Hot Topics - Messmer The Brain House

Mission organization
Putting a lock on security
BY JIM PORELL
This just in: Another tape with thousands
of consumers’ personal data was lost off the
back of a truck. In a related story, a new
Trojan horse has been detected that has
given hackers access to incredible amounts
of business information. Fear and trepidation
ensue for the online consumer. Brand
images and value are lost based on perceived
mismanagement of security and privacy. Each
day, the complexity of securing a business
seems more challenging than the day before.
Chaos reigns in the complexity of
IT infrastructures
Fifty years ago, monolithic computers were
introduced with punch cards and tape
drives to address data processing needs.
They took up a huge, physically secured
raised floor with tremendous cooling and
energy needs. The capabilities of those
1950’s era computers are less than the
processing and storage capabilities of
the iPod today. In fact, the evolution of
laptops and PDAs has created a portable
computing infrastructure that has
eliminated most of the physical security
value of the “glass house” environments of
the past.
Today the Internet and the complexity
of offerings within Windows ® and Linux
desktops have created additional security
exposures. Many of the tried and true
mainframe security capabilities no longer
appear relevant to this on demand world.
What’s a business supposed to do to
combat these losses? Well, panic is not one
of the actions, though sometimes it seems
that way.
Infrastructure simplification
Many times, a business will look at each
server type, individually, for managing
security. The mainframe team operates
independently from the desktop team,
which is independent of the networking
team. Yet, when all these systems are
interconnected, they’re really overseeing
an enterprise view of security or just a
collection of ill fitted piece parts? In a
security conscious business, looking at the
workflow, from end to end, can yield some
simplifying assumptions that will reduce
operational risk. It will be combinations
of virtualization, open standards and
collaboration across communities that can
help the business simplify.
4 February 2006 z/OS HOT TOPICS Newsletter, Issue 14
Avoiding tortured data flow
In many enterprises, managing the
personally identifiable information
associated with a consumer is paramount
to maintaining a successful brand image.
New government regulations provide
penalties and/or costly actions for the
inadvertent or unauthorized disclosure of
such information.
So how can a business avoid that risk?
Well, the first thing to do is look at how
many copies of the data exist and examine
the overall workflow. In the client/server
era, with all the cheap computing out
there, it seemed that copying the data
or moving it to the applications was cost
effective.
Now, in the on demand and privacy
conscious world, bringing the applications
to the data can be more economically
feasible. There will certainly be copies of
data that can’t be avoided.
But don’t forget all the
temporary data sets, used
to stage extracts from
production databases
and then transferred to
other temporary files and
loaded into the database
of another system. The
business needs to protect
the transient data stores
as well as the master
databases.
Are these
resources protected?
In many cases, a simple
no is the answer. The
above scenario is an example of a passive
connection between systems and leveraging
a file transfer program. By leveraging a
file sharing or file serving structure, the
transient data can be shared between
the systems, thus eliminating a process
step. An instance of the transient data is
sometimes necessary to make the copy and
the audit point of control. What does this
mean to the business? Money savings and
operational risk reductions and that’s music
to most CIOs’ ears.
Protecting data in flight
We’ve established that data needs to be
copied or moved. Electronically, that can
be achieved by database and file servers, as
well as application to application transfers.
These formats and protocols can be
protected in a variety of ways:
1. Making sure the identification of
the user is passed along with the data
2. The data being passed is encrypted.
There are a variety of mechanisms for
cross platform authentication services.
IBM ® provides the Tivoli ® Access Manager
and Tivoli Directory Server to facilitate
some cross platform authentication. In
addition, RACF on z/OS ® supports Digital
Certificates with Public Key Infrastructure,
Kerberos Domain Controllers and its
aliasing functions to map user IDs of one
domain to the z/OS domain.
Data confidentiality on a network can be
achieved by exploitation of the Secure
Sockets Library (SSL) or Transaction Layer
Security (TLS) in a variety of middleware
offerings. In addition, the use of a Virtual
Private Network (VPN) and IP Security
(IPSec) can encrypt all data being passed
between two server systems.
For other removable media,IBM
recently introduced the IBM Encryption
Facility for z/OS, as well as a new
encryption archive system within