Introduction

z/OS Security is a critical component of IBM’s mainframe operating system, designed to protect sensitive data and system resources in enterprise environments.

It relies on robust access control mechanisms, typically enforced by external security managers (ESMs) like RACF (Resource Access Control Facility), Top Secret, or ACF2.

These tools manage authentication, authorization, and auditing by controlling how subjects (users, programs) access objects (datasets, resources).

Let's understand it in context of Subjects and Objects

Subject

• A subject is an active entity—usually a user, process, or application—that requests access to a resource.
• For example: a user logged into a mainframe session, or a batch job that runs a program.

Object

• An object is a passive entity—such as a file, dataset, database table, or memory block—that contains or receives information.
• For example: a VSAM file, a DB2 table, or a JES job queue.

Access Control

• Access between subjects and objects is managed through security policies.
• These policies define what actions (read, write, execute, etc.) a subject is permitted to perform on an object.

In the Context of Mainframes (e.g., IBM z/OS)

• Security is often enforced using tools like RACF (Resource Access Control Facility), Top Secret, or ACF2.
• These security tools define access rules between subjects and objects.
• Example:
  • Subject: USERA
  • Object: SYS1.PARMLIB (a dataset)
  • Access rule: USERA has read-only access.

Security in Details

Mainframe security is about keeping data safe in a mainframe system. Since mainframes handle important and sensitive information, strong security is a must.

It includes:

• User Identification & Authentication: Checking who is accessing the system using IDs, passwords, or multi-factor authentication.
• Authorization & Access Control: Giving permissions based on roles to control who can view, change, or run files and programs.
• Data Encryption: Protecting data by converting it into a secure format while stored or transmitted.
• Auditing & Monitoring: Keeping track of system activities and logging them to spot any unusual activity.
• Incident Response: Detecting and fixing security issues quickly to prevent harm..

Key Areas & Tools in Mainframe Security

• Access Control Lists (ACLs): Define which users or groups can access particular resources.
• Profiles & Permissions: Each resource (datasets, programs, terminals) has an associated profile that determines allowed operations.
• Role-Based Access Control (RBAC): Users are grouped by roles, and privileges are assigned accordingly.
• Audit Trails: Continuous logging of all access attempts—both successful and failed—to ensure compliance and for forensic analysis.

IBM Docs - Overview of security

Primary Security Tools

Mainframe security ensures that applications and data are protected from unauthorized access. The well known security tools includes

RACF (Resource Access Control Facility) – IBM’s Security Solution

• Purpose: Controls user authentication, access management, and auditing in z/OS.

• Key Features:

  • User & Group Management: Manages user IDs, groups, and associated privileges.
  • Resource Profiles & ACLs: Defines what actions (READ, WRITE, ALTER, CONTROL) are allowed on datasets and system resources.
  • Audit & Logging: Tracks access attempts for security monitoring.
  • Integration: Supports encryption and external authentication systems (e.g., MFA).

IBM Docs - What is RACF?

Top Secret (TSS)

• Focus: Centralized role-based access control, authentication, and auditing.
• Key Highlight: Detailed logging and compliance tracking.

ACF2 (Access Control Facility 2)

• Focus: Customizable security policies for granular access control.
• Key Highlight: Flexible rule-based security model.

z/OS Security Services / SAF

The security of z/OS is centralized on the System Authorization Facility, which can provide its own security services, but is more likely to route requests for security services to another security manager such as the IBM Resource Access Control Facility (RACF®).

• Purpose: Provides a centralized security framework for authentication, encryption, and policy enforcement.
• Core Features:
  • Works with RACF, TSS, or ACF2 for access control.
  • Includes cryptographic services for secure data storage and transmission.
  • Supports multi-factor authentication and encryption for enhanced security.

System Authorization Facility (SAF)

SAF (System Authorization Facility) is a security component in IBM z/OS that acts as a bridge between the operating system and security tools like RACF, ACF2, or Top Secret.

What SAF Does

• Checks Authorization: When a user or program tries to access a file, program, or system service, SAF asks the security tool (like RACF) if they have permission.
• Controls Security Centrally: SAF ensures that all security rules are enforced consistently across the system.
• Logs Security Events: It records access attempts, making it easier to track and audit system activity.

How SAF Works:

• A user or program tries to access a resource (e.g., a dataset or application).
• SAF sends the request to the active security manager (RACF, ACF2, or Top Secret).
• The security tool checks permissions and responds with allow or deny.
• SAF enforces the decision and logs the event for auditing.

IBM Docs - What is SAF?

Authorized Program Facility (APF)

APF (Authorized Program Facility) allows trusted programs to run with special privileges in z/OS, bypassing some security checks.

• Runs Trusted Programs Safely: Only approved programs can have these special privileges to protect system security.
• Access to System Resources: APF programs can use system files and memory without normal security restrictions.
• Used for System Maintenance: Special utilities, system tools, and installation programs often need APF authorization.

How it is Managed

• APF List: A system file keeps a list of approved programs that can run with special permissions.
• Controlled by Admins: Only system administrators can add or remove programs from the APF list.
• • Security Check: If a program is not on the APF list, it runs with normal restrictions.

How APF Works

When a program starts running in z/OS, the system checks if it is APF-authorized.

• If the program is APF-authorized: It gets special privileges to access system files, commands, and resources without restrictions.
• If the program is NOT APF-authorized: It cannot access certain system files or run commands that could affect system security.

Since APF programs have high-level access, only essential and trusted programs should be authorized to protect system security.

Common Example

• DFSMS Dataset Management Tools – Handle dataset creation, backup, and recovery by bypassing normal security checks.
• Performance & Monitoring Tools – Need deep system access to check performance and system health.

IBM Docs - What is APF?

IBM Docs - APF and AMS

System Management Facility(SMF)

SMF (System Management Facility) records in a mainframe are logs that store detailed system activity and performance data. They help track and log system activities, including user access, authentication, and data changes, making them essential for auditing, compliance, and intrusion detection.

IBM Docs - Introduction to SMF Records.

Common Functionalities Includes:

• User Activity Tracking – Logs user logins, logouts, and command executions.
• Access Monitoring – Captures who accessed which datasets, programs, or system resources.
• Security Events – Records failed login attempts, unauthorized access, and security policy violations.
• Audit & Compliance – Helps organizations meet security standards (e.g., PCI-DSS, HIPAA, SOX) by providing detailed logs.
• Intrusion Detection – Alerts security teams about suspicious activities, like repeated failed logins or unauthorized system access.
• Use Cases: System admins and security teams use them for performance tuning, billing, auditing, and detecting security threats.