New IBM Mainframe Encrypts All the Things

Next-generation Z series features the elusive goal of full data encryption - from an application, cloud service, or database in transit or at rest.

In the first major mainframe announcement by IBM in a decade, the company today unveiled its next-generation Z series that supports full-blown encryption for data via applications, cloud, and databases rather than todays more common practice of pockets of crypto.
Encryption remains a high bar for many organizations to deploy en masse; its more often deployed at specific layers or portions of the data flow. And yes, mainframes are still a thing: The majority of credit card transactions run on IBM mainframes today, and other financial, insurance, and travel transactions still rely on the big ol iron. IBM enlisted experts and customers from 150 different companies in building the architecture of the new Z system, including ADP and Highmark Healthcare.
The challenge everyone has is it was too expensive to encrypt all of this … not really [expensive] in money, but I mean in processing time, says Caleb Barlow, vice president of threat intelligence at IBM Security. Transaction-based systems cant afford degradation of performance or user experience, he says. When youre moving money or visiting an ecommerce website ... the encryption and decryption steps can slow the process, he says.
So in most cases, encryption happens between the Web browser and the application server, or in a storage array. After each step of the data flow, the data is decrypted, so it doesnt remain locked down.
The Z system keeps data encrypted across the board, from the network to the storage array, in what IBM calls pervasive encryption, explains Barlow.
IBM engineered encryption into the Zs postage-stamp sized silicon processor: there are 6 billion transistors there dedicated to encryption processing, he says. The machine doesnt slow down when its asked to encrypt and decrypt data, he says. The only time its decrypted is when an organization needs to work with the data.
The encryption engine supports symmetric and asymmetric encryption algorithms including AES, DES, TDES, RSA, DSA, ECC, and ECDSA, as well as CMAC and HMAC for message authentication, and SHA2 and SHA3 hashing algorithms.
The
IBM Z
, which sells for around $500,000 and ships this quarter, can run more than 12 billion encrypted transactions per day, and includes what IBM calls tamper-responding encryption keys that kills keys if theres a sign of an attack so they cant be stolen; it restores them when the coast is clear.
Mainframes, while less prevalent these days, are still juicy targets for attackers. Researchers at Trend Micro recently
discovered IBM Z Series mainframes
(aka OS/390 machines) and IBM iSeries (aka AS/400 mainframes) left exposed on the public Internet, half of which were in the US. Exposed File Transfer Protocol (FTP) ports were the culprit in many of the cases.
Trend Micros researchers say mainframes are at risk of what they call business process compromise attacks, where attackers infiltrate an organization and modify its mainframe transaction processes in order to siphon money surreptitiously.
John Clay, director of global threat intelligence communications at Trend Micro, says many exposed systems discovered via Shodan scans are misconfigured in some way. The nice thing in what we hope to see with the IBM [Z] announcement is that an organization using the Z can implement encryption of the data at rest or in transit so that with any type of compromise the data cant be stolen because its encrypted, Clay says.
But dont expect an all-encrypted data world anytime soon. Its going to take a while to get these systems in place, Trends Clay notes. But it could bring about a sea change in the encryption space, he says.
The Ponemon Institutes recent Global Encryption Trends Study found that in the past 11 years, the ratio of organizations with enterprise-wide encryption strategies has doubled, from less than 20% to over 40%. They mostly employ an ad-hoc encryption strategy to date: 61% of organizations encrypt employee and HR data; 56%, payment data; 49%, financial records; and 40%, customer data, according to the report.
Related Content:
5 Security Lessons WannaCry Taught Us the Hard Way
The Long Slog To Getting Encryption Right
Trust Begins With Layer 1 Encryption
NotPetya: How to Prep and Respond if Youre Hit

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada, July 22-27, 2017. Click for information on the
conference schedule
and
to register.

Last News
▸ Some DLP Products Vulnerable to Security Holes ◂ Discovered: 23/12/2024 Category: security	▸ Scan suggests Heartbleed patches may not have been successful. ◂ Discovered: 23/12/2024 Category: security	▸ IoT Devices on Average Have 25 Vulnerabilities ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
New IBM Mainframe Encrypts All the Things