTRAL/RRHH/NA (S) BSC_01 / / Luis López ***Restringido*** CAMPO ATOS NSRTAOS 2 Blocked user accounts sorted by date CNTRAL/RRHH/NA (S) BSC_01 / / 2581 CNTRAL/RRHH/NA (S) CAMPO BSC_01 / ANTS / 2581 CAMBO 2 01/06/ Clase *SCOFR Código cont País S Nº Relativo Registro 01/06/ Clase *SCOFR Código cont País S Nº Relativo Registro /06/ Clase *SCOFR Código cont País S Nº Relativo Registro C F Report ate02/06/ Clear (liminar todo). Fue eliminado todo el contenido la tabla. Table rop (Borrado archivo). La tabla fue eliminada físicamente. Fecha reporte02/06/ nd Journaling (etención la auditoría). La auditoría para este archivo fue tenida. Clase *SCOFR Código cont País S Nº Relativo Registro /06/ /06/ Clase *SCOFR Código cont País S Nº Relativo Registro CNTRAL/RRHH/NA (S) BSC_01 / / 2581 CNTRAL/RRHH/NA (S) CAMPO BSC_01 / ANTS / 2581 CAMBO CNTRAL/RRHH/NA (S) CNTRAL/RRHH/NA BSC_01 / (S) / 2581 BSC_01 / / 2581 CNTRAL/RRHH/NA (S) CAMPO BSC_01 / / 2581 CAMPO ATOS NSRTAOS Pedro Martínez 2 2 ncint Record ntries Selección fechas ías la semana Referencias 01/06/ Clase *SCOFR Código cont País S Nº Relativo Registro CNTRAL/RRHH/NA (S) CNTRAL/RRHH/NA BSC_01 / (S) / 2581 BSC_01 / / 2581 CNTRAL/RRHH/NA (S) CAMPO BSC_01 / ATOS NSRTAOS / 2581 CAMPO ANTS CAMBO Luis López ***Restringido*** 2 Grupo evuelve cambios a ficheros nivel alto ornados por fecha 01/06/ hasta 01/06/ Todos Failed Authentication vents ate selection Weekdays Referencias pdate (Modificación). Hubo cambios en la información un registro. nsert (Alta). n nuevo registro fue agregado. pdate (Modificación). Hubo cambios en la informaciónunregistro. nsert (Alta). n nuevo registro fue agregado. elete (liminación). n registro o más fueron eliminados. elete (liminación). n registro o más fueron eliminados. CNTRAL/RRHH/NA (S) BSC_01 / / 2581 CAMPO ATOS NSRTAOS 2 CNTRAL/RRHH/NA (S) BSC_01 / / 2581 CAMPO ANTS CAMBO CNTRAL/RRHH/NA (S) BSC_01 / / 2581 Biblioteca Código cont Clase *SCOFR País S Nº Relativo Registro *SCOFR Código cont País S Clase Nº Relativo Registro Código cont Clase *SCOFR País S Nº Relativo Registro C F /06/ /06/ Report ate02/06/ Clear (liminar todo). Fue eliminado todo el contenido la tabla. Table rop (Borrado archivo). La tabla fue eliminada físicamente. nd Journaling (etención la auditoría). La auditoría para este archivo fue tenida. Clase *SCOFR Código cont País S Nº Relativo Registro /06/ /06/ /06/ /06/ cont Clase *SCOFRNúmeroCódigo País S secuencia *SCOFR Registro S Clase CódigoNº Relativo cont País Nº Relativo Registro Código cont Clase *SCOFR País S Nº Relativo Registro 01/06/ /06/ Númerosecuencia Clase *SCOFR Código cont País S Nº Relativo Registro CAMPO ANTS CAMBO CAMPO CNTRAL/RRHH/NA (S) BSC_01 / / 2581 Biblioteca CNTRAL/RRHH/NA (S) BSC_01 / / 2581 Biblioteca CAMPO ATOS NSRTAOS enied access attempts to sensitive information tables CAMPO ATOS NSRTAOS CAMPO ANTS CAMBO CAMPO ANTS CAMBO CAMPO elete Accesses to PAYCHCK File Selección fechas ías la semana Referencias 2 Luis López ***Restringido*** Clear (liminar todo). Fue eliminado todo el contenido la tabla. 01/06/ Númerosecuencia Clase *SCOFR Código cont País S Nº Relativo Registro 01/06/ Númerosecuencia Clase *SCOFR Código cont País S Nº Relativo Registro C F Table rop (Borrado archivo). La tabla fue eliminada físicamente. nd Journaling (etención la auditoría). La auditoría para este archivo fue tenida. Clase *SCOFR Código cont País S Nº Relativo Registro Clase *SCOFR Código cont País S Nº Relativo Registro CNTRAL/RRHH/NA (S) BSC_01 / / 2581 CNTRAL/RRHH/NA (S) BSC_01 / / 2581 CAMPO ANTS CAMBO pdate (Modificación). Hubo cambios en la información un registro. nsert (Alta). n nuevo registro fue agregado. elete (liminación). n registro o más fueron eliminados. Luis López CAMPO ATOS NSRTAOS ***Restringido*** 01/06/ to 01/06/ Todos Restricted ata Access Selección fechas ías la semana Referencias CNTRAL/RRHH/NA (S) BSC_01 / / 2581 CAMPO ATOS NSRTAOS 2 CNTRAL/RRHH/NA (S) BSC_01 / / 2581 File records lete CAMPO ANTS CAMBO CNTRAL/RRHH/NA (S) BSC_01 / / /06/ /06/ Clase *SCOFR Código cont País S Nº Relativo Registro Código cont Clase *SCOFR País S Nº Relativo Registro Clase *SCOFR Código cont País S Nº Relativo Registro C F Report ate02/06/ Clear (liminar todo). Fue eliminado