November 3, 2017 By Luigi Perrone 3 min read

As cyberthreats make headlines, companies across the globe are working hard to develop efficient IT infrastructures capable of protecting sensitive data and maintaining compliance with privacy regulations. Although it checks both of these boxes, many organizations have been hesitant to adopt encryption due to cost, operational impact, the complexity of key management and other factors. In fact, some business leaders are unsure whether they really need encryption (they do) and when and where it should be applied (always and everywhere).

That’s why the most significant component of IBM’s new z14 mainframe server is its pervasive encryption feature, which protects data both in motion and at rest, reducing cost and complexity without altering business processes. Additionally, the new Central Processor Assist Crypto Function (CPACF) makes encryption processes up to seven times faster.

How Pervasive Encryption Works

Pervasive encryption can be applied during the data allocation, processing and transmission phases. During the data allocation phase, the ACS routines filter the requests, and the Data Facility Storage Management Subsystem (DFSMS) DataClass calls the Integrated Cryptographic Service Facility (ICSF) to encrypt the data. You can also use the Resource Access Control Facility (RACF) key label in the DFP segment or the job control language (JCL) allocation parameter.

The correct order of precedence is as follows:

  1. RACF dataset profile (DFP segment);
  2. JCL (dynamic allocation, TSO allocate command, IDCAMS define); and
  3. SMS (ACS routine by DataClass).

Data can also be encrypted in the coupling facility (CF). At the moment, customer data that flows through the CF, and the CF link infrastructure is vulnerable to exposure because the data is not encrypted. Customer data stored in CF structures is also unprotected. With pervasive encryption, you can protect the data flowing over the coupling links and at rest in the CF with end-to-end, host-based encryption. Individual CF structures can be designated in the coupling facility resource management policy as encrypted, in which case the data will be protected with no middleware or application changes needed.

Finally, critical data can be protected with encryption during transmission. With z/OS Encryption Readiness Technology (zERT), you can transform your Transmission Control Protocol/Internet Protocol (TCP/IP) stack as a central collection point and repository for cryptographic protection attributes for all TCP connections that are either unprotected or protected by Transport Layer Security (TLS), Secure Sockets Layer (SSL), Secure Shell (SSH) or internet protocol security (IPsec).

There are two methods for discovering the security sessions and their attributes. The first is stream observation, in which the TCP/IP stack monitors the protocol handshakes as they traverse the TCP connection. You can also solicit advice from the cryptographic protocol provider. zERT helps you determine what traffic is protected and with what security protocol, which cryptographic algorithms are in use and more.

A Cocktail of Data Protection Solutions

It’s one thing to have all the necessary components to apply pervasive encryption, but how can you determine which approach is most suitable for your specific environment? The first step is to consider the overall security of your infrastructure and review your data protection policy. More often than not, a balanced cocktail of security solutions will produce the best results.

Data discovery and classification are crucial in a well-structured, controlled environment that is compliant with segregation of duties (SoD), systematic audit procedures and strong security policies that ensure integrity and stability. In such an environment, data protection requirements are easily satisfied because user identification, access and behavior are monitored. Critical and sensitive resources are covered by controlled policies, applications are designed under security directives, and devices and sources are managed against possible exposures. In this scenario, the encryption could be selective — programmed to encrypt a specific data type during certain processes, reducing the cost and manual effort required to protect your most sensitive assets.

But what if you have a dynamic infrastructure that frequently changes and lacks granularity controls? Such an environment is vulnerable to data breaches and susceptible to regulatory violations. So what can you do?

This is where pervasive encryption is particularly valuable. By applying total encryption, you are free from the obligation to notify the relevant supervisory authority within 72 hours of a breach. You can also be confident that any captured data would be useless to cybercriminals.

While pervasive encryption is not a silver bullet for all your security woes, it is a great starting point. It can be applied in various modes, for different purposes and in many different mainframe environments. Most importantly, it can protect your data without disrupting business continuity.

Learn More About Pervasive Encryption and IBM’s z14

More from Data Protection

Overheard at RSA Conference 2024: Top trends cybersecurity experts are talking about

4 min read - At a brunch roundtable, one of the many informal events held during the RSA Conference 2024 (RSAC), the conversation turned to the most popular trends and themes at this year’s events. There was no disagreement in what people presenting sessions or companies on the Expo show floor were talking about: RSAC 2024 is all about artificial intelligence (or as one CISO said, “It’s not RSAC; it’s RSAI”). The chatter around AI shouldn’t have been a surprise to anyone who attended…

3 Strategies to overcome data security challenges in 2024

3 min read - There are over 17 billion internet-connected devices in the world — and experts expect that number will surge to almost 30 billion by 2030.This rapidly growing digital ecosystem makes it increasingly challenging to protect people’s privacy. Attackers only need to be right once to seize databases of personally identifiable information (PII), including payment card information, addresses, phone numbers and Social Security numbers.In addition to the ever-present cybersecurity threats, data security teams must consider the growing list of data compliance laws…

How data residency impacts security and compliance

3 min read - Every piece of your organization’s data is stored in a physical location. Even data stored in a cloud environment lives in a physical location on the virtual server. However, the data may not be in the location you expect, especially if your company uses multiple cloud providers. The data you are trying to protect may be stored literally across the world from where you sit right now or even in multiple locations at the same time. And if you don’t…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today