I’ve been helping companies on both sides of the pond solve their data security problems for many years now. If I’ve learned one thing, it’s this: when I go into an organization that runs Windows, there’s little question of the need for data security. The organization knows it and so do I. When I visit a company whose IT infrastructure revolves around a mainframe, however, the mindset is often quite the opposite. In fact, the biggest data security misconception I encounter is the belief that the mainframe environment is inherently secure. Most IT staff view the mainframe as just another network node. Why? Because it’s universally perceived as a closed environment and, therefore, invulnerable to hackers.

In some cases, it’s the mainframe IT pros who hold this conviction. In other instances, it’s the executive management team. Lack of management attention allows “bad practices” to continue. I can tell you this without reserve: data stored in mainframes needs protection just as much as sensitive information stored on a Windows server or anywhere else. And, as systems continue to support more data, users, applications, and services, effective security management in the mainframe environment becomes significantly more difficult.

News flash: mainframes can be hacked!

For that simple reason, mainframe security should not be taken for granted.

Even though the mainframe is a mature platform, there is a real shortage of mainframe-specific security skills in the market. And, the few mainframe security practitioners who are out there spend a lot of time implementing configuration and controls within their environments as well as putting into place security systems like RACF, which provide access control and auditing functionality. As for other security measures, in my experience, the mainframe people know about encryption, but they’re not terribly aware of newer data security techniques like tokenization as it relates to protecting data within the mainframe environment and beyond.

Tokenization is a data security model that substitutes surrogate values for sensitive information in business systems. A rapidly rising method for reducing corporate risk and supporting compliance with data security standards and data privacy laws, it can be used to protect cardholder information as well as Personally Identifiable Information (PII) and Protected Health Information (PHI).

In fact, for companies that need to comply with the Payment Card Industry’s Data Security Standard (PCI DSS), tokenization has been lauded for its ability to reduce the cost of compliance by taking entire systems out of scope for PCI assessments. And, even in companies that do not deal with PCI DSS or other mandates, tokenization has proven effective for managing the duplication of data across LPARs and for facilitating the usage of potentially sensitive data for development purposes.

Too often, compliance audits skim over mainframe control weaknesses and there are also fewer mainframe-specific security guidelines. But this does not mean that significant risk is not there. You can apply a risk-based, defence-in-depth approach within the mainframe environment by using stronger mainframe host security controls and by using tokenization to protect the data itself.

To beef up data security on a mainframe, here’s my advice:

1. Bring in mainframe security experts to identify and remediate risks, and to develop and enforce security policies and procedures.
2. Develop in-house capabilities and skilled professionals across the mainframe platform to support security initiatives.
3. Evaluate available security configuration and administration tools – there are some really good ones out there.
4. Apply an in-depth security strategy that includes secure access and authentication controls, and use them appropriately.
5. Adopt encryption and tokenization to protect sensitive information. Through their proper implementation, it’s really not that hard to achieve a true high level of protection within the mainframe environment.

Protecting sensitive and/or business-critical data is essential to a company’s reputation, profitability, and business objectives. In today’s global market, where business and personal information know no boundaries, traditional point solutions that protect certain devices or applications against specific risks are insufficient to provide cross-enterprise data security. Combining encryption and tokenization, along with centralized key management, as part of a corporate data protection programme works well – including in mainframe-centric environments – for protecting information while reducing corporate risk and the cost of compliance with data security mandates and data privacy laws.

Don’t be fooled: your mainframe isn’t inherently secure. Doing nothing is no longer an option!

Thanks Peter for your guest blog.
And remember, there’s still time to complete the mainframe user survey or place a vendor entry in the Arcati Mainframe Yearbook 2012.

Eddolls, blog, mainframe, security, Peter, Goldberg, Liaison, Technologies, Windows, hacked, RACF, encryption, tokenization, PII, PHI, PCI DSS, audits

When IBM introduced the zEnterprise in July 2010, the company also announced plans to deliver additional general-purpose blades for the IBM zEnterprise BladeCenter Extension including IBM System x-based blades running Linux in 2011. IBM also suggested it would support Windows, and in April 2011 it confirmed its plans to deliver Windows support on z/Enterprise.

Read more…

And here we are. It’s almost November 2011, and both are about to come to pass.

The zEnterprise 196 and the Business Class version, the zEnterprise 114, mainframes come with the zEnterprise BladeCenter Extension. Initially this supported AIX on Power blades and Linux on x86 blades. This fit nicely with IBM’s model of the universe because it owns AIX and Linux is, of course, open source – ie it doesn’t belong to anybody. The Unified Resource Manager (URM) controls the operating systems and hypervisors on the mainframe and the blades. But now – the previously unthinkable – IBM promises that it will have Windows running on its HX5 Xeon-based blade servers for the zBX chassis before the end of this year.

