Tech Talk: In the Voice of a Mainframe Millennial: How Can Mainframe Security Be Made Easier?

World®
’16
In the Voice of a Mainframe Millennial:
How Can Mainframe Security Be Made Easier?
Josh Broadhurst, Associate Software Engineer
CA Technologies
MFT53T
MAINFRAME AND WORKLOAD AUTOMATION

2 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
© 2016 CA. All rights reserved. All trademarks referenced herein belong to their respective companies.
The content provided in this CA World 2016 presentation is intended for informational purposes only and does not form any type of
warranty. The information provided by a CA partner and/or CA customer has not been reviewed for accuracy by CA.
For Informational Purposes Only
Terms of this Presentation

Abstract
Agile businesses need to balance security with ease of use. You need to know who is accessing
your data, where the data is located and that it is secure. But at the same time, authorized users
need access at all times to propel the business forward. How can we our simplify mainframe
security practices to achieve this balance? In this session, a mainframe millennial provides a
fresh perspective on the landscape of mainframe security and provides new insights on how we
can simplify mainframe security practices while improving our security and compliance posture.
Josh
Broadhurst
CA Technologies
Associate Software
Engineer

Quick Introduction
§ Graduated from UIUC
– B.S. Computer Engineering
§ Started at CA in January
– Associate Software Engineer
§ Work at the Lisle, IL office
– CA Data Content Discovery (DCD)
About Me

Agenda
BACKGROUND AND CHALLENGES
ADDRESSING INTERNAL SECURITY RISKS
CREATING A RISK-AWARE CULTURE
PREPARING A YOUNGER WORKFORCE
1
2
3
4
QUESTIONS AND COMMENTS5

Background and Challenges

§ 80% of Fortune 2000 companies have mainframe staff eligible
for retirement
§ Management tasks believed would suffer most from shortfalls
in mainframe staffing:
– Security (55%)
– Storage (47%)
– Workload management (46%)
– Database management (26%)
Mainframe Skills Shortage
SOURCE: “The Mainframe Conundrum: Escalating Workloads, Shrinking Staff” by TheInfoPro, Inc. (2008)

41%
43%
50%
Password Security
Data Loss
Unauthorized Access
Which security challenges are large enterprises
“extremely concerned” with?
Enterprise Security Challenges
SOURCE: Nokia and Penn Schoen Berland survey of 1500 senior IT decision makers (2015)

§ LPAR on IBM System z is EAL5 certified
§ Problem: EAL is limited to specific Target of Evaluation (TOE)
– Only properties of security products or systems considered
§ What about
– Administration?
– User training?
– Compliance?
Measuring Security

Addressing Internal Security Risks

§ Top two causes of security incidents relate to internal risks
Investigating Security Incidents
SOURCE: “Data Breach Investigations Report” by Verizon (2016)
8,886
9,630
9,701
10,490
11,347
Everything Else
Denial-of-Service
Physical Theft/Loss
Privilege Misuse
Miscellaneous Errors

§ 63% of confirmed breaches involved weak, default, or
stolen passwords
§ 26% of miscellaneous error breaches involved employees
sending sensitive information to wrong person
§ 70% of insider misuse breaches took months or years
to discover
Some Useful Figures

27 6 3 2
7 1Internal
External
Discovery methods of breaches within Miscellaneous Errors
Customer Report Leaked Documents or Files Actor Disclosure Audit Employee Report IT Review
How Are Breaches Discovered?

