By Reg Harbeck with Phil Young

This is part three of a 10-part series on security for the mainframe. During SHARE San Jose 2017 Reg Harbeck, chief strategist with Mainframe Analytics Ltd. and member of the SHARE Editorial Advisory Committee, sat down with Phil Young, co-founder of zedsec 390 to explore critical security topics, and offer tips and tactics to help create a more secure mainframe environment.

Imagine a vast herd of wild mainframes—10,000 strong, roaming the ‘IT planes’, apparently impervious to any predators that might threaten them.

Imagine a vast disaster that everyone expects to swallow up the herd—let’s call it “Y2K”—passing harmlessly by as if it didn’t even impact on their surface. And the herd continues on, growing bigger and stronger.

Then one day, a Young Soldier of Fortran (Phil Young) appears and claims that there are vulnerabilities, and begins to show how he can successfully target and take a mainframe down.

What do you do? Do you shoot the messenger? Do you ignore him, since clearly the ‘herd’ has proven its invulnerability? Do you bury your head in the sand and hope you make it to retirement before you have to deal with the implications?

In the “old days” before the Internet and Google, these seemed like good options. After all, in the past, such dangerous information was kept secret for generations. A little bit of hush money, a good poker face, and staying the course were good strategies.

That was when it still seemed possible to keep Pandora’s Box closed (if I may be so bold as to add an additional metaphor into the mix).

Today, the world has reverted to a wilder, more organic state with the general searchability of any so-called secret you might care to know. And while steganography—hiding secrets in plain sight—can still be a good strategy for apparently unimportant targets, it’s hard to imagine that mainframes will be able to keep their camouflage of being “extinct” or “unimportant” for much longer.

Indeed, it is much easier to imagine that there are already individuals and organizations that have discovered the mainframe, and are poking around, looking for opportunities. And not just curious and relatively harmless ones, either. And if Phil can find it out, that means it can be found out.

So, in our interview, when I asked Phil about the danger of exposing the vulnerabilities he’d become aware of, he suggested that an effective way to inoculate the herd was to allow for the weakest to “catch the flu” with the intended result that “everyone else was fine.”

After all, an immune system stays strong by being challenged, not ignored.

But how do we get the word out so the good guys can do something about it before the bad guys start digging? That’s what this series is intended to do, continuing with the next topic.

Read part 2 - Young, the Mainframe Hacker: Young Mainframe Devolution.
Read part 1 - Young, the Mainframe Hacker: The Saga Begins.