News

IBM's Latest Mainframe Includes Constant Encryption Protection

• By John K. Waters
• 07/18/2017

IBM this week unveiled it's latest mainframe IBM Z, which is capable of running more than 12 billion encrypted transactions per day.

According to the company, the system features an encryption engine designed to extend the "cryptographic umbrella" across data, networks, external devices and entire applications, with no app changes or performance hit. At the heart of IBM Z is the next generation of the company's CMOS mainframe technology. It comes with a warp-speed microprocessor running at 5.2GHz, a new scalable system structure designed to deliver up to a 35 percent capacity increase for traditional workloads and a up to a 35 percent capacity increase for Linux workloads, compared to the previous generation z13.

But perhaps more importantly, the company is billing the new Z system as "the most significant repositioning of mainframe technology in more than a decade" -- as big, the company says, as its move to embrace Linux and open source more than a decade ago.

"The vast majority of stolen or leaked data today is in the open and easy to use because encryption has been very difficult and expensive to do at scale," said Ross Mauri, general manager for the IBM Z, in a statement. "We created a data protection engine for the cloud era to have a significant and immediate impact on global data security."

Data security is a serious, ongoing challenge for virtually all enterprises, and the widespread adoption of cloud and mobile technologies have added significant data security risks. IBM used this product release to underscore a "global epidemic" behind 9 billion data records lost or stolen since 2013. The IBM X-Force Threat Intelligence Index reported that more than four billion records were leaked in 2016, which is a 556 percent increase from 2015. Data breaches will have contributed to $8 trillion in cyber crime by 2022, the company said.

The cure for this epidemic, IBM believes, is "pervasive encryption." And yet Big Blue -- and many others -- acknowledge that encryption is often sparsely applied in corporate and cloud datacenters, because encryption products for x86 environments have tended to degrade performance, often dramatically. And they're complexity makes them a pain to manage and expensive to implement.

IBM developed its new system over a three-year period with input from 150 customers, the company said, all with data breaches and encryption at the top of their lists of concerns. The resulting IBM Z pervasive encryption capability reflects "a call to action on data protection articulated by Chief Information Security Officers and data security experts worldwide," the company said.

"The pervasive encryption that is built into, and is designed to extend beyond, the new IBM Z really makes this the first system with an all-encompassing solution to the security threats and breaches we've been witnessing in the past 24 months," said Peter Rutten, analyst at IDC's Servers and Compute Platforms Group, in a statement.

IBM Z is designed to encrypt data associated with an entire application, cloud service or database, in flight or at rest with one click. This kind of "bulk encryption" is made possible by a 7x increase in cryptographic performance over the previous generation z13, driven by a 4x increase in silicon dedicated to cryptographic algorithms.

The system also comes with tamper-responding encryption keys. A favorite target of hackers, encryption keys are routinely exposed in memory as they're used. IBM Z's key management system includes hardware that causes keys to be invalidated at any sign of intrusion, and can then be restored in safety. Another feature, IBM Secure Service Container, protects against insider threats from contractors and privileged users by providing automatic encryption of data and code in-flight and at-rest, and tamper-resistance during installation and runtime.

Another capability included is encrypted APIs. IBM z/OS Connect technologies are designed to make it easy for cloud developers to discover and call any IBM Z application or data from a cloud service, or for IBM Z developers to call any cloud service, the company explained. IBM Z allows organizations to encrypt these.

The IBM Z system can also give companies a means of complying with new standards, such as the EU's General Data Protection Regulation (GDPR), which goes into effect next year, the requirements in the US of the Federal Financial Institutions Examination Council (FFIEC), Singapore and Hong Kong's similar guidance, and the New York State Department of Financial Services' newly published Cybersecurity Requirements for Financial Services Companies.

The company also announced that IBM Z will be providing an encryption engine for IBM cloud services and run IBM Blockchain services "to provide the highest commercially available levels of cryptographic hardware." The company announced new blockchain services in centers in Dallas, London, Frankfurt, Sao Paolo, Tokyo and Toronto.

More information about the new IBM Z mainframes is available here.