IBM Sterling


This portal is to open public enhancement requests for IBM Sterling products and services. To view all of your ideas submitted to IBM, create and manage groups of Ideas, or create an idea explicitly set to be either visible by all (public) or visible only to you and IBM (private), use the IBM Unified Ideas Portal (https://ideas.ibm.com).


Shape the future of IBM!

We invite you to shape the future of IBM, including product roadmaps, by submitting ideas that matter to you the most. Here's how it works:

Search existing ideas

Start by searching and reviewing ideas and requests to enhance a product or service. Take a look at ideas others have posted, and add a comment, vote, or subscribe to updates on them if they matter to you. If you can't find what you are looking for,

Post your ideas

  1. Post an idea.

  2. Get feedback from the IBM team and other customers to refine your idea.

  3. Follow the idea through the IBM Ideas process.


Specific links you will want to bookmark for future use

Welcome to the IBM Ideas Portal (https://www.ibm.com/ideas) - Use this site to find out additional information and details about the IBM Ideas process and statuses.

IBM Unified Ideas Portal (https://ideas.ibm.com) - Use this site to view all of your ideas, create new ideas for any IBM product, or search for ideas across all of IBM.

ideasibm@us.ibm.com - Use this email to suggest enhancements to the Ideas process or request help from IBM for submitting your Ideas.

Add a new idea Subscribe
Status Functionality already exists
Workspace Sterling Connect:Direct
Categories Other
Created by Guest
Created on Jun 20, 2018

RELATED IDEAS

IBM software needs some form of integrity check / digitally signed agent as proof of authenticity

We have a requirement when obtaining software and need IBM to provide an answer around the following requirement:

We need to be able to test the source and integrity of the software being installed in the HSD environments. In my experience, this is the case for AIX and RHEL. I think RHEL uses gpg signatures, which are checked by the rpm install process (with the appropriate public keys in the local repository).

Could you tell us if Connect:Direct goes through the standard signature verification process?

For the Connect:Direct Secure Plus software, we’ll need to do some extra handling. All software that is used has to be approved by the Corporate Information Security validation process. We have an ingress that loosely is:

• SME for tool and/or agent obtains a digitally-signed agent from vendor
o Digital signature + checksum = Best
o Digital signature only = Nice
o Checksum only = Okay

What is your industry? Banking
How will this idea be used?

To validate authenticity of downloaded software, this is a new requirement for the bank.
  • Admin
    Chris Sanders
    Reply
    |     Sep 13, 2018

    Robin,


    I believe Download Director provides proxy capabilities.  Hopefully that will allow access through your firewall in your environment.  As for how to use the capabilities, the checksum is pretty easy to verify.  I've included a link to a Developerworks article below that explains how to verify the chucksum that Download Director creates.  Do let me know if you have any other questions.


    https://developer.ibm.com/answers/questions/217369/where-to-get-checksum-value-of-files-downloaded-fr/


    Sincerely,

    Chris Sanders

    Connect:Direct Offering Manager

  • Guest
    Reply
    |     Sep 7, 2018

    Due to security concerns/issues, our firewall blocks downloads via the Download Director, therefore we must use the HTTP option.

    Regardless of the download method, how do these download options provide the info required from our Corporate Info Security team?

    • SME for tool and/or agent obtains a digitally-signed agent from vendor
    o Digital signature + checksum = Best
    o Digital signature only = Nice
    o Checksum only = Okay

    Regards,

    Robin Overby
    IT Solutions Architect, VP - BB&T
    Wilson, NC 27893
    252.246.3378
    ROverby@BBandT.com

  • Admin
    Chris Sanders
    Reply
    |     Sep 7, 2018

    Thank you for opening this enhancement request with IBM.  I have reviewed the request with my development team and we believe that this capability is provided by the IBM Download Director when can be used to download installers from our Passport Advantage or Fix Central portals.  This should meet your needs, so I will need to reject this enhancement request, but should you run across other suggestions please do let us know.


    Sincerely,

    Chris Sanders

    Connect:Direct Offering Manager

By clicking the "Post Comment" or "Submit Idea" button, you are agreeing to the IBM Ideas Portal Terms of Use.
Do not place IBM confidential, company confidential, or personal information into any field.