todo el contenido la tabla. Table rop (Borrado archivo). La tabla fue eliminada físicamente. nd Journaling (etención la auditoría). La auditoría para este archivo fue tenida. Clase *SCOFR Código cont País S Nº Relativo Registro /06/ /06/ /06/ Clase *SCOFR Código cont País S Nº Relativo Registro CAMPO ANTS CAMBO CAMPO CNTRAL/RRHH/NA (S) BSC_01 / / 2581 CNTRAL/RRHH/NA (S) BSC_01 / / 2581 CAMPO ATOS NSRTAOS evuelve cambios a ficheros nivel alto ornados por fecha 01/06/ hasta 01/06/ Todos sers with 0 ays nactivity ate selection Weekdays pdate (Modificación). Hubo cambios en la información un registro. nsert (Alta). n nuevo registro fue agregado. Referencias elete (liminación). n registro o más fueron eliminados. CAMPO 2 CNTRAL/RRHH/NA (S) BSC_01 / / 2581 Luis López 01/06/ Clase *SCOFR Código cont País S Nº Relativo Registro 01/06/ Clase *SCOFR Código cont País S Nº Relativo Registro ser accounts without activity during a certain period of time 01/06/ to 01/06/ All LOP Accesos a ficheros nivel alto pdate (Modificación). Hubo cambios en la informaciónunregistro. Selección fechas ías la semana nsert (Alta). n nuevo registro fue agregado. Referencias elete (liminación). n registro omásfueron eliminados. CNTRAL/RRHH/NA (S) BSC_01 / / 2581 CAMPO ATOS NSRTAOS 2 CNTRAL/RRHH/NA (S) BSC_01 / / 2581 C F C F Fecha reporte02/06/ Clear (liminar todo). Fue eliminado todo el contenido la tabla. Table rop (Borrado archivo). La tabla fue eliminada físicamente. nd Journaling (etención la auditoría). La auditoría para este archivo fue tenida. CAMPO ANTS CAMBO CNTRAL/RRHH/NA (S) BSC_01 / / /06/ /06/ /06/ Clase *SCOFR Código cont País S Nº Relativo Registro Report ate02/06/ Clear (liminar todo). Fue eliminado todo el contenido la tabla. Table rop (Borrado archivo). La tabla fue eliminada físicamente. nd Journaling (etención la auditoría). La auditoría para este archivo fue tenida. Clase *SCOFR Código cont País S Nº Relativo Registro /06/ /06/ Clase *SCOFR Código cont País S Nº Relativo Registro CAMPO ANTS CAMBO nserciones, modificaciones y eliminaciones registros l fichero (LOP) 01/06/ hasta 01/06/ Todos pdate (Modificación). Hubo cambios en la información un registro. nsert (Alta). n nuevo registro fue agregado. elete (liminación). n registro o más fueron eliminados. CNTRAL/RRHH/NA (S) BSC_01 / / 2581 CAMPO ATOS NSRTAOS 2 CNTRAL/RRHH/NA (S) BSC_01 / / 2581 CAMPO ANTS CAMBO SOX Access to Financial Files ate selection Weekdays Help Topics Table Job ser Program pdate. The record information was changed. nsert. A new record was add. elete. One or more records were leted. 01/06/ to 01/06/ All CNTRAL/FNANC/PORTNG (SALS) BSC_01 / JOAN / 2581 JOAN Group Library FL NSRT COR CSTNAM CSTCO SALSYT ACCTCO Table Job ser Program Key ACM Corp CNTRAL/FNANC/PORTNG (SALS) BSC_01 / / 2581 JOAN Group Library CNTRAL/RRHH/NA (S) BSC_01 / / 2581 File records insert, update and lete FL BFO CHANG CSTNAM CSTCO SALSYT ACCTCO SOXY & Co C F C F Clear (liminar todo). Fue eliminado todo el contenido la tabla. Table rop (Borrado archivo). La tabla fue eliminada físicamente. nd Journaling (etención la auditoría). La auditoría para este archivo fue tenida. 01/06/ Clase *SCOFR Código cont País S Nº Relativo Registro 01/06/ Clase *SCOFR Código cont País S Nº Relativo Registro /06/ CNTRAL/RRHH/NA (S) 14 BSC_01 / / 2581 Clase *SCOFR País S 2002 Fecha reporte02/06/ Clase *SCOFR Código cont Nº Relativo Registro País S /06/ Clase *SCOFR Código cont País S Nº Relativo Registro Clear. ntire table content was cleared. Table rop. The file was physically leted Report ate 02/06/ p.m. nd Journalling. Journalling for this file has end. Class *SCOFR Sequence Number Accounting Co Relative Record Number Country S 01/06/ /06/ Sequence Number Class *SCOFR Accounting Co Country S Relative Record Number SOXY & Co /06/

