Mainframe's midlife crisis: Security

Best practices for safe hardware disposal Beyond consolidation: five reasons why you should start virtualizing Myth of the Million Dollar Database Learn-Fast Guide: Get Up to Speed on Green IT Sign up to receive Security Resource Alerts

January 29, 2004 (Computerworld) -- Twenty years ago, mainframes sat in tight glass houses, accessed by a limited list of select employees. Today, mainframes remain a mainstay of enterprise operations. All predictions of the mainframe's imminent demise have disappeared as quickly as those predicting the end of brick-and-mortar retailing. In fact, industry sources estimate that 30 billion Cobol transactions occur daily; that's more than the number of Web page hits in the same time period.
In today's enterprise, mainframes have shattered their glass houses and are accessible by a variety of network services. In addition to conventional users of core CICS or IMS-based transactions, large organizations (including many financial services companies) are shifting applications from Wintel to Linux on the mainframe to save costs and increase performance and reliability. And Web-based applications hosted on the mainframe's Linux or Unix environment enable millions of customers to access the core transactional data needed to conduct business.
With so much traffic from so many sources -- and new government regulations aimed at consumer privacy and corporate diligence -- it's time for companies to rethink how they secure the mainframe.
Fatigue, inexperience and overconfidence trump security
Marooned on islands, with limited outside connectivity, mainframes have always been relatively easy to administer and secure. It wasn't uncommon for an organization to literally have one mainframe technician per user. Now, it's one technician per 1,000 users. Across our customer base of more than 300 large companies, we're seeing the trend: Experienced mainframe help is overworked and hard to find. You can't just plug in a firewall administrator and expect him to find his way around a spaghetti works of applications and services that were written before that administrator was even born.
In addition to increased connectivity and staff scarcity and knowledge, one of the largest challenges for mainframe security is complacency and overconfidence. Most companies assume that mainframes are secure, simply because of their glass-house heritage. I recently visited a very large European bank that boasted about mainframe security. I made the wrong assumption; with so many applications hosted on the mainframe, it was relatively easy for an insider to abuse and compromise the system. Sensitive data could be copied, records deleted, and all traces of this activity could be removed.
In particular, mainframes are vulnerable to three major types of threats:

1. Malicious data access: Hackers and trusted users have increased potential to access the mainframe's core data repository just like any other platform. The Sarbanes-Oxley Act, the Health Insurance Portability and Accountability Act (HIPAA), the Gramm-Leach-Bliley Act (GLBA) and other standards all point to the need to protect data accountability and integrity. The mainframe can't be an exception.


2. Self-inflicted mistakes: A generation of mainframe masters is quickly retiring, and less qualified or less experienced technical staffers (often rushed and overworked) can inadvertently change code or settings to open up holes or deliver too much authorization to the system.


3. Aged software: The strength of the mainframe is that you can continue to run the old reliable software without too much maintenance. But even mainframe software needs checks, patches and updates to close gaps or simply improve security.

Teaching an old dog new tricks

	Rob van Hoboken is a founder of and manager of technical support and customer services at Consul Risk Management Inc., a security software provider with more than 300 corporate customers worldwide.

Organizations need to take a deep breath and start applying traditional best-of-breed security practices to the mainframe. Here's a quick checklist of the types of practices that dramatically improve security on mainframes:

• Create a mainframe security dashboard: With fewer staffers on the job and more threats daily, organizations need to install a mainframe security dashboard to show the progress of security initiatives. A dashboard should include an overview of who is accessing data on the mainframe, which data groups are accessed most and, ideally, if access violates your security policy.
  Similarly, an overview of the number of users who have been added and removed, the number of dormant accounts and the weakest passwords will provide you with assurance that your mainframe security team is on top of the job.


• Smart centralization: You need to better leverage the mainframe knowledge base you have by wisely centralizing some of the security functions -- particularly administration and auditing -- to less-specialized resources. This can be done with "dummy-proof" mainframe software or with enterprise systems that allow for role-based and policy-driven provisioning of users and auditing of file access and configurations across the enterprise. Your mainframe experts should be leveraged for their expertise, while your central security team and help desk should take on many of the mundane tasks of auditing and administering the mainframe as they do with open systems.


