Chapter 28 Key Takeaways: Mainframe Security for COBOL Developers

Threshold Concept

Security is an architecture decision, not a bolt-on. Security permeates every layer — network, system, dataset, DB2, CICS, MQ, and application code. Designing it in from day one is architecture. Adding it later is rework.

The Seven-Gate Security Model

Network   →  System    →  Dataset   →  DB2       →  CICS      →  MQ        →  Application
(AT-TLS,     (RACF       (RACF        (DSNR +      (TCICSTRN,   (MQQUEUE,    (code-level
 IP filter)  auth,       profiles,    GRANT/       resource     MQPROC,      checks,
             MFA)        encryption)  REVOKE)      security)    RESLEVEL)    masking,
                                                                             audit log)

Key insight: Each gate is independently configured, independently audited, and independently logged. An attacker must defeat every gate. Configure every gate — not just the outer ones.

RACF Essentials

Critical resource classes for COBOL architects:

Encryption Architecture

Key insight: Encryption on z/OS is free in CPU cost. CPACF runs on dedicated hardware coprocessors not measured for software licensing. The "encryption is too expensive" argument does not apply to z/OS.

Key management rules: - Master keys: dual control, annual rotation - Data encryption keys: ICSF CKDS, quarterly rotation, RACF CSFKEYS protection - TLS certificates: RACF keyrings, annual renewal - Never embed keys in COBOL source or copybooks

Secure COBOL Coding Rules

SQL Injection Prevention

Buffer Overflow Prevention

• Always validate reference modification offsets and lengths before use
• Use OVERFLOW clause on UNSTRING to detect unexpected delimiters
• Use COUNT IN to verify data lengths after UNSTRING
• Validate container data length before EXEC CICS GET CONTAINER

Audit Logging

• Write audit record before the business action (update result after)
• Capture: who (userid), what (action, data), when (timestamp), where (terminal/IP), outcome (success/failure)
• Write to RACF-protected transient data queue or dataset
• Log both successful and failed operations

Data Masking

• Externalize masking decisions to RACF (FACILITY class check)
• Never hard-code user lists for masking decisions
• PAN: show last 4 only (****-****-****-1234)
• SSN: show last 4 only (***-**-6789)
• Mask at the earliest point where you know the consumer's authorization level

PCI-DSS Compliance Map (Summary)

HIPAA Compliance Essentials

HIPAA Safe Harbor: If ePHI is encrypted (AES per NIST standards) and the key is not compromised, a security incident is NOT a breach — no 60-day notification obligation.

Security Monitoring Tiers

Incident Response Framework

Detection (0-15 min) → Containment (15-60 min) → Investigation (1-24 hr)
  → Eradication (1-48 hr) → Recovery (1-72 hr) → Lessons Learned (2 wk)

Severity 1 rule: Contain first, investigate second. ALTUSER userid REVOKE before forensics.

Rules of Thumb

• UACC(NONE) on everything. If you can't justify UACC(READ), you don't need it.
• SETROPTS PROTECTALL(FAILURES). An unprotected dataset is an uncontrolled dataset.
• RACLIST every active resource class. The 1,000x performance difference is not optional.
• Never STRING user input into dynamic SQL. Host variables or parameter markers. Always.
• Validate all reference modification bounds. Every. Time.
• Audit successful access to sensitive data, not just failures. Compliance requires it.
• Encrypt all ePHI/cardholder data at rest and in transit. CPU cost is zero on z/OS.
• Separate batch userids by function. Shared userids are shared risk.
• Rotate encryption keys quarterly. Document the rotation.
• Test the incident response plan quarterly. An untested plan is not a plan.
• Security debt compounds. Fix it when you find it, not when the auditor finds it.