We are expecting more and more from our IBM z Systems. Our critical data and applications are nested in our IBM z Systems infrastructure, and more than ever it positions itself as the security hub. It now exports services to secure distributed environment thanks to its security as a services capabilities. During this lecture, Mr Darées talks about z Systems Roles for security in most of today’s hot topics (compliance, Database encryption, Tokenization, Digital Certificates, ...).

1. © Copyright IBM Corporation 2016.
The Mainframe’s Role in Enterprise Security Management
Jean Marc Darées
IT Architect, Security on IBM z Systems

2. 1© Copyright IBM Corporation 2016
• End to end security
• Crypto Monster
• Security certification
Agenda

3. 2© Copyright IBM Corporation 2016
Security leaders are more accountable than ever before
Source: Discussions with more than 13,000 C-suite executives as part of the IBM C-suite Study Series
Loss of market share
and reputation
Legal exposure
Audit failure
Fines and criminal
charges
Financial loss
Loss of data
confidentiality, integrity
and/or availability
Violation of employee
privacy
Loss of
customer trust
Loss of brand reputation
CEO CFO/COO CIO CHRO CMO
Security a must for the Business

4. 3© Copyright IBM Corporation 2016
Security Projects use z Systems features.
Security in the core of the mainframe design

5. 4© Copyright IBM Corporation 2016
© Copyright IBM Corporation 2015
System Z unique: the full portfolio
End to End security
• IDENTITY & ACCESS
• Enable secure collaboration with internal and
external users with controlled and secure access to
information, applications and assets
• DATA SECURITY
• Protect and secure your data and information assets
• APPLICATION SECURITY
• Continuously manage, monitor and audit application
security
• INFRASTRUCTURE SECURITY
• Comprehensive threat and vulnerability management
across networks, servers and end-points
• SECURITY COMPLIANCE
• Demonstrable policy enforcement aligned to
regulations, standards, laws, agreements (PCI,
FISMA, etc..)

6. 5© Copyright IBM Corporation 2016
RACF
Enables application and database security without
modifying applications
Can reduce security complexity and expense:
• Central security process that is
easy to apply to new
workloads or as user base
increases
• Tracks activity to
address audit and
compliance
requirements
Hardware
Architecture
z/OS
Networks
Data & Applications
Administration
Authentication
Authorization
Administration
Auditing
Resource Access Control Facility (RACF)
IDENTITY & ACCESS
EAL5: https://www.bsi.bund.de/ContentBSI/EN/Topics/Certification/newcertificates.html

7. 6© Copyright IBM Corporation 2016
z/OS PKI Services : Ready to use on zOS
IDENTITY & ACCESS

8. 7© Copyright IBM Corporation 2016
Execute what you trust !!!
APPLICATION SECURITY
Code signing
• Code signing for Program Objects in PDSEs
• Support in Program Management Binder & Loader
• System SSL support for a new mode of operation designed to meet NIST
FIPS 140-2 Level 1 criteria
• AT-TLS support for FIPS 140-2

9. 8© Copyright IBM Corporation 2016
HW Crypto in z Systems
DATA SECURITY/ INFRASTRUCTURE SECURITY/IDENTITY & ACCESS
CPC Drawer
Smart Cards
Crypto
Express5S
Smart Card Readers
PU SCM
Each PU is
capable of
having the
CPACF
function
PCIe I/O
drawers
Trusted Key Entry
(TKE)
TKE required for
management
of Crypto Express5S
and EP11
FIPS 140-2 Level 4

10. 9© Copyright IBM Corporation 2016
Secured Connections
Security Projects can count on z Systems features.
We are expecting more and more from our Mainframe

11. 10© Copyright IBM Corporation 2016
z13 a Crypto monster …
RSA-AES-128-GCM-SHA256 TLS 1.2
0,0
5000,0
10000,0
15000,0
20000,0
25000,0
30000,0
Software 1 Acc 2 Acc 3 Acc 4 Acc 5 Acc 6 Acc
RSA-2048 SSL HS/s - Crypto Card Scalability
Software 1 Acc 2 Acc 3 Acc 4 Acc 5 Acc 6 Acc

12. 11© Copyright IBM Corporation 2016
Database Encryption & Data Tokenization
Security Projects can count on z Systems features.
DATA SECURITY

13. 12© Copyright IBM Corporation 2016
Encryption on DB2 / IMS : Easy, Efficient , No change
• No need to change your application with z/OS Infosphere Guardium
Encryption for DB2 & IMS.
• Prefect integration with the IDENTITY & ACCESS management RACF
• Prefect integration with the zOS Cryptographic function ICSF
• Low performance impact thanks to the crypto hardware accelerator CPACF