17 SQL Server Controls nstance status Followup of changes of roles and users Transaction log Connections and access SQL statements Locks Table scanning Objects rrors Windows processes tc. Oracle Controls SQL statements run by sysdba ser SQL statements* Role and user monitoring Critical processes Special permissions Relevant users Table auditing xhaustive control of superuser activity Authentication Log monitoring tc. Chronological ata Changes Job Queues Communications Backups Security BPCS Jobs Abusive SQL nused evices VSAL message center 08/01/ p.m. References nsert pdate elete Summary iseries Controls Windows Controls Total Operations 7 System access Profiles and users Special users activity Adopted security (use of privileges) Sensitive commands Objects (integrity, accesses, saved / restored, etc.) System values Spool files QSYSOPR, QHST, system auditing log and any type of log nactive users se of service systems Message queues tc. Changes in auditing configuration, privileges, directory services, domain policies, etc. Complete, realtime verification of the event Log Automatic verification of plain text logs (in any format) in real time Control of Active directory, S, firewall service, SA Server, xchange, Citrix, Remote Access, AS, enial of Service, etc. Access to folrs and files Changes in system folrs Connection of removable drives nvalid logins Status of critical services nactive users etection and retention of suspicious processes tc. nserts (28,57%) 2 nserts (28,57%) nserts (28,57%) 2 SCRTY STATS SRVR APOLLO NTWORK SCRTY PRMTRAL STATS NTRNAL STATS Auditing changes FTP XC Authority changes OBC & JBC Adopted Audit Client Access Sensitive Files BPCS Accesses Sensitive Program SAP R/ xecution Abusive SQL sage SQL M/RA Spool File Access Object eletions M J dwards Production Object changes Late hours Connection Remote ser Profile changes Commands Password changes Telnet File Server System Configuration changes Linux/nix Controls (AX, HPX, Solaris, etc.) B2 B Controls Complete, realtime verification of syslogs Changes ma to system configuration (password file, /etc/security/config, system environments, etc.) Control of superusers nvalid logins Changes in folrs and objects Changes in privileges and user accounts Getting privileges (becoming a superuser) Change in security policies Automatic verification of plain text logs (in any format) in realtime ncoming and outgoing FTP files Sensitive command management (mkuser, pass, rmdir, chrole, chmod, etc.) etection and retention of suspicious processes tc. se of special editing tools (F, STRSQL, etc.) Control and restriction of exit points SQL statements nteractive SQL auditing Record accesses tc. Plus xecution of automatic actions vent and incint management according to TL recommendations Highlevel control dashboards All kinds of auditing and forensic reports ntegration with other security products and applications of any kind tc. Total Operations Total pdates Total nserts (*) Some controls pend on the version, service pack, distribution, and/or release of the operating system, application and database, and may not be available in some cases. Computing Group

18 Five Reasons to Choose Tango/04 Minimum risk asy to use. n contrast to large T management solutions, which require months or years to implement before becoming operational, Tango/04 can be signed, installed and configured in a matter of weeks and at a fraction of the cost. Open and flexible software architecture Open. All Tango/04 products are signed based on open standards, allowing you to incorporate new functions and components. Furthermore, Tango/04 allows you to create new agents to cover future business requirements. Latest generation technology legant and Morn. All Tango/04 software is veloped from the bottom up using the latest architecture, languages, standards and quality processes available. This allows us to offer you better functionality and performance than other solutions built on obsolete legacy co. We are specialists in systems management xperts in Monitoring. Tango/04 concentrates all of its R& resources and professional services on the automated management of operations, processes, security, service levels and business processes. Maximum satisfaction. Now and in the future. Satisfied customers. All over the world, hundreds of companies and public institutions that acquired Tango/04 products over the last 15 years continue to use them to speed up their business processes. Many find new uses for the software they have or add new modules to resolve new problems. The loyalty and high rate of satisfaction of our customers is one of the best guarantees we can offer you.