• Reinvigorated audits: Many customers I visit are proud of the number of access violations they were able to prevent when they look at log-on and data-access failures. What about those you didn't prevent -- that is, the vast majority?
  Make it a point to properly configure logging of the mainframe operating systems and the applications on it to ensure you can establish a trail of who touched what data. Then systematically look at key files (data sets), particularly those governed by federal regulations such as Sarbanes-Oxley, GLBA or HIPAA, and make sure your policies are being enforced. Automated tools that enable such monitoring allow this type of routine auditing without requiring an army of administrators.


• Enhanced controls: Look to improve the security controls on the mainframe. Real-time alerting for access violations or misconfigurations is worth considering. You've installed such intrusion-detection systems on the open system; make sure you have similar confidence in your mainframe security. Similarly, ensure that you have solutions that can prevent the mistakes that will be made by the less experienced and less technical staff that you'll need to employ to pick up the administrative burden of the mainframe.

Finally, ensure that your administration and audit functions are indeed separate and serve to check and balance each other.
Even though security threats to the mainframe may not be as glamorous as well-publicized viruses and worms, they are indeed a viable threat to the mission-critical services and information typically found in the glass house. The good news: Technologies for monitoring security have come a long way, and even the simple measures outlined above can have a dramatic affect on mainframe security without requiring a fortune in staff or software.
You can teach an old dog new tricks. You just need to try.

Print this Story

Send Us Feedback

E-mail this Story

Digg this Story

Slashdot this Story

"It's the early 1990s when this pilot fish is challenged to find a better way to support telecommuting — and..." Read more... "It's a cheaper IT Blogwatch: in which Apple cuts the price of the top-end MacBook Air. Not to mention dan..." Read more... Read more Hardware posts or See all Blogs

Microsoft promises four patches next week Google gives away home-cooked Web application security scanner Expect iPhone, Fourth of July scams, security firm says More top stories...

Microsoft trumpets security additions in upcoming IE8 Apple cuts price of high-end SSD MacBook Air by $500 Ultrathin showdown: Apple MacBook Air vs. Lenovo ThinkPad X300 vs. Toshiba Portege R500

This old laptop: Revitalizing an aging notebook on the cheap All it takes is a couple hours and about $125 to breathe new life into an old laptop. Here's how. Bill Gates moves on Is Microsoft's Golden Age over? What are Gates' most memorable quotes? Find out in Computerworld's complete coverage of the end of the Bill Gates era at Microsoft. Five things you should never tell your boss There are some things your CIO definitely doesn't want to hear. Also don't miss the flipside, Five things you should always tell your boss. Hands-On: Firefox 3 fixes what's broke and keeps what's right With its latest version, Mozilla's browser continues to raise the bar for what Web browsers should be. Windows Vista A to Z Reviews, analyses, how-tos, visual tours, hot issues and predictions about Microsoft's new OS. More Continuing Coverage After 9/11: Homeland SecurityAsk a Premier 100 IT LeaderBlackBerry Legal BattleData Security BreachesElectronic VotingFirefoxH-1B VisasHP's Boardroom ScandalHandheld DevicesHurricane Katrina AftermathMicrosoft Legal IssuesMicrosoft's VistaOpen SourceRFID TechnologySCO's Linux FightSarbanes-Oxley ActSpamVoice Over IPWi-FiWindows Meta File VulnerabilityWindows XP Service Pack 3 IT Careers 2010 Four years from now, the IT field will be a vastly different place. Will you be ready? More Special Reports Premier 100 IT Leaders 2007 Best in Class2006 Computerworld Horizon Awards2006 Premier 100 IT Leaders2006 Salary Survey2007 Best Places to Work in IT2007 IT Forecast2007 Premier 100 IT Leaders40 Years of ComputerworldASPs, Take TwoBest Places to Work in IT 2003Best Places to Work in IT 2004Best Places to Work in IT 2005Best Places to Work in IT 2006Business Intelligence Home RunsBusiness Intelligence: Smarter BIBusiness Intelligence: The Future of BICRM Goes VerticalCRM: Sober CRMCareer Planning Guide 2005Careers: IT Profession 2010Computerworld Horizon Awards 2005Data Management: Mining for GemsData Management: Taming Data ChaosDevelopment: Hard-Workin' Web SitesDevelopment: New Tools New ChoicesDevelopment: The New World of Application DevelopmentDevelopment: The Web Services TsunamiDevelopment: Web Services HurdlesDisaster Recovery: Preparing for the WorstE-commerce Grows UpE-mail/Groupware: Big DecisionsFaces of Mobile ITForecast 2006Global MobileHardware: Multiple Cores, Multiple ChallengesHardware: On-Demand Un-HypedHardware: The Shape of Things to ComeHorizon Awards: 10 Cool Cutting Edge TechnologiesIT Management: Guide to Managing VendorsIT Management: Navigating Global ITIT Management: Recovery AheadIT Management: The Future of ITIT Management: The Resourceful Project ManagerInnovative Technology Awards 2004Management: Reinventing ITMicrosoft in TransitionMobile/Wireless Leaders and LaggardsMobile/Wireless: The Untethered WorkerMobile/Wireless: Tiny Gadgets, Huge CostsNetwork Management: Taking ControlNetworking: Turbulence Ahead!Networking: VoIP Goes MainstreamOperating Systems: In the Slow LaneOperating Systems: Linux Goes GlobalOperating Systems: Should You Nix Unix?Outsourcing: Offshore Buyer's GuideOutsourcing: Outsourcing DangersPremier 100 IT Leaders 2004 Best in ClassPremier 100 IT Leaders 2005 Best in ClassROI: Do the Math!Salary Survey 2003Salary Survey 2004Salary Survey 2005Security Action PlanSecurity: Compliance HeadachesSecurity: Proactive SecuritySecurity: Risk and RewardSecurity: Tips From Security ProsSouped-up SecurityStorage: Battling ComplexityStorage: Cheap & Secure Data StoresStorage: Stretching Your Storage DollarsStorage: The Lean Storage MachineStorage: The New Rules of StorageStorage: The Ultimate Backup GuideSupply Chain: Missing LinksSupply Chain: RFID Reality CheckThe Business of SecurityWeb 2.0 SecurityWireless: Wireless At Work All Zones Application Performance Zone Business Continuity Zone Data Center Management Zone Enterprise-Class Security Zone The File Data Management Zone Grid Computing on Windows Zone Security Management Zone ITIL Best Practices Zone The SAS Zone Storage Virtualization Zone Business Intelligence and Analytics Zone See your link here