14. 13© Copyright IBM Corporation 2016
Complete Key Management solution
• Dual control for access /Separation of duties
• Restrict access to cryptographic keys to the
fewest number of custodians necessary.
• Store cryptographic keys securely in the fewest
possible locations and forms
• Secure cryptographic key storage: tamper
responsive cryptographic hardware
• Cryptographic key changes for keys that have
reached the end of their crypto period (key
rotation)
• Fully document and implement all key-
management processes and procedures for
cryptographic keys.
• Key changes in accordance with recommended
crypto periods (ie. NIST SP800-57)
• Audit trails for all key management operations
EKMF
EKMF
Browsers
EKMF
Workstation

15. 14© Copyright IBM Corporation 2016
Tokenization's solution are available on z
Irreversible Tokens
Irreversible tokens can never be converted back to the original PAN.
It is not possible in any circumstance for any party to obtain a PAN
from its irreversible token, either through analysis or from any kind
of stored data extraction.
Authenticatable Irreversible
Non Authenticatable Irreversible
Reversible Tokens
Reversible tokens provide the possibility for entities using or
producing tokens to obtain the original PAN from the token.
Reversible tokens have the potential to become a PAN
again by the process of de-tokenization. Reversible tokens
can be mapped to a unique PAN or multiple tokens may map
back to the same PAN depending on technology used. If it is
technically possible for a token to be de-tokenized, a product
is considered to be a reversible tokenization product even if
the entity producing the tokens does not intend to permit de-
tokenization.
Reversible Cryptographic
Reversible Non-Cryptographic Tokens
Mainframe Technologies Available
Performances
SHA512 = 3,5GB/s / C
Security
CEX5S as Co-
ProcesMainframe
Granularity
CPACF, CEX5S
APIs
z/OS, zLinux, APIM
Standards
SHA, SHA256, SHA384, SHA512, SHA3

16. 15© Copyright IBM Corporation 2016
z Systems Security Certifications
z/OS z/VM
Linux Linux Linux
Virtualization with partitions
Cryptography
 z13 Common Criteria evaluation
−Common Criteria EAL5+ with specific
target of evaluation -- LPAR: Logical
partitions
 Crypto Express5 Coprocessor
−FIPS 140-2 level 4
−Approved by German ZKA
−
 CP Assist
−FIPS 197 (AES)
−FIPS 46-3 (TDES)
−FIPS 180-3 (Secure Hash)
The IBM z13 is designed for Common
Criteria Evaluation Assurance Level 5+
certification for security of logical
partitions.
The Common Criteria program establishes
an organizational and technical framework
to evaluate the trustworthiness of IT
Products and protection profiles
z/VM
 Common Criteria
− z/VM V6.1 is EAL 4+ for OSPP
 z/VM V6.3 System SSL FIPS
140-2 certification pending.
 System Integrity Statement
z/OS
 Common Criteria EAL4+
− with CAPP and LSPP
− z/OS V1.7  V1.10 + RACF
− z/OS V1.11 + RACF (OSPP)
− z/OS V1.12, z/OS V1.13,
− z/OS V2R1 (OSPP) Sept ‘14
 Common Criteria EAL5+
− RACF V1R12 (OSPP)
− RACF V1R13 (OSPP)
− RACF V2R1 OSPP
 z/OS 1.10 IPv6 Certification
by JITC
 IdenTrust™ certification for
z/OS PKI Services
 FIPS 140-2
− System SSL z/OS V1.10 
V1.13
− z/OS ICSF PKCS#11
Services
• z/OS V1.11  z/OS V1.13
 Statement of Integrity
Linux on z Systems
 Common Criteria
− SUSE SLES11 SP2 certified
at EAL4+ with OSPP
− Red Hat EL6.2 EAL4+ with
CAPP and LSPP
 OpenSSL - FIPS 140-2 Level
1 Validated
 CP Assist - SHA-1 validated
for FIPS 180-1 - DES &
TDES validated for FIPS 46-3

17. 16© Copyright IBM Corporation 2016
• End to end
• With Optimum performance
• With Latest Security certifications
Security on Mainframe :

18. © Copyright IBM Corporation 2016.

19. 18© Copyright IBM Corporation 2016
© Copyright IBM Corporation 2015
Join us in Montpellier at the IBM System z
Security Conference and enhance your
security skills to achieve your security projects
September 27/ 30th
Montpellier France
2016