Solution Brief

Mainframe Security
Top Secret™ for z/OS

• Continued investment leading toinnovations by Broadcom engineersthat meet the needs of today’s
regulatory requirements.

Mainframe Security solutions enable enterprises touse mainframe IT to solve business problems andtake advantage of the opportunities that mainframe
offers for digital transformation while ensuring atrusted environment for customers.

• Integrated with enterprise solutions
to address the full security lifecycle.

At a Glance• Same-day support for new
operating system releases and subsystem releases.

Broadcom® Mainframe Security solutions provide a foundation that enables
the mainframe to connect securely within your enterprise and deliver vital
support for digital transformation.

• Improved efficiency throughstreamlined administrative andreporting functions.

Top Secret™ manages the digital identities of users, devices and applications
accessing resources, and the underlying policies and processes thatgovern how those entities interact with the organization. Our Mainframe
Security solutions enable businesses to comply with relevant regulations
and corporate policies, and facilitate the reporting of critical information todemonstrate such compliance.

Key Benefits

Key Features• Multi-factor authentication
through Advanced Authentication
Mainframe integrated within TopSecret.
• Integrated security for z/OS, USS,and zLinux on the mainframe foruser authentication leveraging theTop Secret database.
• True external security for IBM
DB2 without the need for exit
processing.
• Built in administration with robust
security administration capabilities
provided through panels in TSO as
well as CICS.
• Flexibility to interface to Top Secretthrough ZOWE as well.
• Out-of-the-box reporting andauditing are robust; there is no
additional software to purchase.
• Simulated security testing ofchanges to ensure that a change
will deploy without incurring anoutage.

Top Secret for z/OS provides innovative, comprehensive security for yourbusiness transaction environments (including Linux, UNIX, and z/OS on IBMZ). Top Secret for z/OS helps you realize the reliability, scalability and costeffectiveness of the mainframe in a secure, trusted environment. Top Secretprovides the Advanced Authentication Mainframe feature, system entry
validation, resource control, auditability, accountability, and administrativecontrol. There is no need for additional add-on vendor tools for robustreporting and administration of Top Secret. In conjunction with distributed
security solutions from Broadcom, Top Secret provides mobile-to-mainframe
enterprise class security and compliance management.

Business Challenges
In today’s hybrid cloud and hybrid IT environments, mainframes are
more connected to enterprise processes than ever before in history. Thisconnectedness changes the security context, opens new threat vectors, andraises the risk level. Access to the mainframe is more open to employees,
partners, contractors, and customers. Controlling access to content andresources goes hand in hand with identity management of all individuals.
Access control must be granular, role based, and continually updated toensure that only the correct people have sufficient access. Effective security
requires consistent content controls across systems and the organization.
Organizations need to keep pace with available security solutions that
address modern threats. Inconsistent policies increase risk and invite
disaster. Companies cannot afford a lapse in security or complianceMainframe Security

Solution Brief
Business Challenges (cont.)
Key Features (cont.)• PDS Member Level Protection forfurther restriction of access withinpartitioned datasets.
• Top Secret supports segregation ofdata with multi-level security anddata classification options.
• Role-based access controls available
to implement within Top Secret.
• Day 1 support for all new operating
system releases and sub-systemreleases—for example, CICS, DB2,and IMS.

standards. The average cost of a data breach in 2020 was $8.64M in theU.S. ($3.86M global), and predictions of more than $150M for a major
business (Ponemon Institute). Unanticipated fines, fees and brand damage
can be detrimental, if not fatal, to business operations.

Solution Overview
Security is one of the most crucial components of an IT environment today.
Although security efforts have been around for four decades, Broadcom
continues to evolve Top Secret security to address modern threats andcompliance requirements. Top Secret is developed under the continuous
delivery model so that as the security landscape changes, from both athreat vector and a platform support perspective, the solution is ready tosolve today’s business challenges.

• Apply maintenance without theneed to IPL for most PTFs.

Critical Differentiators• Command-enabled security request
tracing through SecTrace facility.

• Broadcom listens to our customer’s needs, working together todeliver new solutions within Top Secret to meet the new cybersecurity
requirements of customers.

• Easily determine who has accessto data and resources through
WHOHAS sub-command.

