As cyberthreats make headlines, companies across the globe are working hard to develop efficient IT infrastructures capable of protecting sensitive data and maintaining compliance with privacy regulations. Although it checks both of these boxes, many organizations have been hesitant to adopt encryption due to cost, operational impact, the complexity of key management and other factors. In fact, some business leaders are unsure whether they really need encryption (they do) and when and where it should be applied (always and everywhere).

That’s why the most significant component of IBM’s new z14 mainframe server is its pervasive encryption feature, which protects data both in motion and at rest, reducing cost and complexity without altering business processes. Additionally, the new Central Processor Assist Crypto Function (CPACF) makes encryption processes up to seven times faster.

How Pervasive Encryption Works

Pervasive encryption can be applied during the data allocation, processing and transmission phases. During the data allocation phase, the ACS routines filter the requests, and the Data Facility Storage Management Subsystem (DFSMS) DataClass calls the Integrated Cryptographic Service Facility (ICSF) to encrypt the data. You can also use the Resource Access Control Facility (RACF) key label in the DFP segment or the job control language (JCL) allocation parameter.

The correct order of precedence is as follows:

1. RACF dataset profile (DFP segment);
2. JCL (dynamic allocation, TSO allocate command, IDCAMS define); and
3. SMS (ACS routine by DataClass).

Data can also be encrypted in the coupling facility (CF). At the moment, customer data that flows through the CF, and the CF link infrastructure is vulnerable to exposure because the data is not encrypted. Customer data stored in CF structures is also unprotected. With pervasive encryption, you can protect the data flowing over the coupling links and at rest in the CF with end-to-end, host-based encryption. Individual CF structures can be designated in the coupling facility resource management policy as encrypted, in which case the data will be protected with no middleware or application changes needed.

Finally, critical data can be protected with encryption during transmission. With z/OS Encryption Readiness Technology (zERT), you can transform your Transmission Control Protocol/Internet Protocol (TCP/IP) stack as a central collection point and repository for cryptographic protection attributes for all TCP connections that are either unprotected or protected by Transport Layer Security (TLS), Secure Sockets Layer (SSL), Secure Shell (SSH) or internet protocol security (IPsec).

There are two methods for discovering the security sessions and their attributes. The first is stream observation, in which the TCP/IP stack monitors the protocol handshakes as they traverse the TCP connection. You can also solicit advice from the cryptographic protocol provider. zERT helps you determine what traffic is protected and with what security protocol, which cryptographic algorithms are in use and more.

A Cocktail of Data Protection Solutions

It’s one thing to have all the necessary components to apply pervasive encryption, but how can you determine which approach is most suitable for your specific environment? The first step is to consider the overall security of your infrastructure and review your data protection policy. More often than not, a balanced cocktail of security solutions will produce the best results.

Data discovery and classification are crucial in a well-structured, controlled environment that is compliant with segregation of duties (SoD), systematic audit procedures and strong security policies that ensure integrity and stability. In such an environment, data protection requirements are easily satisfied because user identification, access and behavior are monitored. Critical and sensitive resources are covered by controlled policies, applications are designed under security directives, and devices and sources are managed against possible exposures. In this scenario, the encryption could be selective — programmed to encrypt a specific data type during certain processes, reducing the cost and manual effort required to protect your most sensitive assets.

But what if you have a dynamic infrastructure that frequently changes and lacks granularity controls? Such an environment is vulnerable to data breaches and susceptible to regulatory violations. So what can you do?

This is where pervasive encryption is particularly valuable. By applying total encryption, you are free from the obligation to notify the relevant supervisory authority within 72 hours of a breach. You can also be confident that any captured data would be useless to cybercriminals.

While pervasive encryption is not a silver bullet for all your security woes, it is a great starting point. It can be applied in various modes, for different purposes and in many different mainframe environments. Most importantly, it can protect your data without disrupting business continuity.

Learn More About Pervasive Encryption and IBM’s z14