IBM Security Z Security

 View Only

More from the WW IBM Z Security Conference: Hacking thwarted by Multi-Factor Authentication

By Marilyn Thornton posted Sun September 23, 2018 01:56 AM

  

Conference Sign
I've had a great week in Montpellier, France at the WW IBM Z Security Conference, but sadly, my mastery of the French language is still elusive.  However, I am able to confirm something that requires no translation: cybersecurity is a worldwide hot topic and organizations of all shapes and sizes, across every industry, are "sharing the pain." 

Mark Wilson, of RSM Partners, presented a session on "Hacking the Mainframe."  While he and I have always disagreed on the difference between a "hack" and a "breach" we DO agree that when a company's data is compromised, it's not good for anyone.  Mark's example described how someone with no mainframe skills was able to use a tool that analyzes network traffic and pick up user credentials (e.g., userid and password), and eventually gain access to a mainframe system.  

Mark is an energetic speaker (he will be presenting at IBM's TechU Conference in Hollywood, FL in October) and he made some very good points about how companies have the tools to protect themselves but they have to use them.  Additionally, it was obvious to me that if the company depicted in Mark’s scenario would have implemented a security strategy requiring additional factors for authentication (i.e., something you know, something you have, and something you are) and not just relied on the age-old userid and password, those stolen credentials would have been useless.  Check out IBM MFA for z/OS to learn how you can implement multi-factor authentication on the mainframe without making changes to the RACF infrastructure.

And if you’re wondering why the conference sign has flamingos (Flamant Rose in French), it’s because here in the south of France flamingos are flourishing.  Apparently, the brine lagoons, marshes and salt flats that lie between the Rhone river and the Mediterranean Sea provide an ideal breeding ground for these beautiful birds.  Who knew?

2 comments
16 views

Permalink

Comments

Luigi Perrone
Wed November 21, 2018 07:46 AM

I completely agree with you, Bill. We must not do terrorism, because it is very difficult to hack a z/OS system if we do an efficient work. Infact, from my point of view, the security incidents on the mainframe occur only and exclusively due to a lack of attention in the security policy implementation and controls. We have all the instruments to counter efficiently any type of attack, but we have to work well,

Bill Seubert
Mon September 24, 2018 01:39 PM

To me, the issue comes in when a company makes a blatant mistake in configuring the system. For example, what if (and this is an extreme example) a company's security admins don't delete IBMUSER with the default password, and someone uses it to do something nasty. Is that a "hack"? Is it exploitation of a "hole" or an "exposure" when IBM clearly tells people to address something like that?  The difference between "hack" and "breach" can be something as basic as intent - was the incident intended to do harm to the victim company via stealing info or breaking infrastructure?  But that's splitting hairs.

I think what we all REALLY want to have happen is for any potential intrusion points to be identified and controlled, AND for attempts to be quickly identified and mitigated.