19 Tango/04 Computing Group is one of the leading velopers of systems management and automation software. Tango/04 software helps companies maintain the operating health of all their business processes, improve service levels, increase productivity and reduce costs through intelligent management of their T infrastructure. Found in 11 in, Spain, Tango/04 is an BM Premier Business Partner and key member of BM's Autonomic Computing initiative. n addition to receiving industry recognition on numerous occasions, Tango/04's solutions have been validated by BM and have been signated BM ServerProven. Tango/04 has over a thousand customers who are served by more than 5 Business Partners around the world. Technology alliances BM Premier Business Partner BM PartnerWorld for evelopers (Advanced Member) BM Autonomic Computing Business Partner BM SV Advantage Agreement BM arly Co Release BM ServerProven Solution Provir Microsoft eveloper Network (MSN) Microsoft arly Co Release Alliances with local consultancies in every country Awards About Best monitoring product (SA, APX Awards, 2004) Product of the Year 200 (SA, Search400.com) BM All Star award, 17 to now Best Performance Product (SA, Midrange Computing Showcase Product excellence, 2000) BM iseries Magazine Honor Roll, 2001 BM Server Proven certification Computing Group Selected Customers ABB Agfa Amsterdam City Hal Aviva Bacardi Martini Bank of Boston Banque Luxembourg Bayer BMW Bridgestone Fireston CCG (talian Stock xchange) Certegy CB Bank Coca Cola ole Footlocker Genesis MetLife Gillette Government of Hallmark Cards Honda NG Jack Henry Liberty nsurance L oreal Luxottica Manpower Mitsubishi Nestle Nike Nissan Pfizer Prada Salvesen Logistic Shell Toyota Tupperware niversal Music Xerox Zodiac Zurich nsurance Find out how Tango/04 can help you visualize your business processes, control your T infrastructure and achieve the results your organization mands. Visit our Web site Call (North America) (nternational) mail us at info@tango04.com Legal Notice This document and its contents are property oftango/04 Computing Group or of its respective owners when so indicated. Any use of this document outsi the purpose for which it was created is prohibited without the express permission of its owner.likewise the reproduction of this document, in part or in its entirety,by whatever means, be it physical, optical, magnetic, print, telematic, etc.,without the express permission of the owner,is also prohibited. This document may contain technical or typing errors.any pointers in this publication to external web sites are provid for your convenience only and do not, in any manner,serve as an endorsement of these web sites. The following terms are tramarks of the nternational Business Machines Corporation in the nited States and/or other countriesas/400,as/400e, iseries, i5, B2, e (logo) Server BM, Operating System/400, OS/400, i5/os. Microsoft, Windows, Windows NT, Windows XP, the Windows logo and SQL Server are tramarks of Microsoft Corporation in the nited States and/or other countries. Java and all Javabased tramarks and logos are tramarks or registered tramarks of Sun Microsystems, nc. in the nited States and/or other countries. NX is a registered tramark in the nited States and other countries licensed exclusively through The Open Group. Oracle is a registered tra mark of Oracle Corporation. Other company,product, and service names may be tramarks or service marks of other companies.

20 n SA TollFree uropean Headquarters Tango/04 Computing Group Avda. Meridiana 58, 5º AB (Spain) Tel Fax info@tango04.com Sales Offices Tango/04 SA Tel sales@tango04.net Tango/04 Spain Tel Fax info@tango04.es Tango/04 taly Tel Fax info@tango04.it Tango/04 France Tel Fax contact@tango04.net Tango/04 Switzerland Tel Fax contact@tango04.net /04 Argentina Tel (54 11) Fax (54 11) info@barcelona04.com /04 Chile Tel (562) Fax (562) info@barcelona04.com /04 Peru Tel (511) Fax (511) info@barcelona04.com Consult our list of Certified Business Partners on our Web site.