For more than 40 years, IBM® mainframes have supported an extraordinary portion of the world's computing work, providing centralized corporate databases and mission-critical enterprise-wide applications. The IBM System z®, the latest generation of the IBM distinguished family of mainframe systems, has come a long way from its IBM System/360 heritage. Likewise, its IBM z/OS® operating system is far superior to its predecessors, providing, among many other capabilities, world-class, state-of-the-art, support for the TCP/IP Internet protocol suite.

TCP/IP is a large and evolving collection of communication protocols managed by the Internet Engineering Task Force (IETF), an open, volunteer, organization. Because of its openness, the TCP/IP protocol suite has become the foundation for the set of technologies that form the basis of the Internet. The convergence of IBM mainframe capabilities with Internet technology, connectivity, and standards (particularly TCP/IP) is dramatically changing the face of information technology and driving requirements for ever more secure, scalable, and highly available mainframe TCP/IP implementations.

The IBM z/OS Communications Server TCP/IP Implementation series provides understandable, step-by-step guidance about how to enable the most commonly used and important functions of z/OS Communications Server TCP/IP. This IBM Redbooks® publication explains how to set up security for your z/OS networking environment. With the advent of TCP/IP and the Internet, network security requirements have become more stringent and complex. Because many transactions come from unknown users and from untrusted networks such as the Internet, careful attention must be given to host and user authentication, data privacy, data origin authentication, and data integrity. Also, because security technologies are complex and can be confusing, we include helpful tutorial information in the appendixes of this book.

For more specific information about z/OS Communications Server base functions, standard applications, and high availability, refer to the other volumes in the series:

• "IBM z/OS V1R10 Communications Server TCP/IP Implementation Volume 1: Base Functions, Connectivity, and Routing," SG24-7696
• "IBM z/OS V1R10 Communications Server TCP/IP Implementation Volume 2: Standard Applications," SG24-7697
• "IBM z/OS V1R10 Communications Server TCP/IP Implementation Volume 3: High Availability, Scalability, and Performance," SG24-7698

In addition, "z/OS Communications Server: IP Configuration Guide," SC31-8775, "z/OS Communications Server: IP Configuration Reference," SC31-8776, and "z/OS Communications Server: IP User's Guide and Commands," SC31-8780, contain comprehensive descriptions of the individual parameters for setting up and using the functions that we describe in this book. They also include step-by-step checklists and supporting examples.

It is not the intent of this book to duplicate the information in those publications, but to complement them with practical implementation scenarios that can be useful in your environment. To determine at what level a specific function was introduced, refer to "z/OS Communications Server: New Function Summary," GC31-8771.

Part 1. SAF-based security

Chapter 1. RACF demystified

Chapter 2. Protecting network resources

Part 2. Managing security

Chapter 3. Certificate management in z/OS

Part 3. Policy-based networking

Chapter 4. Policy Agent

Chapter 5. Central Policy Server

Chapter 6. Quality of Service

Chapter 7. IP filtering

Chapter 8. IP Security

Chapter 9. Network Security Services for IPSec Clients

Chapter 10. Network Security Server for DataPower appliances

Chapter 11. Network Address Translation traversal support

Chapter 12. Application Transparent Transport Layer Security

Chapter 13. Intrusion Detection Services

Chapter 14. IP defensive filtering

Chapter 15. Policy-based routing

Part 4. Application-based security

Chapter 16. Telnet security

Chapter 17. Secure File Transfer Protocol

Appendix A. Basic cryptography

Appendix B. Telnet security advanced settings

Appendix C. Configuring IPSec between z/OS and Windows

Appendix D. zIIP Assisted IPSec

Appendix E. z/OS Communications Server IPSec RFC currency

Appendix F. Our implementation environment