Recovery from Tampering

The situation of a security breach is expected to be rare. Therefore, the recovery is not integrated in the daily workflow and processing logic. In order to recover from such a situation, two alternatives are provided: privileged delete or database repair.

Database Repair

A database repair tool which will correct all inconsistent signatures in a AvantGard Trax data- base can be provided. Note that the separation of the database administrator role and access to the database repair tool is crucial in the support of a secured setup as otherwise the database administrator would be able to tamper with the data and then correct the seals to cover the tampering. The same applies to the database administrator role and access to the AvantGard Trax enterprise application archive, since this application contains the key used for generating signatures.

The tool is called repairSeals.bat and comes delivered as a compressed file with all libraries and configuration files as required. Some customization of the configuration files can be done in order to control batch size of records per sealed entity to repair (batch) and logging level of the tool (silent true/false). The configuration files are located in the config folder.

batch=100

silent=false

Figure 102 repairSeals Application Properties

In case the system account has an invalid seal, it is necessary to disable sealing, run the repairseals tool and re-enable sealing again.

repairSeals.bat

The final line of the repairSeals command should contain the correct path to the JAVA virtual machine as used by the application server.

C:\WebSphere6\AppServer\java\bin\java com.trax.ogf.sealing.SealerRepairer

Figure 103 repairSeals.bat

Application.Properties

AFTER you have run the repairSeals.bat to initiate the seals of the database, sealing can be enabled by making sure a seal-implementation-list property is available in the application properties file of Trax.

seal-implementation-list=com.trax.system.sealing.AllowedInventorySealer,com.trax.system.sealing.InventorySealer

Figure 104 Trax Application Properties

Trax supports by default data sealing on below objects and fields:

AllowedInventorySealer

InventorySealer

SecurityProfileAuditSealer

SecurityProfileSealer

UserProfileAuditSealer

UserProfileSealer

UserAuditSealer

uniqueIdentifiercodename

UserSealer

uniqueIdentifiercodename

SignerProfileSealer

uniqueIdentifierall uniqueIdentifiers of signers

MandateSealer

code workflowID approvalType

accountGroupIDaccountID accountByDataOwnerID accountByHolderID accountByBankID paymentInstructionTypeGroupIDmessageInstructionTypeGroupIDICTGroupIDCEVClassificationsignerProfile1IDsignerProfile2IDmaximumAmountminimumAmountmaximumCounterValuemaximumCounterValueminimumCounterValuemaximumAmountCurrencyCodeminimumAmountCurrencyCodecheckOnTransactionLevelXPathdescriptionapprovalStatedataOwnerID

PaymentSealer

uniqueIdentifierorderingCustomerAccount/accountNumbercounterpartyAccount/accountNumberinterbankSettlementAmount/amountinterbankSettlementAmount/currencyCodeinstructedAmount/amountinstructedAmount/currencyCodevalueDaterequestedExecutionDateEnvelopeIDrepositoryID

EnvelopeSealer

uniqueIdentifierinterbanksettlementAmount/amountinterbanksettlementAmount/currencyCodecounterValue/amountcounterValue/currencyvalueDaterequestedExecutionDatenumberOfTransactionsrepositoryID

ArchiveSealer

archiveTypeuniqueIdentifierarchiveDateexportDatebusinessDateownReferenceE2EReferencehash of archiveData

PasswordUpdator

AvantGard Trax protects access to users by using passwords and authentication, but someone can still gain access to the database and could try to tamper with the passwords to gain access of the system. In that case the actual user would not be able to login with his code and password and during the login the application would prompt error ‘Invalid login’.

How to update the user password in that case? There are two ways to update the user password:

  1. Admin user can take ‘Set password’ or ‘Reset password’ actions to update the user password.
  2. PasswordUpdator tool:

This tool is packaged inside sealer package. To run the tool, the admin or support user needs to run passwordUpdator.bat (or sh file depending on the operating system). It will prompt for the user code and the new password of the user whose password needs to be updated.

Also, this tool take care of password policy as it checks the password history of the user and other password checks. If the given password is present in the history it will not allow to update the password.

passwordUpdator.bat

The final line of the passwordUpdator command should contain the correct path to the JAVA virtual machine as used by the application server.

C:\WebSphere6\AppServer\java\bin\java com.trax.password.updator.PasswordUpdator

Figure 105 passwordupdator.bat

Application.properties

Old users created prior to TRAX version 5.7.1 are still able to login by making sure ‘use-old-password-algorithm=true’. By default this property is false under the application properties file of Trax.

User password algorithm

use-old-password-algorithm=false

Figure 106 Trax Application Properties