# **Rocket® z/Assure® Vulnerability Analysis Program (VAP)**

VAP helps businesses identify, assess, and mitigate security vulnerabilities within their systems, ensuring a robust and secure IT environment with mainframe vulnerability scanning.

### **Why mainframe security matters**

Did you know that up to 71% of a corporation's financial data can be stored on the mainframe? Contrary to popular belief, mainframes can be breached. Many organizations, misled by myths, neglect mainframe security, leading to potential breaches. Every z/OS environment has vulnerabilities - once exploited, hackers can access any data within.

### **Fortify defenses. Without the oversights**

Elevate your mainframe’s security posture with Rocket z/Assure VAP, ensuring your system remains resilient against modern threats while optimizing its performance with mainframe vulnerability scanning.

- **Automated, real-time, binary code scanning:** We make it possible for enterprises to scan the operating system layer of the mainframe to identify zero-day vulnerabilities without the use of signature files.
- **Precise vulnerability detection:** Utilize the power of the Interactive Application Security Testing (IAST) model, pinpointing real vulnerabilities and guiding developers directly to the issues.
- **Detailed vulnerability reports:** Empower your teams with comprehensive insights, streamlining the path to immediate remediation.
- **Proactive defense strategy:** By understanding and debunking the myths around mainframe security, z/Assure VAP ensures a proactive approach to strengthening defenses with mainframe vulnerability scanning.

### **How z/Assure VAP works**

Manually scanning systems isn't just time-consuming—it's impractical. Rocket Software advocates for a systematic, automated approach:

1. Initiate a baseline scan of your enterprise.
2. Review the Vulnerability Detail Reports (VDRs).
3. Engage with vendors using VDRs.
4. Implement patches from vendors.
5. Rescan to confirm vulnerability resolution.
6. Regularly scan before maintenance is applied into your production environment.

### Questions **IT Risk Officers** can ask to determine gaps

##### **Q1**: Is the mainframe environment a part of your IT Risk Assessment methodology?

##### **Q2**: Does your compliance and risk team provide you with ongoing mitigation reports associated with operating system risks?

##### **Q3**: Do you have the proper controls, governance, and communication to leadership on all aspects of securing your mainframe environment?

##### **Q4**: Do you have a Mainframe Vulnerability Management Program? If not, what aspects of the mainframe are included in compliance audits?

##### **Q5**: Do you have compliance solutions that utilize the commonalities in all the compliance regulations?

## What do customers say about **z/Assure Vulnerability Analysis Program (VAP)?**

We never even thought we could have vulnerabilities on the mainframe, but once we began automated scanning, we found the volume and the severity to be much greater than anticipated.

**Chief Information Security Officer**

z/Assure® Vulnerability Analysis Program (VAP)

z/Assure® Vulnerability Analysis Program (VAP)

z/Assure® Vulnerability Analysis Program (VAP)

## Mainframe security products and services

Ensure mainframe security alignment with corporate policy.

## Resources

### Webinar
- [DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy](https://www.rocketsoftware.com/en-us/node/4931)
- [IDC DORA Webinar](https://www.rocketsoftware.com/en-us/resources/idc-dora-webinar)

### EBook
- [Mastering Mainframe Risk Management](https://www.rocketsoftware.com/sites/default/files/resource_files/mastering-mainframe-risk-management.pdf)
- [Rising Cyberattacks Lead to Regulatory Changes — like DORA](https://www.rocketsoftware.com/sites/default/files/resource_files/DORA-Action-Guide.pdf)

### Whitepaper
- [Bringing Security and Resilience Into Alignment](https://www.rocketsoftware.com/sites/default/files/resource_files/DORA-Whitepaper.pdf)
- [How to Start a Mainframe Vulnerability Management Program](https://www.rocketsoftware.com/sites/default/files/resource_files/WhitePaper-MF-vulnerability-MgtProgram.pdf)
- [What Mythos Can’t See: The Mainframe Risk Leaders Are Accountable For](https://www.rocketsoftware.com/sites/default/files/media/documents/whitepaper-what-mythos-cant-see.pdf)

### Infographic
- [Secure Your Mainframe: Stay DORA Compliant and Resilient](https://www.rocketsoftware.com/sites/default/files/resource_files/Mainframe-Security-DORA-Infographic.pdf)
- [Think Your Mainframe Is Secure? Think Again](https://www.rocketsoftware.com/sites/default/files/resource_files/Mainframe-Vulnerability-Management-Infographic.pdf)
- [Simplifying Mainframe Vulnerability Management](https://www.rocketsoftware.com/sites/default/files/resource_files/vulnerability-mgt-infographic.pdf)

### Use Case
- [Enable and Assess z/OS® Compliance](https://www.rocketsoftware.com/sites/default/files/resource_files/enable-and-assess-zos-compliance.pdf)
- [Mainframe Vulnerability Scanning Against Regulatory Requirements](https://www.rocketsoftware.com/sites/default/files/resource_files/mainframe-vulnerability-scanning-against-regulatory-requirements.pdf)

### Video
- [Hacking The Mainframe in Less Than 30 Minutes](https://www.rocketsoftware.com/en-us/resources/hacking-mainframe-less-30-minutes)

## Modernization. **Without Disruption.** ™