Mainframe & RACF: Security in the Time of Dinosaurs

In the 1950s, computing made its way into the business world. The data processing capabilities delivered by mainframe computers couldn’t be matched. Today, we will delve into the security systems of these computers, particularly focusing on RACF.

Beginning in the mid 1970’s, “Historical Background Resource Access Control Facility” (RACF) emerged on the MVS operating system provided by IBM with its mainframe computers. RACF is responsible for ensuring security and control over operations performed within the system. It is based on three principles:

• User Identification and Verification
• Authorization for Resource Access
• Logging and Reporting of Access Activities

Despite its age, this system has evolved alongside IBM’s hardware and operating systems. Even today, after nearly 50 years of service, it continues to ensure security for modern z/OS systems, which are the 64-bit descendants of MVS.

How Does It Work? 

The RACF system provides the necessary tools to manage user access to critical resources. RACF stores information about users, resources, and access permissions in special structures called “profiles” within its database. It refers to these profiles when deciding which users should be allowed to access protected system resources. RACF, to aid in safeguarding critical resources, enables:

• Identification and authentication of users
• Authorization of users to access protected resources
• Logging and reporting of unauthorized access attempts to protected resources
• Control over means of resource access

Exporting and auditing 

The principle is to treat each piece of data as a record, and the attributes change based on the type of record. There are three categories that group these record types:

• Groups
• Users
• Resources

Well-known record types include, for example, “0100 – Group basic data” or “0200 – User basic data.” In an RACF extraction, you will find all the records in a single file, with the first four characters identifying the record type. Each type is also well defined. Each attribute is defined within a character range. For example, with type 0200:

• Characters 6 to 13: User login
• Characters 50 to 53: Account status (Revoked)

And Identity and Access Governance (IAG) in All of This? 

Despite the age of many IBM mainframe computers, they are still prevalent, especially in the IT systems of banks, insurance companies and other financial services firms. Reviewing RACF accounts is therefore a significant aspect of their identity and access governance.

WALLIX Kleverware is capable of auditing and analyzing these “dinosaurs,” identifying anomalies, and enabling data recertification. The first step in the process is to present RACF records in a more readable format, without requiring reviewers to browse through 20 pages of documentation to determine if the SPECIAL attribute is assigned to an account.  As we saw in the previous section, RACF extractions are formatted based on the RECORD type. Once the type is identified, the data can be transformed into a more readable form, such as Excel or CSV (for the more adventurous.) Only records relevant to account reviews are retained. Based on experience, here is the list of attributes that WALLIX Kleverware systematically audits for its clients:

Record Type 0100: “Group Basic Data” This type defines basic information associated with a group. One record corresponds to one group.

Record Type 0101: “Group Subgroups” This type defines relationships between different groups. One record corresponds to a relationship between two groups.

Record Type 0200: “User Basic Data” This type defines basic information associated with a user. One record corresponds to one user.

Record Type 0203: “Group Subgroups” This type defines relationships between users and groups. One record corresponds to a relationship between a user and a group.

In addition to these pieces of information, WALLIX Kleverware IAG integrates the necessary data for the client’s review. For this purpose, other types of records can also be extracted, such as record 0205 “User Connect” for information related to TSO, for example. Once the necessary information is extracted and transformed, it can be presented to the reviewers through the application and integrated with the rest of the IT system that has been modeled to establish the legitimacy of users, groups, and access associated with RACF.