§ Employee compliance with security guidelines is a major
factor in security incidents
§ Why aren’t employees following existing security guidelines?
§ Need more internal diligence to identify breaches and
respond earlier in the lifecycle
Root of the Problem

Creating a Risk-Aware Culture

§ Monitor systems and users
– Log, analyze, and report on security events
– SIEM software
§ CA Compliance Event Manager
§ Know your data
– Where is sensitive data located?
– Who has access to it?
– DLP software
§ CA Data Content Discovery
Technical Measures

§ Changing attitudes
– People will follow procedure only if perceived benefit outweighs cost
– Initiatives, programs, and policies often considered “extra work”
– Fear of punishment could inhibit reporting
§ Active support from management
– Authorize risk management costs and resource allocation
– Accept accountability for security failures and policy violations
– Provide ongoing training to security team
Non-technical Measures

“Active and visible involvement of top management…not only
changes the relevant culture of the organization but also
directly influences the cognitive beliefs of employees which
then influence their compliance intentions.”
Managing Employee Compliance with Information Security Policies: The Critical Role of
Top Management and Organizational Culture

Preparing a Younger Workforce

Personal Experience
§ x86/Linux background
– Computing fundamentals not
so different
§ Mainframe ASE Program
– 7 weeks official training
§ z/Architecture Basics
§ TSO and ISPF Panels
§ z/OS languages
ME

§ Current offerings focus on mainframe platform as a whole
§ What about security practices?
§ IBM “Enterprise Skills Survey” of 130 customers and partners
shows lack of emphasis on mainframe security skills
What’s Missing?
SOURCE: IBM Academic Initiative, System z Program, Enterprise Skills Survey Results (2006-2009)
Skills Area Strongly Required Not Required
Security Training 36.03% 17.30%

Vulnerability Labs
First-hand experience
on various
vulnerabilities, attacks,
and countermeasures
Design Labs
Apply security principles
in designing and
implementing systems
Exploration Labs
Enhance student
learning via
observation, playing
and exploration
Case study: SEED
SOURCE: “SEED: A suite of instructional laboratories for computer security education” by Du, W. and Wang, R. (2008)

Case study: SEED
42%
52%
6%
"The lab sparks my interest in
computer security"
Strongly Agree Agree Neutral
SOURCE: “SEED: A suite of instructional laboratories for computer security education” by Du, W. and Wang, R. (2008)
68%
29%
3%
"The lab was a valuable part of
this course"
Strongly Agree Agree Neutral

Conclusion
Action or inaction by employees poses significant risk to informational assets. Awareness of threats and the
rationale behind security controls can encourage appropriate preventive behavior.
Information security is primarily a management problem. Top management support is a critical factor in
procuring resources to develop an effective security culture.
Controlled access to real-world systems is an invaluable educational tool. Training for new employees should
be designed to encourage compliance as an easy and desirable task.
Summary
A Few Words to Review

Questions?

Recommended Sessions
SESSION # TITLE DATE/TIME
MFX173S The Importance of Mainframe Security Education 11/16/2016 at 3:45 pm
MFT174S
Mainframe Security Strategy and Roadmap: Best
Practices for Protecting Mission Essential Data
11/17/2016 at 12:45 pm
MFT175S Gaps in Your Defense: Hacking the Mainframe 11/17/2016 at 3:00 pm

Must See Demos
Real-Time Data
Security & Compliance
CA Data Content
Discovery
Mainframe Theatre
Mainframe Security
Smart Bar
CA Top Secret®
Mainframe Theatre
Real-Time Data
Security & Compliance
CA Compliance
Event Manager
Mainframe Theatre
Mainframe Security
Smart Bar
CA ACF2™
Mainframe Theatre

Thank you.
Stay connected at communities.ca.com

Mainframe and Workload Automation
For more information on Mainframe and Workload Automation,
please visit: http://cainc.to/9GQ2JI

Tech Talk: In the Voice of a Mainframe Millennial: How Can Mainframe Security Be Made Easier?

Recommended

Recommended

More Related Content

Viewers also liked

Viewers also liked (19)

Similar to Tech Talk: In the Voice of a Mainframe Millennial: How Can Mainframe Security Be Made Easier?

Similar to Tech Talk: In the Voice of a Mainframe Millennial: How Can Mainframe Security Be Made Easier? (20)

More from CA Technologies

More from CA Technologies (20)

Recently uploaded

Recently uploaded (20)

Tech Talk: In the Voice of a Mainframe Millennial: How Can Mainframe Security Be Made Easier?