PowerTech Updates Compliance Manager

October 9, 2007 Alex Woodie

System i shops looking for a powerful, System i-based security compliance reporting product may want to check out the new release of Compliance Monitor unveiled by PowerTech Group last week. With the capability to process bigger chunks of security log data from more systems into plain English results that are easier to understand, Version 2.0 promises to be the nontechnical security auditor’s best friend.

Debuting as “ComplianceMonitor” in October 2005, Compliance Monitor is designed to help System i shops satisfy the security audit components of regulations like PCI, SOX, and HIPAA. By interrogating the i5/OS QAUDJRN security log and several other sources of security data via end-point agents, mapping that data into more general COBIT and ISO-17799 terms, and then generating attractive-looking compliance reports in PDF and Excel formats from a Windows-based console, Compliance Monitor allows even nontechnical personnel to accurately assess the strength or weakness of production System i servers.

With version 2, PowerTech has tried to reduce the performance impact that large amounts of security data can have on the system. The new version compresses the audit data when it’s sitting on the “consolidator” tier, an i5/OS-based component of the product that receives log data from the other System i servers equipped with end-point agents. PowerTech says it is able to compress data stored in IBM‘s proprietary QAUDJRN format by up to 95 percent.

By reducing the DASD impact, it now becomes feasible to keep larger amounts of audit data online for the reporting component of Compliance Monitor. This can have a big impact on the quality of the reports generated, especially when comparing present security “snapshots” to older snapshots taken by the software.

Additional new features cited by PowerTech include integration with other PowerTech products, including PowerTech Network Security and Authority Broker, which will provide another source of security data besides the native i5/OS sources; and streamlined report reviews, which allow users to view reports only when there are exceptions to their security policy.

Many System i shops unknowingly put their data at risk when they are pressured by business forces to open their back-end systems to other areas of their company and partners, says John Earl, vice president and chief technology officer with PowerTech. “Compliance Monitor 2.0 helps organizations begin to close this gap by providing a streamlined tool for identifying and reporting security issues relating to the System i vis-a-vis regulatory and industry compliance rules,” he says.

Compliance Monitor 2.0 is available now. The end-point and consolidator components of Compliance Monitor each require OS/400 V5R2 or higher. The graphical console requires Windows 2000, XP, or Vista. PowerTech is also giving a discount on Compliance Monitor to users of its older compliance reporting product, the 5250-based Security Audit. For more information, visit www.powertech.com.