Learn-Fast Guide: Get Up to Speed on Green IT (Source: Computerworld) Whether it's in the front office or the server room, green thinking can save energy, trees and money. From the Editorial Staff at Computerworld, here's the latest thinking on greening your operations. Download this executive briefing  Virtualization Everywhere Download this white paper, free, compliments of Citrix. (Source: Citrix) Adoption of virtualization is concentrated among large enterprises, while adoption by mid-sized companies has been much slower. For these companies, the cost and complexity of server virtualization solutions has been a barrier. In this paper, we'll discuss how Citrix XenServer" provides simple, economical server virtualization for any size company. Download now! Download this white paper  Long Tail Supplier Collaboration - What's In It For You? Long Tail Supplier Collaboration - What's In It For You? Download this webcast, free, compliments of Sterling Commerce Go to the webcast  White Papers Read up on the latest ideas and technologies from companies that sell hardware, software and services. Deploying Virtualized NetWare on Linux Whitepaper Toward More Flexible, Next-Generation Collaboration Solutions Driving Business Success Through Workgroup Choice and Flexibility View more whitepapers

• Microsoft promises four patches next week
• Google gives away home-cooked Web application security scanner
• Expect iPhone, Fourth of July scams, security firm says
• More top stories 

Cost Effective Scaling with Virtualization and Coyote Point Systems An overview of the industry trend toward virtualization, how server consolidation has increased the importance of application uptime and the steps being taken to integrate load balancing technology with virtualized servers. Download this white paper now!

Get Into Gear! Check out our new personal technology section -- TechGear -- for the latest on those cool gadgets that you just gotta have! Host Mike Elgan provides hands-on reviews and analysis of the stuff that makes IT fun. Head to TechGear

Detect, identify, and locate RF interference in 802.11 WLANs. AnalyzeAir software provides IT network professionals with the vision they need into the hidden world of RF, providing them with the ability to see the spectrum in a visible and intelligible format. AnalyzeAir software lets you see, monitor, analyze, and manage all the RF sources and wireless devices that influence your Wi-Fi network's performance and security, even if those devices are unauthorized or transient. AnalyzeAir Trial Software v3.1 highlights the features found in AnalyzeAir Software using a set of saved spectrum files. Replay the data and experience the visibility that AnalyzeAir Wi-Fi Spectrum Analyzer provides. Note: The trial software is limited to a player version only. It does not communicate with an AnalyzeAir PC card so it does not collect actual spectrum data. Register for this trial now.