Related Products• Top Secret™ for DB2 provides theability to externalize security for IBM
DB2 without the need for an exit.
• Cleanup finds and removes obsolete,unused, redundant and excessiveaccess rights in Top Secret, IBM
RACF, and ACF2™.
• Trusted Access Manager for Z
monitors and controls privilegedusers by granting time-boundedjust-in-time access to system,
to critical resources, and toregulated data or resources—allwith 1:1 accountability and auditing(included with the TSS license).
• Advanced Authentication for
Mainframe provides true multifactor authentication for mainframe
users. Supports RSA hard and soft
tokens, and radius protocol support(included with the TSS license).
• Compliance Event Manager provides
a single source for the collection andmonitoring of real-time, compliancerelated information and eventsoccurring within the mainframe
environment with the ability to send
to Splunk or an enterprise SIEMsolution.

• Top Secret implements ongoing innovations with Broadcom engineering
staff and doesn’t rely on third-party engineering.
• Multi-factor authentication is included for enhanced authenticationcontrols.
• Compliance reporting is included for flexible audit/compliance reports.
• No need for expensive third party mainframe administrative or reporting
front ends to perform tasks. Easy to use interfaces for your staff are partof our solution.
• Top Secret is integrated with cross-platform solutions such as Identity
Suite, Privileged Access Manager, and SiteMinder for full security lifecycle.
• Integrated security for z/OS, USS, and zLinux for user authentication
against Top Secret source of record.
• Granular control over Unix Systems Services (USS) SuperUsers.
• Full security control over USS files and directories with true external
security. Security staff no longer need to learn and manage native USS
security.
• Simulate authorization to ensure that changes work before deploying toavoid incurring an outage.
• PDS Member Level Protection for further restriction of access withpartitioned datasets, particularly those that may contain application
configuration.
• Robust native password complexity validation without any need for asecurity exit.
• Transmit security information to LDAP compliant directory managed
servers through LDAP Directory Services.

Mainframe Security

Solution Brief
Additional Items for Consideration
Related Products (cont.)• Auditor for z/OS (formerly CAExamine Auditing) delivers in-depth
auditing, integrity checks andverification for z/OS.
• Data Content Discovery finds andclassifies regulated and sensitive
data to ensure proper security andprivacy controls are in place for thedata.
• Compliance Information Analysis(CIA) replicates compliancesecurity information from themainframe security database intoa CIA relational data repository
for compliance and ad-hoc SQL
reporting.
• LDAP Server for z/OS provides
a full-function LDAP-compliant
directory server.
• PAM Client for Linux for System z isa flexible, open-source architecture
for user authentication on Linuxsystems. Pluggable Authentication
Module client support enables Top
Secret to act as an authentication
server for one or more Linuxsystems, eliminating the need for
redundant security administration
on a system-by-system basis.
• Distributed Security Integration(DSI) Is a standalone daemon thatruns in the z/OS UNIX environment,independent of the LDAP Server. Inaddition, DSI allows applications ona Windows platform to issue calls toTop Secret.

Broadcom not only continues to innovate mainframe security capabilities,
but also in other areas to support the growing mainframe securityecosystem:• STIG – Our mainframe security STIGs are a collection of recommended
settings for Top Secret. These articles sit somewhere between a hardrequirement and a best practice. For each article, we include thefollowing information:– A possible security exposure.
– How to identify if your site may be exposed.
– How to remedy said exposure.
For each STIG, we include detailed steps—in this case, Top Secretcommands. Users have the information they need in one spot toremediate the audit finding.
• Education – Online education enables your staff to train in new featuresand functionality on demand. Modularized training allows for flexible
learning.
• Mainframe Vitality Residency Program – Broadcom will train your staff or,
if you are having trouble finding talent, we will partner with you to findcandidates and train new skills through our Vitality Residency Program
to become Top Secret experts. Once fully-trained with experience in yourenvironment, they are available to transition and become one of youremployees fully certified in our solutions—all at little to no cost to you.
• Security Health Checks – Both no-cost reviews of key security settingsand paid engagements for a more in-depth review of your mainframe
security configurations are available.
• MRI Security Essentials – Compare key access control configurations andsettings against industry best practices with executive overviews anddashboards.
• Communities – Learn, connect, and share with other Top Secret users
as well as Broadcom product experts that promote peer-to-peerengagement.
• Roadmap sessions – Periodic sessions with the product team thathighlight future features and functionality so that your organization can
prepare to take advantage of upcoming innovations.
For more information, please visit: https://www.broadcom.com/products/mainframe/identity-access

For more product information: broadcom.com
Copyright © 2022 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.
All trademarks, trade names, service marks, and logos referenced herein belong to their respective companies.
CA-TS-zOS-SB101 June 8, 2022