IT security is like spinach — necessary for well-being, but few enjoy it. However, the advent of business compliance is a rare opportunity to improve both security and the benefits derived from it. Thus, IBM's recent announcement of software for encrypting file formats on mainframe tapes and disks, is not merely another System z9 encryption story: It rounds out an IBM mainframe security solution that should set the standard for another generation of business-critical system security.
IBM says its new System z9 z/OS software is specifically aimed to "help organizations … adhere to compliance laws." Over the last 30 years, at the least, customers have testified that the IBM mainframe is the "gold standard" for IT security, one that users depend on to protect their most trusted computer-based information assets. The new announcement shows that IBM senses the new difficulties and opportunities of security, and is moving proactively to answer customer needs.
So what is the impact of business compliance on security, and why is IBM's response appropriate?
Business compliance and security
In IT terms, business compliance is primarily about ensuring rapid access to information required by regulatory or legal authorities — all kinds of information, and access no matter how old the data is.
Business compliance impacts an environment in which the main focus of security has been the prevention of access to key proprietary information by unauthorized users. Enterprises may have accomplished prevention by disguising data (encryption), by erasing data as soon as possible, by removing data as soon as possible to a secure facility (archiving), or by controlling access to the data (access control, firewalls, and so on). In other words, security has emphasized keeping people outside a carefully chosen circle away from information; business compliance emphasizes giving new people outside that circle (and outside the enterprise) access to information.
Table 1 below shows the evolution of security caused by the clash between security and business compliance concerns.
Table 1: Impact on Security of Business Compliance
Security TypeBusiness Compliance RequirementResulting Change in Security
| Disguising data | Provide rapid access to undisguised data to regulators/discovery, demonstrate data's safety from malicious attack | Allow encryption on data shared with partners, authorities, improve encrypt/decrypt speed
| | Erasing data | Save data of all types (structured accounting data, semi-structured email, unstructured media files) for many years, provide rapid access to the data | Instead of erasing data, archive in a secure but comprehensive, robust, and rapidly accessible manner
| | Placing (older) data in secure facility | Demonstrate data's safety from disaster, provide rapid access to all types of older data | Combine archiving with disaster recovery, add business-compliance (reporting) and security (firewall, encryption) mechanisms
| | Controlling data access | Demonstrate data's safety from malicious attack, extend right to access to regulatory and legal authorities and often to investors and the press | Integrate access-control and data-access (reporting, querying) mechanisms, make data stored on secure media available outside the enterprise. Use encryption over the internet when transmitting sensitive data.
| | | |
Note that the result of these changes is actually to make security better than before — with less performance overhead, more comprehensive and integrated across all enterprise information, more applicable to inter-organization communication, better integrated with risk management and disaster recovery. Thus, security is harder to do; but, once done, delivers more benefits.
IBM's Response
Table 2, below, shows the ways in which IBM System z9 is aiming to incorporate the needed changes in security.
Table 1: Impact on Security of Business Compliance
Security TypeBusiness Compliance RequirementResulting Change in SecurityIBM Mainframe Offerings
| Disguising data | Provide rapid access to undisguised data to regulators/discovery, demonstrate data's safety from malicious attack | Allow encryption on data shared with partners, authorities, improve encrypt/decrypt speed | Encryption Facility for z/OS 1.1 extends mainframe encryption to tape/disk to share secure data with partner; allows decryption by non-mainframe partners with Java client program.
Encryption performance is accelerated in the System z9 server.
Recent enhancements in encryption over the internet, with improved performance and simplified implementation.
| | Erasing data | Save data of all types (structured accounting data, semi-structured email, unstructured media files) for many years, provide rapid access to the data | Instead of erasing data, archive in a secure but comprehensive, robust, and rapidly accessible manner | IBM business compliance solution combines IBM reporting, information integration, security and archiving software and hardware (e.g., information lifecycle management) including centralized encryption and key management facilities.
| | Placing (older) data in secure facility | Demonstrate data's safety from disaster, provide rapid access to all types of older data | Combine archiving with disaster recovery, add business-compliance (reporting) and security (firewall, encryption) mechanisms | IBM solution combines IBM reporting, business compliance, disaster recovery, information integration, security and archiving software and encryption and compression hardware
| | Controlling data access | Demonstrate data's safety from malicious attack, extend right to access to regulatory and legal authorities and often to investors and the press | Integrate access-control and data-access (reporting, querying) mechanisms, make data stored on secure media available outside the enterprise. Use encryption over the internet when transmitting sensitive data. | Support for secure encryption keys in z9 Crypto Express2 cards with tamper-resistant Master Key. Support for recent encryption standards (AES-128, SHA-256) in the hardware encryption. Built-in support in z/OS operating system for centralized key management, including disaster recovery.
| | | | |
In other words, IBM is extending System z9 security primarily by (a) integrating security with expanded business compliance and disaster recovery solutions in the servers and in the z/OS operating system and (b) expanding security offerings to improve performance and widen the scope of users employing IBM mainframe security (e.g., to more users outside the enterprise).
Conclusions
The bottom line is that while the mainframe is the gold-standard of security, it's not hack proof—and IBM is smart enough to know it. Take the time to make this upgrade. Big Blue has made it worth the effort.
This document is subject to copyright. No part of this publication may be reproduced by any method whatsoever without the prior written consent of Infostructure Associates. All trademarks are the property of their respective owners. While every care has been taken during the preparation of this document to ensure accurate information, the publishers cannot accept responsibility for any errors or omissions.
About Infostructure Associates
Infostructure Associates is an affiliate of Valley View Ventures that aims to provide thought leadership and sound advice to both vendors and users of information technology. This document is the result of Infostructure Associates sponsored research. Infostructure Associates believes that its findings are objective and represent the best analysis available at the time of publication.
