One key reason to convert mainframe applications to Web services is to make them available more broadly -- often including end users outside of the organization and the consumer market. In many cases, these users expect access in which there is a single sign-on, with some privacy as to the identity or characteristics of the user. Because of the features of Web services, it may be that this new classes of end users will attempt to access the mainframe application frequently, requiring flexible adjustment by mainframe security software.
Web services on non-mainframe platforms that link to the mainframe may be more vulnerable, so that a PC application that has been be a trusted internal consumer of mainframe services becomes a new pathway by which a hacker can attack key corporate data on the mainframe.
At the same time, the Web service allows users to define corporate-standard security that is automatically applied in each access to the Web service. This, in turn, means that by creating an SOA (service-oriented architecture), organizations can enforce mainframe-level security across the entire organization. And this standardization also makes it easier to mesh the RACF (Resource Access Control Facility) and encryption facilities of the mainframe with the Kerberos and firewall capabilities of other platforms.
The key to success in adapting mainframe security to Web services is to take advantage of the opportunities and thereby solve the problems. In other words, by defining the right corporate standard for security, based on mainframe security, and implementing it in an SOA, the user will actually reduce security risks as it moves to adopt Web services.
For an introduction to SOA, read this tutorial on Web service technologies.
Web services and security
Web Services impact an environment in which the main focus of security has been prevention of access to key proprietary information by unauthorized users. Enterprises may have a
To continue reading for free, register below or login
To read more you must become a member of SearchSOA.com
ccomplished prevention by disguising data (encryption), by erasing data as soon as possible, by removing data as soon as possible to a secure facility (archiving), or by controlling access to the data (access control, firewalls, and so on). In other words, security has emphasized keeping people outside a carefully chosen circle away from information; an SOA (along with other new technologies such as business compliance) emphasizes giving new people outside that circle (and outside the enterprise) access to information.
Table 1 below shows the potential evolution of security due to Web services in each of these areas of security.
Table 1: Impact on security of web services
[TABLE]
Note that the result of these changes is actually to make security better than before -- with less performance overhead, more comprehensive and integrated across all enterprise information, more applicable to inter-organization communication, better integrated with risk management and disaster recovery. Thus, as Web services arrive, security is harder to do; but, once done effectively, delivers more benefits.
IBM's response
IBM's approach to mainframe security stresses MultiLevel Security (MLS) for z/OS, a multiple-layer approach in which perimeter defense (e.g., firewalls, anti-virus, intrusion detection, cryptography via eServer Cryptographic Coprocessor) operates as a first "access checkpoint" for broad threats from outside. A control layer (e.g., RACF, Tivoli Access Manager, Tivoli Identity Manager) applies more fine-grained criteria to determine whether a particular user can carry out a particular function on the mainframe. An an assurance layer carries out "service level fulfillment" tasks related to business compliance, auditing, risk management, and security-event response.
IBM System z security offerings also include PKI (Public Key Infrastructure) support to manage digital certificates, Crypto Express2 to allow easier migration to higher levels of mainframe cryptographic security such as anti-fraud security, z/OS Intrusion Detection Services, and SSL (Secure Sockets Layer) with improved performance.
Table 2, below, shows the ways in which Infostructure Associates believes that the IBM System z has built on past strengths to address the needed changes in security.
Table 2: IBM's response
[TABLE]
In other words, IBM is extending System z security to Web services primarily by:
Integrating security with expanded business compliance and disaster recovery solutions that can support Web services and outside users;
Expanding security offerings to improve performance and widen the scope of users employing System z security (e.g., to more users outside the enterprise); and
Offering extensive Web service conversion and creation tools and platforms that allow extension of mainframe security to an organization-wide SOA.
This allows IBM to differentiate its System z security solutions especially well in two ways. Experience -- no one else has IBM mainframes' track record in security, based on technologies like RACF. Comprehensiveness -- no one else offers an information integration product that allows users to apply the same data-access security scheme across all of an enterprise's data stores, no matter what type.
IBM's approach also allows users to incorporate extensive, standard, and robust security products not only into mainframe Web-service applications but also across a cross-platform SOA.
The advent of Web services means not merely another architecture expanding the organization's security risks by allowing new points of attack, but also a rare opportunity to improve both security and the benefits derived from it, by extending mainframe security to an organization-wide SOA.
About the author:Kernochan is president of Infostructure Associates.
