RACF enhancements, Multilevel Security

Once a user is authenticated, RACF and the resource managers control the interaction between that user and the objects it tries to gain access to. These objects include: commands, datasets, programs, tape volumes, terminals and objects that you deﬁ ne. RACF supports ﬂ ex- ibility in auditing access attempts and changes to security controls. To audit security-relevant events, you can use the RACF system management unload utility and a variety of reporting tools.

With one command, a security administrator can update remote RACF databases without logging on to remote sys- tems. Throughout the enterprise, RACF commands can be sent automatically to synchronize multiple databases. In addition, RACF can automatically propagate RACF data- base updates made by applications. With RACF, users can keep passwords synchronized for speciﬁ c user IDs. When you change one password, RACF can change passwords for your user ID on different systems and for several user IDs on the same system. Also, passwords can be changed automatically for the same user ID on different systems. This way, several RACF databases can be kept synchro- nized with the same password information.

RACF enhancements:

•Digital Certiﬁ cates can be automatically authenticated without administrator action

•Administrative enhancements enable deﬁ nition of pro- ﬁ les granting partial authority. Handling of new pass- words and removal of class authority are simpliﬁ ed.

•On demand applications require a way to associate more users under a RACF Group deﬁ nition, so RACF allows the creation of a new kind of Group that can con- tain an unlimited number of users

•RACF now allows you to perform RACF installation class updates without an IPL, which can help improve availability

•RACF facilitates enterprise password synchronization through RACF password enveloping and notiﬁ cation of password changes using z/OS LDAP

•Improved user accountability through RACF’s enforce- ment of unique z/OS UNIX UIDs and GIDs

•Improved access control ﬂ exibility and granularity for z/OS UNIX ﬁ les with access control lists

•Multilevel security support

Multilevel Security

z/OS 1.5 is the ﬁ rst and only IBM operating system to pro- vide multilevel security. This technology can help improve the way government agencies and other organizations share critical classiﬁ ed information. Combined with IBM’s DB2 UDB for z/OS Version 8, z/OS provides multilevel security on the zSeries mainframe to help meet the strin- gent security requirements of government agencies and

ﬁnancial institutions, and can help open up new hosting opportunities. Multilevel security technology allows IT administrators to give users access to information based on their need to know, or clearance level. It is designed to pre- vent individuals from accessing unauthorized information and to prevent individuals from declassifying information.

With multilevel security support in IBM’s z/OS 1.5 and DB2 V8, customers can enable a single repository of data to be managed at the row level and accessed by individuals based on their need to know.

SSL

Secure Socket Layer (SSL) is a public key cryptography- based extension to TCP/IP networking which helps to enable private communications between parties on the Internet. z/OS provides fast and highly secure SSL sup- port, with increased performance when coupled with zSeries server cryptographic capabilities.