Solution Brief

Mainframe Security
ACF2™ for z/OS

• Continued investment leading toinnovations by Broadcom engineersthat meet the needs of today’s
regulatory requirements.

Mainframe Security solutions enable enterprises touse mainframe IT to solve business problems andtake advantage of the opportunities that mainframe
offers for digital transformation while ensuring atrusted environment for customers.

• Integrated with enterprise solutions
to address the full security lifecycle.

At a Glance• Same-day support for new
operating system releases and subsystem releases.

Broadcom® Mainframe Security solutions provide a foundation that enables
the mainframe to connect securely within your enterprise and deliver vital
support for digital transformation.

• Improved efficiency throughstreamlined administrative andreporting functions.

ACF2™ manages the digital identities of users, devices and applications
accessing resources, and the underlying policies and processes thatgovern how those entities interact with the organization. Our Mainframe
Security solutions enable businesses to comply with relevant regulations
and corporate policies, and facilitate the reporting of critical information todemonstrate such compliance.

Key Benefits

Key Features• Protection by default for datasetsand resources. There is no conceptof global access for undefinedresources.
• Multi-factor authentication
through Advanced Authentication
Mainframe integrated within ACF2.
• Integrated security for z/OS, USS,and zLinux on the mainframe foruser authentication leveraging theACF2 logon-id database.
• True external security for IBM
DB2 without the need for exit
processing.
• Built in administration with robust
security administration capabilities
provided through panels in TSO as
well as CICS.
• Flexibility to interface to ACF2
through ZOWE.
• Out-of-the-box reporting andauditing are robust; there is noadditional software to purchase.
• Simulated security testing ofchanges to ensure that a change
will deploy without incurring anoutage.

ACF2 for z/OS provides innovative, comprehensive security for yourbusiness transaction environments (including Linux, UNIX, and z/OS on
IBM Z). ACF2 for z/OS helps you realize the reliability, scalability and costeffectiveness of the mainframe in a secure, trusted environment. ACF2
provides the Advanced Authentication Mainframe feature, system entry
validation, resource control, auditability, accountability, and administrative
control. There is no need for additional add-on vendor tools for robust
reporting and administration of ACF2. In conjunction with distributed
security solutions from Broadcom, ACF2 provides mobile-to-mainframe
enterprise class security and compliance management.

Business Challenges
In today’s hybrid cloud and hybrid IT environments, mainframes are
more connected to enterprise processes than ever before in history.
This connectedness changes the security context, opens new threat
vectors, and raises the risk level. Access to the mainframe is more open
to employees, partners, contractors, and customers. Controlling access tocontent and resources goes hand in hand with identity management of allindividuals. Access control must be granular, role based, and continually
updated to ensure that only the correct people have sufficient access.
Effective security requires consistent content controls across systems andthe organization. Organizations need to keep pace with available security
solutions that address modern threats. Inconsistent policies increaserisk and invite disaster. Companies cannot afford a lapse in security orcompliance standards. The average cost of a data breach in 2020 was$8.64M in the U.S. ($3.86M global), and predictions of more than $150M fora major business (Ponemon Institute). Unanticipated fines, fees and branddamage can be detrimental, if not fatal, to business operations.

Mainframe Security

Solution Brief

Key Features (cont.)• PDS Member Level Protection forfurther restriction of access within
partitioned datasets.
• ACF2 supports segregation of datawith multi-level security and dataclassification options.
• Record Level Locking in CICS.
• Role-based access controls available
to implement within ACF2.
• Day 1 support for all new operating
system releases and sub-systemreleases—for example, CICS, DB2,and IMS.

Solution Overview
Security is one of the most crucial components of an IT environment today.
Although security efforts have been around for four decades, Broadcom
continues to evolve ACF2 security to address modern threats andcompliance requirements. ACF2 is developed under the continuous delivery
model so that as the security landscape changes, from both a threat vector
and a platform support perspective, the solution is ready to solve today’s
business challenges.

Critical Differentiators• Broadcom listens to our customer’s needs, working together to deliver
new solutions within ACF2 to meet the new cybersecurity requirementsof customers.
• ACF2 implements ongoing innovations with Broadcom engineering staff
and doesn’t rely on third-party engineering.

• Apply maintenance without theneed to IPL for most PTFs.

• Protection by default. ACF2 can protect both defined and undefined
datasets and resources.

