AP-Journal Application Security & Business Analysis

1. AP-JournalApplication Security & Business Analysis

2. Part 1 Overview

3. Overview • Application Security & Business Analysis tool • Keeps managers constantly informed on database changes • Produces reports on changes over numerous years Relax. AP-Journal Will Check it for You.

4. Features Reports- based on changes to business-critical application data Alerts (e.g. “Item price increased by more than 10%”) Keeps selected updates in intermediate storage for long periods Cross-application activity tracking (based on common identifiers in ERP, Finance, Shipment applications) Instantaneous access to data covering numerous years Used to meet regulatory requirements - SOX, HIPAA, PCI (Ensures only authorized programs update production data) Based on patent-pending technology

5. What does IBM DB-Journal Support? IBM DB-Journal is generally used for: • Data integrity – handling commitment control to ensure that a transaction involving several updates is complete • High Availability – enabling Hot Backup to ensure instantaneous access to updated business-critical application data • Incremental backup – saving “before” and “after” images of file updates If IBM DB-Journal is enabled, and functioning Use it to its best advantage with AP-Journal

6. AP-Journal Added Value Reports integrating data from multiple applications Powerful Quickly generates user-friendly printed/online reports from journals Convenient Real-time threshold-activated alerts Efficient No programming or changes to applications, no performance impact Reliable Effective storage of only user-selected data in special “containers” Cost-effective Flexible filters based on field data (e.g. Price increased by over 10%) Adaptable

7. AP-Journal Real-Life Applications Alerts to Enforce Changing Business Rules and Policies • Corporate management often changes customer and discount policies • AP-Journal alerts ensure each salesperson handles only specific customers and doesn’t give customers discounts over a certain percentage Long-Term Reports • Mortgage bank uses AP-Journal to monitor the long-term history of all changes madeto loans • Clerks have a user-friendly interface to produce “single-click” AP-Journal reports PCI Compliance • Credit card company is required by PCI regulations & auditors to save many files • Accumulates 10M entries per hour, but monitors and issues alerts on only 5K entries per day using AP-Journal advanced filtering capabilities Using AP-Journal Containers to Save Disk Space • Company that needs weekly reports based on information from journal receivers • Limited disk capacity won’t allow saving information from receivers for more than 1 day • Uses AP-Journal Containers as temporary storage until weekly report is produced !

8. Part 2 Alert Scenario

9. Monday Morning “OK… Let’s define salary thresholds. Assistants: Alert at over 10%...” Mr. Bryan Fields HR Audit Manager Insurance Company

10. Three days later… “Finally… I got a 20% raise!” Ms. Jane Smith Administrative Assistant Insurance Company

11. One second later… Mr. Bryan Fields HR Audit Manager Insurance Company

12. At the Greenspan Residence “Dear… Shouldn’t we be done with our mortgage already? It’s been 35 years…” Mr. & Mrs. Greenspan Retired Senior Citizens

13. At the Bank Mortgage Timeline: Greenspan family “In just a minute, I will produce a report that covers all the information about all 35 years of your mortgage: payments, interest rates, guarantors…” 15 Aug 1973 Mortgage start 1 Oct. 1975 Change of interest rate +4% Standard payment $800 1 June 1978 Mortgage frozen 30 Nov 1981 4 Mar 1992 $15,000 installment 1 Apr 1996 Guarantor replaced Change of property 6 Jul 2001 2nd mortgage added Standard payment $1000 8 Jan 2007 1 Apr 2003 Mr. Michael Hill Mortgage Consultant

14. Back at the Greenspan Residence “Goodness! All that information in a single report. This bank sure gives great service. “ Mr. & Mrs. Greenspan Retired Senior Citizens

15. Part 3 About AP-Journal

16. Facts about AP-Journal • Based on IBM DB-Journal receivers • Real-time – operates as soon as database update occurs • No programming • No maintenance – fully automated receivers and containers transfer, backup and removal • Not Based on Triggers – no delay in application, works asynchronous to the application, can operate during off-peak hours • Not intended to support QUADJRN (Security Audit Journal); for this see iSecurity/Audit

17. iSecurity Overview 1 7 Re-Assessment Compliance on Demand Visualizer 8 6 3 Auditing Audit Capture User Profile System Control Central Admin Compliance Regulation (PCI, HIPAA, SOX) or Security Breach or Management Decision 4 Protection Firewall Authority on Demand Anti-Virus Screen Password Action 2 Assessment 5 Databases AP-Journal View FileScope

18. Content From either Receivers or Containers Processes information (Who, What, When…) Records changes to data (“transfer-to account” changed) Compares with previous value (Quantity decreased > 100) Covers dozens of years of application history Format Flexible filters, various levels of detail Timeline reporting Online – enables extension of filters Printed – upon request or via included Scheduler Emailed- in PDF or HTML formats Reporting Features 18

19. Alerts Features • Content • Real-time • Threshold-activated • Enables defining complex rules • Supports comparison to group of items • Fully editable message with field values • Field values appear in Before/After images • Format • Email including alert details • Message queue with alert details • CL script with access to event fields

20. Business Analysis Features • Patent Pending • Traces customer activities throughout all applications: • Mortgage bank: reports containing timeline of all mortgage activity (payments, returns, guarantors) across 7 years • Insurance Company: reports integrating data from policy, collection, claims and accounting applications • Accesses data exceptionally fast • Special-purpose Containers store and index customer-selected business items for quick retrieval • Can also function based upon the IBM Journal Receivers

21. Part 4 Technology

22. Business Analysis: Integrating Data from Multiple Databases Payments Guarantors Interest Rates Loan No. 1 Loan No. field is identified in all databases & indexed Time Operation DB Loan No. Output 20 Apr 01 03 Jan 03 17 Feb 05 12 Mar 05 24 Jun 07 11 May 08 Update Add Add Change Update Update Interest Payments Guarantors Payment Interest Payments 1 2 1 8 9 1 Screen Report All changes to Loan No. 1 are integrated into a single report

23. Processing of Receivers in Real time (or at night) AP-Journal Tech Overview DB1 DB2 DB3 Long-time storage for critical data Journal 1 Alert Before 2 Receivers 3 4 Alert After 6 Reporting System 5 Reporting System Screen Email & HTML Print-out

24. Technical Features • *BEFORE / *AFTER journal types • Remote Journal • Performance optimized for High Availability (HA) Journals containing tens of millions of entries • Operates in parallel to HA software • Automatic exchange of Journal Receivers • Automatic exchange of Containers (AP-Journal’s proprietary database) • Automatic backup of containers • Tracking offline containers

25. Part 5 About AP-Journal

26. Alert Conditions Screen Generate an Alert if the Quantity increases by more than 15% or if the Price drops by more than $20

27. Alert Message Definition Screen Define a Generic Alert message

28. Alert Recipient & Format Define who receives alerts and in what format (email, message queue, etc.)

29. Optional Alert Action Script Capture the offending users’ screens over 5 minutes and terminate their session

30. Display of Database Update Display data before & after any changes which were made from a specific IP address

31. Full Report Displaying All Changes Printable report highlighting the before & after data in fields which were changed

32. Thank You! Please visit us at www.razlee.com