Embedded Files
MAINFRAME /
Security: how data is protected. Security technology is commonly applied to data at rest.
Privacy: rights, control and how data is used. Privacy technology is commonly applied to data flowing in a network.
Businesses: whole suite of tools like security management systems, encryption, digital certificates, strict audit practices, and real-time monitors.
Data security is often maintained, data privacy is often compromised. The motive for securing the data while compromising individual data privacy is because the accumulated data has value to whoever possesses that data.
Security and privacy practices are very different in z/OS software and IBM Z hardware. The z/OS environments are commonly configured for omni-present security, privacy, audit, and real-time monitoring. When they’re all configured and working together, they make a secured environment for the IBM Z hardware.
z/OS environment layers:
the physical box
operating system
applications
Hardware and software layers:
Resource Access Control Facility (IBM RACF)
pervasive encryption built into the z/OS components
best-of-breed hardware encryption accelerators and techniques
communication server software sub-components enabling security and privacy for data in flight
communication server and other software components enabling real-time monitoring and alerting of suspicious activity
Critical IBM Z data center locations are confidential and typically hidden from the public.
System Authorization Facility (SAF): built-in feature of the OS, provides tools for managing the system security functions. Users don't interface directly with SAF.
RACF: security manager, contains the security rules used by the z/OS components.
Customer Information Control System (IBM CICS), Time Sharing Option (TSO): user interfaces.
FIGURE OF SYSTEM AUTHORIZATION FACILITY (SAF) MANAGEMENT LAYERS:
The RACF stores:
IDs and passwords of users
names of objects (e.g. data sets, files, programs)
rights (read only/read-write) as connections between users and objects
User:
person
process
If a batch job or started task requires an access to a protected resource, the RACF will allow or deny.
Access to protected objects frequently includes:
RACF multi-factor authentication
RACF digital certificates
long complex RACF password strings
Too lazy, didn’t read (TL:DR):
a user attempts to access a resource
the OS calls a security manager (e.g. RACF)
the security manager (e.g. RACF) gives back allow or deny answer
the OS will allow or deny access to the user
Google Sites
Report abuse