Controlling mainframe security & sticky fingers.
By Savio Saldanha - Director Mainframe Business, Australia & New Zealand
I pulled out some old vinyl, and watched my 8 year old daughter look inquisitively as I carefully placed it on the turntable, sitting back on the couch, listening intently to the opening riff's of side two of Sticky Fingers, I start to write this piece.
Simply, it is now getting tougher to find out, register and know all the entry points into your mainframe. From programs, web services, users, distributed applications and legacy code all have access to mainframe resources and these resources are controlled commonly by RACF or ACF2. How then do we know that all resources are adequately secured, that there are no holes in the security fabric that keeps our processing reliable and our information secure.
From my research, I have found four key area's that have increased the risk associated with managing security and compliance on mainframes, these include;
- Mergers and divestiture of government departments
- Reduced skills and an aging workforce
- Reduced budgets and resources allocated to managing and monitoring security
- Inconsistent measuring of metrics that define an organizations security posture
Let's look at each of these in turn to see how the quality of an organizations mainframe security posture is affected.
M&A (Mergers and Acquisitions)
The number of organizations that have merged in the last several years has increased and with the flexibility of the mainframe platform, combining workloads into virtualized processing areas, LPARS, is simple, reliable and now a common and standard business practice. Little thought though typically goes into the integration process, as long as there is minimal disruption of the revenue or service providing applications, efficiencies are gained and short term success is achieved.
Achieving rapid ROI of the merger, which results in "the slapping" together of real business applications, commonly see's minimal resources being allocated to integrate complex components such as the identity and access, security layer. Commonly, these security resources are just simply replicated leaving vulnerabilities to the platform. In addition this, the security rule of thumb where employees have access to information, only where and when they need it, is seriously compromised.
Reduced Skills and aging workforce
It is now common to find in the largest Mainframe sites around the world have a reliance on a hand full of skilled and commonly, aging, security specialists. Younger, security administrators, often outsourced with minimal skills and limited site knowledge, often, execute commands with incomplete knowledge and little investigation. Commonly, ACF2 and RACF use syntax they just don't understand and have an interface that makes what should be a logical and systematic process seem foreign, clumsy and error prone. This leaves a situation where, minimal diagnostics are being carried out prior to making changes and validation of changes and the affect of those changes is limited to simple user testing. Lack of automation and skills in the area of mainframe security systematically adds increases the vulnerability of the platform over time.
Reduced Budgets and resources
Mainframe security, with its history of reliability and just getting on with supporting a growing business with little fuss and demands, means that it is often overlooked when it comes to allocating budgets for improvements and health checking / risk checking. Even working with auditors, whom are seen as the equivalent of a visiting dentist - just something you have to endure, are now struggling to know what to ask and how to measure the quality of answers to the questions they are asking. Often sites just automate the same reports, year after year to demonstrate audit compliance for the mainframe. There is really no underlying trend measure of the health of the security platform.
Inconsistent measures.
Every team member and every team that manages mainframe security does things slightly differently. If you were in charge of the security for the platform, what would you set up to measure and monitor the security health (security posture) of your mainframe platform? How would you know if you were trending upwards, or downwards with respect to your ecurity posture? How would you know if changes to your business exposed vulnerabilities, that were yet to be exploited, but were still vulnerabilities? How could you continue to reduces costs while doing more work and most importantly, how can you do all this while ensuring that you maintain your current level of service and business agility.
The only way today to bring a level of consistency to managing security for the mainframe is to automate. Automation of the management of the security layer will and reduce the likelihood of "Sticky Fingers" exposing vulnerabilities in the world's best business computing platform.
Coming Up Next
The next installment - we will look into some simple things that we can automate to simplify processes and reduce security risk.