• Command-enabled security request
tracing through SecTrace facility.

• Multi-factor authentication is included for enhanced authentication
controls.

• Easily determine who has access todata and resources through ACCESS
sub-command.

• Compliance reporting is included for flexible audit and compliancereports.

Related Products• ACF2™ for DB2 provides the ability
to externalize security for IBM DB2
without the need for an exit.
• Cleanup finds and removes obsolete,unused, redundant, and excessiveaccess rights in ACF2, IBM RACF
and Top Secret™.
• Trusted Access Manager for Z
monitors and controls privileged
users by granting time-boundedjust-in-time access to system, tocritical resources, and regulated
data or resources—all with 1:1accountability and auditing(included with the ACF2 license).
• Advanced Authentication for
Mainframe provides true multifactor authentication for mainframe
users. Supports RSA hard and soft
tokens, and radius protocol support(included with the ACF2 license).
• Compliance Event Manager provides
a single source for the collection andmonitoring of real-time, compliancerelated information and eventsoccurring within the mainframe
environment with the ability to send
to Splunk or an enterprise SIEM
solution.

• No need for expensive third party mainframe administrative or reporting
front ends to perform tasks. Easy to use interfaces for your staff are partof our solution.
• ACF2 is integrated with cross-platform solutions such as Identity Suite,Privileged Access Manager, and SiteMinder for full security lifecycle.
• Integrated security for z/OS, USS, and zLinux for user authentication
against ACF2 source of record.
• Granular control over Unix Systems Services (USS) Superusers.
• Full security control over USS files and directories with true external
security. Security staff no longer need to learn and manage native USSsecurity.
• Simulate authorization to ensure that changes work before deploying toavoid incurring an outage.
• PDS Member Level Protection for further restriction of access withpartitioned datasets, particularly those that may contain application
configuration.
• Robust native password complexity validation without any need for asecurity exit.
• Transmit security information to LDAP compliant directory managed
servers through LDAP Directory Services.

Mainframe Security

Solution Brief

Related Products (cont.)• Auditor for z/OS (formerly CAExamine Auditing) delivers in-depth
auditing, integrity checks, andverification for z/OS.
• Data Content Discovery finds andclassifies regulated and sensitive
data to ensure that proper security
and privacy controls are in place forthe data.
• Compliance Information Analysis(CIA) replicates compliancesecurity information from themainframe security database intoa CIA relational data repository
for compliance and ad-hoc SQL
reporting.
• LDAP Server for z/OS provides
a full-function LDAP-compliantdirectory server.
• PAM Client for Linux for System z isa flexible, open-source architecture
for user authentication on Linuxsystems. Pluggable Authentication
Module client support enables ACF2to act as an authentication server
for one or more Linux systems,
eliminating the need for redundantsecurity administration on a systemby-system basis.

Additional Items for Consideration
Broadcom not only continues to innovate mainframe security capabilities,
but also in other areas to support the growing mainframe security
ecosystem:• Education – Online education enables your staff to train in new featuresand functionality on demand. Modularized training allows for flexible
learning.
• Mainframe Vitality Residency Program – Broadcom will train your staff or,
if you are having trouble finding talent, we will partner with you to findcandidates and train new skills through our Vitality Residency Program
to become ACF2 experts. Once fully trained with experience in yourenvironment, they are available to transition and become one of youremployees fully certified in our solutions—all at little to no cost to you.
• Security Health Checks – Both no-cost reviews of key security settingsand paid engagements for a more in-depth review of your mainframe
security configurations are available.
• MRI Security Essentials – Compare key access control configurations andsettings against industry best practices with executive overviews anddashboards.
• Communities – Learn, connect, and share with other ACF2 users as wellas Broadcom product experts that promote peer-to-peer engagement.
• Roadmap sessions – Periodic sessions with the product team thathighlight future features and functionality so that your organization can
prepare to take advantage of upcoming innovations.
For more information, please visit: https://www.broadcom.com/products/mainframe/identity-access• Distributed Security Integration(DSI) is a standalone daemon thatruns in the z/OS UNIX environment,
independent of the LDAP Server. Inaddition, DSI allows applications ona Windows platform to issue calls toACF2.

For more product information: broadcom.com
Copyright © 2022 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.
All trademarks, trade names, service marks, and logos referenced herein belong to their respective companies.
CA-ACF2-zOS-SB101 June 8, 2022