Microsoft Windows Server 2008 R2 Datacenter Edition will run on the PS701 blade servers in the zBX enclosures. The zBX extension can have 112 PS701 blades or 28 HX5 blades.

This is clearly important for those sites that use mainframes or are ready to upgrade to mainframes and still have a big Windows-using population. It’s interesting that so many people consider Windows to be the de facto computing platform. I recently had a conversation where Windows laptops were given the metaphor of rats or beetles – they just turn up everywhere – and Linux was given the metaphor of a stealth operating system or a hidden shadow – it was everywhere, but you didn’t see it. Why stealth, well because Linux turns up behind the scenes on routers, on TiVO boxes, on supercomputers, as the precursor to Android on smartphones, making movies at Pixar and Dreamworks, in the military, governments, everywhere!

After Windows on IBM hardware, the next thing we hear is that Virginia M Rometty, a senior vice president at IBM, is going to be the company’s next CEO – starting in January. “Ginni”, aged 54 (as all the releases inform us), succeeds Samuel J Palmisano, who is 60, and will remain as chairman.

Ms Rometty graduated from Northwestern University with a degree in computer science, joined IBM in 1981 as a systems engineer. She moved through different management jobs, working with clients in a variety of industries. Her big coup was in 2002, when she played a major part in the  purchase of the very big consulting firm, PricewaterhouseCoopers Consulting. PwC staff were used to working in a different way from IBM’s and managing that culture shift was down to Ms Rometty.

In 2009, Ginni became senior vice president and group executive for sales, marketing, and strategy.

You’ll recall that Sam Palmisano took over in 2003 from Louis V Gerstner Jr, who’d joined IBM from RJR Nabisco in 1993 and helped turn round an ailing IBM. The previous incumbent had been the lacklustre John Akers.

I suppose with Siri on iPhones and the much less serious about itself Iris on Android, we’ve moved some way towards being able to talk to a computer – even if it is a smartphone. Still no sign of Scotty being beamed up, though!

I’m not talking about some sci fi shrink ray wielded by some fearsome purple-coloured alien, I’m talking about the use of emulation software to make one lot of hardware successfully interpret instructions designed to be used on completely different hardware – and vice versa. The mainframe programs think they are running on a mainframe and continue quite happily – totally unaware of the work being performed by the emulation software.

Fundamental Software Inc (FSI) gave us FLEX-ES, which ran on Intel chips and allowed developers to test their mainframe applications on their PCs. The PC itself ran Linux and FLEX ran under that – emulating a range of mainframe hardware devices including terminals and tape drives. Fundamental also sold hardware allowing real mainframe peripherals to connect to PCs.

In 2000 a company called T3 launched the tServer based on FLEX-ES.

UMX Technologies also offered Intel server emulation – using UMX’s Virtual Mainframe software. The company offered Windows compatibility as well.

Then there was Hercules, an Open Source software implementation of  mainframe architectures. Hercules runs under Linux, Windows, Solaris, FreeBSD, and Mac OSX. Hercules was created by Roger Bowler and was maintained by Jay Maynard. Jan Jaeger designed and implemented many of the advanced features of Hercules, including dynamic reconfiguration, integrated console, interpretive execution and z/Architecture support – according to their Web site. IBM stopped licencing its operating systems for Hercules systems, so users were left with running older public domain versions of IBM operating systems or illegally running newer versions.

Platform Solutions Inc (PSI) developed Open Mainframe servers, Open Systems servers, and NEC D-Series storage arrays. The company’s System64 product line consolidated z/OS, Windows, and Linux operating systems in one secure operating environment based on Intel Itanium 2 processor technology. At the time, Platform Solutions had a strategic partnership with T3 Technologies. In 2008, IBM took them over.

Sim390 was an application that ran under Windows and emulated a subset of the ESA/390 mainframe architecture. The emulator supported most TCP/IP operations (via socket calls using an emulated IUCV interface), and contained a Telnet 3270 (tn3270) server for remote log-in (with IP address filtering), as well as local 3270 sessions. It was possible to run it on a very small machine, such as a Pentium 75MHz with 16MB memory. So says the Sim 390 Mainframe Emulator home page.

