Explain RACF and Mainframe Security in IBM Mainframes

53 / 60

z/OSintermediate

RACF and Mainframe Security

Understand how RACF controls authentication and authorization for datasets, resources, and transactions on z/OS.

RACF decides who may log on, what they may reach, and at what level. Almost every dataset access and every CICS transaction goes through it.

RACF is a building's centralized badge access system — instead of every door having its own separate lock and key list, badges are issued to individuals and assigned to groups (departments), and each door (a dataset or transaction) has a policy defining which badge groups and access levels (enter, enter and use equipment, enter and reconfigure the room) are allowed through it.

Key Concepts

Three kinds of profile.

    user profile      an individual: their id, default group, attributes
    group profile     a set of users with common access needs
    resource profile  protection for a dataset, transaction or resource

Access is granted to groups, not people. That is the operating principle:

    GROUP  PAYCLERK
      users: ASHA, RAVI, MEERA
    PROFILE PROD.PAYROLL.**
      PERMIT PAYCLERK ACCESS(READ)

A new clerk is connected to the group. Someone leaving is disconnected. Nobody edits the dataset profiles, which is what makes the model auditable at all.

Access levels are ordered.

    NONE    no access
    READ    read it
    UPDATE  read and change it
    CONTROL for VSAM, beyond UPDATE
    ALTER   full control, including deleting it and changing its profile

ALTER on a dataset profile includes the ability to change who else can reach it, which is why it is given sparingly.

ALTER

Profiles use patterns, and the most specific one wins:

    PROD.PAYROLL.**        generic -- everything under it
    PROD.PAYROLL.SALARY.*  more specific -- overrides for these

That specificity rule is how a general read grant coexists with a tighter rule on the sensitive subset. It also means adding a broad profile can unintentionally cover datasets that had no profile before.

The attribute to be careful with. A user with SPECIAL can change any RACF profile in the system. OPERATIONS grants access to most datasets regardless of their profiles.

SPECIALOPERATIONS

Both exist for administration and both defeat the controls everywhere. Auditors ask who holds them, and the answer should be short.

How a check is logged. RACF records failures, and successes for profiles marked to audit them. That log is the evidence trail — it is how an investigation answers who read a file and when, which is the reason the logging exists rather than a by-product.

Beyond datasets. RACF also protects CICS transactions (so a user may run INQC and not UPDC), DB2 objects, JES resources and operator commands. The model is the same in each case: a resource profile, a permitted group, and a level of access.

INQCUPDC

What the interviewer is probing.1. "What are the main RACF concepts?" Probing: the model. Stalls: "Users." Moves up: users, groups, resource profiles and access levels, with profiles usually defined generically over dataset name patterns.

2. "What are the access levels?" Probing: the detail. Stalls: "Read and write." Moves up: NONE, EXECUTE, READ, UPDATE, CONTROL and ALTER — in increasing order.

3. "Why is group-based access preferred?" Probing: the discipline. Stalls: "Convenience." Moves up: permissions attach to a role rather than a person, so a leaver is handled by one group removal rather than an audit of every profile.

4. "What is the significance of generic profiles?" Probing: the practical angle. Stalls: "Nothing." Moves up: one profile covers a whole naming pattern, which is why naming conventions are effectively a security control.