Micro-segmentation is the ability to limit application access to a specific network segment or specific network device, providing you with an additional layer of security above and beyond user authentication.

• An innovative way to manage segmentation using ESM (RACF|ACF2|TSS)
• Unique Network Discovery: build a complete map of network activity
• Isolate specific aspects of your environment at network not userid level
• Better understand your network and traffic patterns
• Block unwanted or unnecessary network traffic
• Periodic reporting for compliance
• Dramatically reduce the time and costs of compliance assessments

Using zTrust for Networks, you control access by permitting network segments to access specific applications using standard SAF controls and commands, all managed by the software, rather than either blocking or enabling access to the mainframe in its entirety.

zTrust augments standard IBM components, applying additional management, implementation and monitoring controls to separate systems with different security needs, so reducing the number of systems in scope. While it may be possible to do this manually, the time and costs can make it prohibitive for large and complex organizations.

Stage 1 – Network Discovery
With various applications requiring compliance with specific regulations or industry standards, zTrust’s unique Network Discovery feature detects all network traffic on the LPAR and builds a Network Knowledge Base of all connections. The software learns the current picture of who is connecting to what.

Stage 2 – ESM Resource Generation
zTrust uses the Network Knowledge Base to build a complete set of ESM resources and access list based on current network traffic. Prior to execution, the access lists can be reviewed to ensure only permitted network segments and devices are accessing key applications. Access controls can be extended to only allow access from specific network segments if the connections are encrypted.

Stage 3 – Build Security Profiles
zTrust analyses the ESM security profiles in RACF|ACF2 |TSS and builds the IBM Policy Agent profiles required to block or permit specific network traffic based on the ESM access controls. Although Policy Agent filters are typically defined at the IP address and port level, zTrust managed resources in the ESM are managed by their names, further simplifying the network segmentation process. You are continuing to work with the gold standard in mainframe security but with an added layer of application security.

Stage 4 – Monitor & Manage Complexity
While monitoring proves your segmentation is working, businesses and networks can experience change: new applications added, and new traffic patterns emerging. zTrust means you can manage this hugely complex requirement, via standard commands, or the Vertali browser interface enabling easy viewing of status and simplifying operational processes. New Policy Agent filters can be regenerated by zTrust as new network resources are detected or additional access controls are required.

Stage 5 – Report for Compliance Audits
Network micro-segmentation is a more efficient and cost-effective way to control regular audit commitments for mandatory compliance, and address recommendations that can soon be mandatory. Audit logs are maintained, documenting all activity, and reporting is easy. Periodic reports for compliance can be generated confirming not only the network segmentation policies implemented, but also exception reports highlighting where additional segmentation policies may be required.

Segmentation can apply to both inbound and outbound connections on z/OS. You receive a full and accurate analysis of network activity on the mainframe without relying on high volume SMF processing. You can detect new or unexpected network activity to/from the mainframe, and confirm or otherwise that firewall settings are correct and working.

Inbound IP Activity Alerts

• Permanently open TCP ports (open for incoming connections)
• Permanently open UDP ports (open for incoming datagrams)
• Temporarily open TCP ports to which a connection has been made
• Open unreserved ports to which connections have been successful
• When an IP address first attempts mainframe access
• When an IP address first establishes a clear connection to a mainframe application
• When an IP address first establishes an encrypted connection to a mainframe application
• When an IP address first establishes a connection to a VTAM application via TN3270
• When an IP address first sends a UDP packet to mainframe
• When an IP address first sends a UDP packet to a mainframe application
• All inbound connection failures/rejects

Outbound IP Activity Alerts

• First time mainframe attempts to connect to a remote IP address not accessed before
• First time mainframe successfully connects to a remote IP address in clear
• First time mainframe successfully connects to a remote IP address with encryption
• First time mainframe successfully connects to a remote IP//Port combination not accessed before
• All outbound connection failures
• First time mainframe sends a UDP packet to a remote IP
• First time mainframe sends a UDP packet to a remote IP/Port combination