But now you don’t need to worry about litigation, old Web sites (and older emulators), or potentially dodgy bits of software. You can have the IBM System z Personal Development Tool (zPDT), which enables a virtual System z architecture environment on x86 and x86-compatible platforms.

The IBM zPDT consists of software that is authenticated and enabled by a USB hardware key, loaded on to the Intel and Intel-compatible platform, running Linux. The zPDT comes with one, two, or three virtual engines, which can be defined as System z general-purpose processors, System z Integrated Information Processors (zIIPs), System z Application Assist Processors (zAAPs), System z Integrated Facility for Linux (IFL), and Integrated Coupling Facility (ICF).

As well as the current IBM operating systems and software, it also supports a variety of real and emulated hardware devices such as disks, tapes, printers, card readers,etc. System z customers, service providers, business partners, and ISVs can get the simpler version as part of the Rational Developer for System z Unit Test (RDz-UT) offer.

So now you can get your hands on a very small mainframe.

This whole change in staff structure is also being encouraged by the advent of the zEnterprise hybrid machines with their zBX blades running everything from AIX to, potentially, Windows. A consequence is that a mainframe specialist could be dealing with a Linux error message, or a Windows SharePoint guru might be trying to understand what’s going on inside CICS. What can you do to help them?

Or let’s suppose in a more traditional mainframe environment, for whatever reason, you lost some of your top technical people. Perhaps they got jobs elsewhere or perhaps they retired early, but suddenly you find yourself with a huge knowledge gap. Maybe you can transfer someone across from the distributed team. Or maybe you can recruit one of the new generation of youngsters who are learning the benefits of mainframe computing. But whatever you do, there will be a fairly long period of time during which anything out of the ordinary occurring is going to leave everyone scratching their heads and searching Google – whereas, previously, your in-house expert knew exactly what to do. So, in this situation, what are you going to do?

Let’s not worry too much at this stage about Service Level Agreements (SLAs) and performance targets. Let’s simply focus on the problem. How can any organization, irrespective of how its IT team is constructed, ensure that appropriate expertise is available at all times to whichever staff members are available?

Obviously you can have the manuals, and some could be on the IBM mainframe portal, but that doesn’t give you speedy access to the necessary information. A Google search will reveal hundredsof pages of results, but it takes a degree of expertise to sift through those and find the correct one quickly. And someone without any expertise could spend a very long time reading solutions to completely different problems before ever finding the right one. Not a satisfactory way to provide IT services to customers – whether internal or external to the organization.

So what would be a good solution? How can these issues of staff working outside their comfort zone be dealt with in a way that is good for the business? And what kind of a solution will still be able to ensure those business-critical mainframes are being supported in a year’s time, in five year’s, or even further into the future?

This is where a new breed of solutions that can address this coming challenge are positioning themselves. One of these, Softlib with its iSolve product (www.softlibsw.com/mvs.aspx), allows an organization to combine all its IT-related information into a single virtual library. That means users – your harassed staff – have to search in only one place, not as previously in many places, to find a solution to any problem. And once you have a single location for information available, you can allow product champions and other IT-literate staff access to it – which should result in more empowered and satisfied users and fewer calls to the Help Desk.

It makes sense to organize the information in this single virtual library using themes, so CICS information might be one theme, IMS another, Linux a third, etc. The information in the library starts from IBM and third-party software vendors’ manuals, and can be supplemented with information from newsgroups and other online resources. Plus, you can add your own technical expertise.

Access to the information can be from a Web browser or a terminal server. It can be hosted locally, or as a cloud-based resource. The advantage of the cloud route is that the information is looked after by Softlib and they already have access to a huge number of the resources you’ll need. So you can start using the facility almost immediately. Plus the online documentation is automatically updated when new information becomes available. Other benefits include knowledge usage analytics that can help address missing or outdated knowledge, and seamless integration with CRM, bug-tracking, Service Desk, content-management applications, etc.

All in all, Softlib’s iSolve product has a lot to offer most mainframe sites, and certainly provides an answer to the question of what to do if you restructure your IT customer support and need to extend the working expertise of your staff onto other platforms such as AIX and Windows. It also offers a solution to the problem of losing key mainframe experts in a mainframe-only environment.

OpenCOBOL translates COBOL into C and compiles the translated code using the native C compiler. You can build your COBOL programs on various platforms, including Unix/Linux, Mac OS X, and Microsoft Windows.

Read more about OpenCOBOL…

During the 1970s, computing, where it existed, was very much a centralized affair. The gods of the mainframe pretty much controlled what anyone was able to do. It was like Stalinist Russia. Everything came out of the centre. You didn’t get it, unless someone at the hub of things deemed it necessary for you to have it.

