Stopping Mainframe Data Breaches

In short, yes. It’s not always easy, but hackers have found creative ways to infiltrate corporate mainframes. And many of the familiar attacks that threaten distributed computer systems still apply to the mainframe, especially given how increasingly integrated the system now is with public-facing systems and networks. For example, the main server for Nordea bank was the first known victim of mainframe ransomware, in 2012. Hackers have every reason to search for entry points to the mainframe: it holds a treasure trove of valuable personal and business data that could be stolen, sold or otherwise misused. Research suggests up to 87 percent of the world’s credit card transactions are processed on the mainframe.

Code-based vulnerabilities are areas of flawed code that allow a program to bypass the security controls put in place by the operating system and the organization. There’s a huge amount of risk involved with code-based vulnerabilities. If a hacker were to exploit one, they would have access to all of the data, applications and users on the entire mainframe. That could be catastrophic for any organization, especially if the hacker were to gain system administrator privileges. Hundreds of applications and thousands of users could be exposed, all from one single code flaw. While most mainframe operations teams use Enterprise Security Managers to scan for application code bugs, these tools don’t scan for OS-level code. For that, you need a mainframe vulnerability scanning tool purpose-built to find OS code gaps.

Forrester analysts conceived of the Zero Trust security framework in 2012. The principle describes a strict security approach in which internal user accounts are treated with the same level of scrutiny as unknown external accounts, and therefore must undergo rigorous identification and authentication. It argues that putting inherent trust in internal user accounts – such as for employees – is flawed, since these credentials can be misused, misplaced, stolen, or otherwise compromised. When applied to the mainframe, Zero Trust essentially means that mainframe user accounts need to be thoroughly identified and authenticated before being granted access. Additionally, a Zero Trust approach to mainframe security puts a spotlight on issues of excessive access – in which mainframe user accounts are given a higher degree of privilege than what is absolutely necessary to complete their job.