As cyberthreats make headlines, companies across the globe are working hard to develop efficient IT infrastructures capable of protecting sensitive data and maintaining compliance with privacy regulations. Although it checks both of these boxes, many organizations have been hesitant to adopt encryption due to cost, operational impact, the complexity of key management and other factors. In fact, some business leaders are unsure whether they really need encryption (they do) and when and where it should be applied (always and everywhere).

That’s why the most significant component of IBM’s new z14 mainframe server is its pervasive encryption feature, which protects data both in motion and at rest, reducing cost and complexity without altering business processes. Additionally, the new Central Processor Assist Crypto Function (CPACF) makes encryption processes up to seven times faster.

How Pervasive Encryption Works

Pervasive encryption can be applied during the data allocation, processing and transmission phases. During the data allocation phase, the ACS routines filter the requests, and the Data Facility Storage Management Subsystem (DFSMS) DataClass calls the Integrated Cryptographic Service Facility (ICSF) to encrypt the data. You can also use the Resource Access Control Facility (RACF) key label in the DFP segment or the job control language (JCL) allocation parameter.

The correct order of precedence is as follows:

  1. RACF dataset profile (DFP segment);
  2. JCL (dynamic allocation, TSO allocate command, IDCAMS define); and
  3. SMS (ACS routine by DataClass).

Data can also be encrypted in the coupling facility (CF). At the moment, customer data that flows through the CF, and the CF link infrastructure is vulnerable to exposure because the data is not encrypted. Customer data stored in CF structures is also unprotected. With pervasive encryption, you can protect the data flowing over the coupling links and at rest in the CF with end-to-end, host-based encryption. Individual CF structures can be designated in the coupling facility resource management policy as encrypted, in which case the data will be protected with no middleware or application changes needed.

Finally, critical data can be protected with encryption during transmission. With z/OS Encryption Readiness Technology (zERT), you can transform your Transmission Control Protocol/Internet Protocol (TCP/IP) stack as a central collection point and repository for cryptographic protection attributes for all TCP connections that are either unprotected or protected by Transport Layer Security (TLS), Secure Sockets Layer (SSL), Secure Shell (SSH) or internet protocol security (IPsec).

There are two methods for discovering the security sessions and their attributes. The first is stream observation, in which the TCP/IP stack monitors the protocol handshakes as they traverse the TCP connection. You can also solicit advice from the cryptographic protocol provider. zERT helps you determine what traffic is protected and with what security protocol, which cryptographic algorithms are in use and more.

A Cocktail of Data Protection Solutions

It’s one thing to have all the necessary components to apply pervasive encryption, but how can you determine which approach is most suitable for your specific environment? The first step is to consider the overall security of your infrastructure and review your data protection policy. More often than not, a balanced cocktail of security solutions will produce the best results.

Data discovery and classification are crucial in a well-structured, controlled environment that is compliant with segregation of duties (SoD), systematic audit procedures and strong security policies that ensure integrity and stability. In such an environment, data protection requirements are easily satisfied because user identification, access and behavior are monitored. Critical and sensitive resources are covered by controlled policies, applications are designed under security directives, and devices and sources are managed against possible exposures. In this scenario, the encryption could be selective — programmed to encrypt a specific data type during certain processes, reducing the cost and manual effort required to protect your most sensitive assets.

But what if you have a dynamic infrastructure that frequently changes and lacks granularity controls? Such an environment is vulnerable to data breaches and susceptible to regulatory violations. So what can you do?

This is where pervasive encryption is particularly valuable. By applying total encryption, you are free from the obligation to notify the relevant supervisory authority within 72 hours of a breach. You can also be confident that any captured data would be useless to cybercriminals.

While pervasive encryption is not a silver bullet for all your security woes, it is a great starting point. It can be applied in various modes, for different purposes and in many different mainframe environments. Most importantly, it can protect your data without disrupting business continuity.

Learn More About Pervasive Encryption and IBM’s z14

More from Data Protection

Cybersecurity 101: What is Attack Surface Management?

There were over 4,100 publicly disclosed data breaches in 2022, exposing about 22 billion records. Criminals can use stolen data for identity theft, financial fraud or to launch ransomware attacks. While these threats loom large on the horizon, attack surface management (ASM) seeks to combat them. ASM is a cybersecurity approach that continuously monitors an organization’s IT infrastructure to identify and remediate potential points of attack. Here’s how it can give your organization an edge. Understanding Attack Surface Management Here…

Six Ways to Secure Your Organization on a Smaller Budget

My LinkedIn feed has been filled with connections announcing they have been laid off and are looking for work. While it seems that no industry has been spared from uncertainty, my feed suggests tech has been hit the hardest. Headlines confirm my anecdotal experience. Many companies must now protect their systems from more sophisticated threats with fewer resources — both human and technical. Cobalt’s 2022 The State of Pentesting Report found that 90% of short-staffed teams are struggling to monitor…

The Importance of Modern-Day Data Security Platforms

Data is the backbone of businesses and companies everywhere. Data can range from intellectual property to critical business plans to personal health information or even money itself. At the end of the day, businesses are looking to grow revenue, innovate, and operationalize but to do that, they must ensure that they leverage their data first because of how important and valuable it is to their organization. No matter the industry, the need to protect sensitive and personal data should be…

Meeting Today’s Complex Data Privacy Challenges

Pop quiz: Who is responsible for compliance and data privacy in an organization? Is it a) the security department, b) the IT department, c) the legal department, d) the compliance group or e) all of the above? If you answered "all of the above," you are well-versed in the complex world of compliance and data privacy! While compliance is a complex topic, the patchwork of regulations imposed by countries, regions, states and industries further compounds it. This complexity has turned…