Currently in the UK, we have the opposite approach in terms of our model of how things should work. Quite logically, you might think, if you live in a rural area with rolling fields full of wheat or livestock, your concerns are completely different from those of someone living in a post-industrial run-down urban area. Of course, this localism easily lends itself to the criticism of postcode lottery. Anyway, we have little islands of individuality separate from each other. Unfortunately, the reality is that political areas tend to include more than a monoculture of just rural or just urban populations. Plus you have different needs for different age groups – you can see where this idea falls down when applied to the real world, but hang on to the little islands metaphor.

Now let’s turn time back to 1989. We find the Berlin wall coming down and the whole centralized power base of the USSR and it’s Warsaw Pack allies crumbling. In the world of computing, we find the balance of opinion has moved right away from mainframes. In the early 90s, their death was confidently predicted. In its place we had millions of underpowered PCs running DOS-based operating systems. And as the 90s progressed we saw the triumph of Windows and Microsoft. We also saw that antithesis of centralization, Open Source software. Unix started life in 1969, and Linus Torvalds’ Linux arrived in 1991. Even IBM, which had developed and standardized the PC in the early 1980s, was working on the development of other platforms. 1988 gave us the AS/400 – now the IBM System i and which now runs on the POWER platform. The RS/6000, running a Unix variant called AIX, arrived in the 1990s and also now run on POWER hardware.

So, having been empowered to make their own decisions and choices of hardware and software, what have users done since then? Well, in the PC world, they go for big servers that are virtualized in order to benefit from the control that gives them. It makes back-ups and business continuity easier.

And now, here we are in 2011 and IBM announces a Business Class (basically not a top-end machine, more one for the everyman mainframe user) zEnterprise – the z114. It’s gone back to being a centralized piece of hardware because not only is it a mainframe, it’s a POWER7 box, and it has x86 blades. So that gives users a smaller footprint, less power consumption, and control of everything using the IBM zEnterprise Unified Resource Manager and the IBM zEnterprise BladeCenter Extension (zBX). The POWER7 blades mean that AS/400 and RS/6000-heritage users have a home. And the x86 blades not only run Linux x86 applications unchanged, but, by the end of the year, are expected to run Windows applications too.

The culture shock at many sites will come when the distributed applications teams (and they may have many different names) discover that all the things they’ve been planning to achieve (virtualized desktops, virtualized servers, etc) are just part of the techniques that the mainframe people take for granted. And the mainframers are going to have to understand that for many of the people in the other teams, it’s in many ways still about 1992 in terms of business recovery times etc. But when the teams do come together, the synergy is going to be very beneficial for the organization that allow it to happen.

This new mainframe, unusually, comes with a published price tag – $75,000. As part of the package you get the IBM Smart Analytics Optimizer to analyse data faster at a lower cost per transaction, and the IBM WebSphere DataPower XI50 for integrating Web-based workloads. The new hardware runs the latest version of z/OS – 1.13. You get 3.8GHz processors (the zEnterprise 196 uses  5.3GHz processors), and you can configure up to 14 of them with 10 specialty processors – zIIP, zAAP, and IFL.

The pendulum has now swung completely back. We have a single box capable of providing all the different computing needs of an organization.

On top of that, you’ve got another layer of IT. People who use laptops with Windows and/or people who use Linux, and possibly bits or Solaris dotted around. These people have more interesting lives. They have to fight to get the best performance. Their back-up strategy is good if they can recover to last night! They probably still insist on people using XP as their Windows operating system because Vista was no good and it’s a bit of a jump to Windows 7. Plus they’re probably coming to the end of a virtualization project to reduce the number of server boxes they’ve got lying around. Parhaps they’re installing Citrix to virtualize desktops, or SharePoint to produce an intranet and join up all the separate islands of computing.

Plus you’ve got remote users, who are logging in over somebody else’s wifi. Or they might be using the 3G network on their smartphone. It’s your fault, of course, because you spent so long changing your CICS and IMS applications so they could be used in a Service-Oriented Architecture (SOA) environment. But, I guess you have strategies in place to secure the connection, and secure what applications they can run, and what data they can see.

In fact, you’re probably convincing senior managers in your organization that it really was their idea all along to combine the strengths of mainframe computing with the flexibility of distributed systems. What your organization needs is a nice z196 mainframe – perhaps one of the planned-but-not-quite-announced Business Class (BC) machines.

