Security is always a hot topic in mainframe, and that’s definitely the case at SHARE Sacramento, which runs this year from March 11 to March 16. Beyond a keynote on securing the mainframe by experts Phil Young and Chad Rikansrud, there are more than a dozen technical sessions that touch on security in some way.
One will focus entirely on security for CICS, the enterprise application servers that power billions of transactions each day. That session will be presented by Mark Wilson, a 30-year mainframe veteran and Global Technical Director at mainframe services provider RSM Partners. We spoke to Mark to find out what he has in store for Sacramento, and to learn his thoughts on the state of mainframe security and education. If you haven’t already, register for SHARE Sacramento by visiting event.share.org/register.
Could you describe your background in mainframe? How long have you been involved in SHARE?
I’ve been in mainframe computing since May 1980 – the same month The Empire Strikes Back was released in the U.K. and U.S. I started as a trainee operator and worked my way up through the ranks to operator, senior operator then shift leader, before moving into operations support and systems programming. In 1998, I took my first role in a consulting organization – something I’ve been doing ever since. I started RSM Partners in 2005 and have grown the business to the point where we now have almost 100 people. As for SHARE, I started attending in the late 1990s and became a regular speaker. I joined the security project officially around 2010, a development the rest of the SHARE team have probably regretted ever since!
You’re leading a session on CICS security – can you describe why this is such an important topic to cover?
I’m consistently amazed by the stats on the number of CICS transactions taking place on the planet each day. The sheer volume of processing being supported by mainframes dwarfs the Internet giants. It’s staggering. By comparison: some IBM numbers state that every second there are approximately 6,900 tweets, 30,000 Facebook likes and 60,000 Google searches. CICS processes more than 1.1 million transactions per second – that’s 100 billion transactions a day. So, is CICS security important? Absolutely. CICS transactions enable the world’s economy, but not many people actually know what it is. This session explains the basics of CICS security, to help ensure those billions of transactions each day are performed as securely as possible.
What are your thoughts on the current state of mainframe security? Do mainframe pros take it seriously enough? Are there any industry blind spots they should be aware of?
The biggest issue with mainframe security right now is the fallacy that mainframes are secure by default. This is simply not the case. Mainframe systems are the most securable server on the planet – certainly – but like most things in life, it takes a bit of time and investment to secure them properly. And that investment comes in many forms: from people through software tools to ongoing education. The problem is, we often see systems that are so bad that I seriously question whether I’d want to share my personal data with the organizations running them.
I do think mainframe security professionals take these issues very seriously. But, they need proper support from upper management to do the job properly. We still hear today that “the mainframe is secure” because it’s behind the corporate firewall, and no one understands it. Come on, this is 2018. The biggest threats to mainframe systems are still insider threats. The bad actors won’t target a system or application; they’re more likely to target an individual to steal their system logins and credentials.
An RSM team member spoke at an event recently and explained “the art of the possible” by way of a mainframe hack. Afterwards, an attendee said this wouldn’t work on his system. My colleague asked the attendee if he had access to do these things and the answer was yes. The riposte was, “What if I am you?” The reply? “That’s not fair...” Really: do we think the bad actors care if it’s fair or not?
What are your thoughts on the current state of mainframe education, and the resources available to younger programmers looking to join the industry?
Mainframe education is an extremely interesting topic, and very dear to my heart. I was given an opportunity at the tender age of 16 to join the mainframe world, and I’ve never looked back. There are a great many resources out there today for people wanting an IT career centered on mainframe technology. At RSM, for instance, we launched our own program to develop the next generation: Mainframer in Training (MIT). The issue, of course, is that it takes time and investment to grow the talent the industry requires, and investment of any sort is always challenging in today’s corporate world. But the clock is ticking as old-timers retire. Organizations, and the industry in general, need proper plans to replace them. Even I may retire one day. But you’ll probably have to drag me away kicking and screaming.
What do you hope attendees walk away with?
A smile and some impetus to take a closer look. My hope is they will have a bit of fun for an hour and leave with basic but useful information on CICS and how to secure it. I want to provide people with enough information so they can take a good look at their own implementation of CICS security and can have a sensible discussion with their peers, senior managers and leaders on the risks associated with their organization’s CICS security posture.
Heading to SHARE Sacramento? Mark will host “CICS Security for Dummies; Presented by a Dummy” Thursday, March 15 from 4:30 pm to 5:30 pm – log in here to save his course to your SHARE profile.
You also still have time to register for SHARE Sacramento, March 11-16, if you haven’t already.