For those of you who’ve spent the past year on Mars, the z196 brings together the latest mainframe technology with POWER7 and x86 IBM blade systems, giving potential users z/OS, AIX, Linux, and (coming soon) Windows, all on the one box. At this stage, I should point out that there are very strong arguments for going to zLinux. It’s been around for 10 years now, and is just becoming an overnight success – as they say.

So, there you are thinking that you can use your mainframe experience and expertise to tidy up all the other computing areas in your organization and get them under your control when HR tells you they have supplied everyone on the board of directors with an iPad. Now, you might think this is a good opportunity to bring some of the board into the 21st century, but it creates yet another rip in the secure blanket you’ve been throwing over the company’s computing infrastructure. Can you set up a security policy for iPads? Well, yes, if they come into a Microsoft server – in the same way you would for Mac users. Can you allow board members to download apps? Or can they have only pre-approved ones? Where do you start building proper security? It’s back to herding cats!

And don’t think I’ve singled out iPads, Androids have similar issues. You can download firewalls and anti-virus software for them, but it’s not the same as RACF!

And it might not just be board members – you may still have road warriors that want the small form factor of a tablet. The issues of theft or forgetfulness compound your security problems.

My suggestion at this stage is to wait for Windows 8 tablets, and hope that the policies laid down by the non-mainframe ITers will apply to them. And by then, Windows will be running on our z196 box. So everyone’s a winner!

OK, no-one may have actually said those words as such, but that was the message. Plus, I was with some friends on Saturday when the conversation turned to discussing what use a mainframe was in this day and age! As Arcati Director, Mark Lillycrop, so eloquently put it recently, mainframes are thought of as ‘your dad’s technology’. Most of the people I was chatting to felt that mainframes were relics of the past and anything they can do, a few servers could do just as well!

So for many of us mainframe verterans, our job is to get out there and spread the word. We need to tell people exactly what a mainframe is, what it can do, and how people are interacting with them all the time, but don’t realise it. That way, the new generation of youngsters that are beginning to get access to mainframe technology at universities and elsewhere will arrive with a knowledge of what mainframes can do, and why working with them can be so enjoyable.

So let’s just start with the absolute beginner’s guide to mainframes. They are computers – just like your laptop – except that over the years they faced and solved all the problems about back-ups and restores, security, and high-speed data access. They have been around for a long time – which is a good thing because lots of people have moved the technology forward. They allow millions of users controlled access to information – allowing them to create, modify, and save data from almost any data entry device you can think of, including browsers.

Mainframes have been virtualized since the 1980s, and some of the software first saw the light of day in the 1960s. Most Windows data centres have only been virtualizing for the past five years! It’s true that laptops etc are everywhere – in your home, at work, etc – but mainframes are working away in the background. Everytime you take money from an ATM (cash machine) your bank is running a transaction on a mainframe. And it is banks and large financial institutions that use mainframes. And they do it because of the reliability. They do it because, should there be an outage, they can recover back to almost the last second before they went down. Almost no transactions are lost. And as a bank customer, I like that. Lots of non-mainframe-using sites think they are doing quite well if they can recover data back to last night! You see the difference in scale here.

Mainframes run an operating system (z/OS, but could be z/VM or z/VSE) and on top of that are a number of subsystems – you might think of them as apps (but big ones!). These subsystems include CICS and IMS. Now, both of these have been being developed since the 1960s and provide ways of accessing data very quickly and securely. They allow users to fill in virtual forms. And they store data in a way that means it can be accessed very quickly.

Another ‘app’ you may have heard of is DB2. DB2 is a comparative youngster, having arrived in the 1980s. It stores data in a ‘relational’ way rather than the more traditional ‘hierarchical’ way. DB2 is a database that can exist on Windows machines as well as mainframes (and many devices in between).

Mainframes can also run Linux (z/Linux) and all the Linux applications. That makes them very cost-effective replacements for sites with numerous ageing Linux servers. Linux has been available on mainframes for just over 10 years.

And there’s plenty of software available to control all aspects of this mainframe behemoth. And you can link them together at different sites in different countries round the globe.

So if anyone asks you what’s a mainframe, you can tell them that it’s the most successful server architecture ever devised and it’s all around them doing important work.

I’m a mainframe guy. Cut my teeth writing COBOL, PL/I and FORTRAN on the IBM System/370. CICS is my friend. Was playing with virtual machines long, long before there was anything called “DOS” or Windows” or “Linux.” My office closet is filled with punch cards and old nine-track tapes, all probably unreadable today. One of the happiest days of my professional life was trading in an old TeleVideo 925 monochrome terminal for a brand-new 3279 color display.

Read more here…