Progress announced the latest release of Progress® Semaphore™, its metadata management and semantic AI platform.
For years, mainframe systems have served as the bedrock of enterprise networks, standing unmatched in terms of reliability, scalability, and data protection. But with emerging practices like DevOps, the rise of open-source, and the move to hybrid cloud models, security risks have become a pressing concern. With constantly changing rules and shifts in how software is developed and used, it's more important than ever to focus on mainframe security. With over 70% of Fortune 500 companies still relying on mainframe infrastructure — mainframe security has never been more critical.
According to Rocket Software's latest research report, only 28% of IT leaders are extremely confident in their ability to proactively respond to mainframe security vulnerabilities — despite agreeing that mainframe security is a top priority for their organization. This is thanks in large part to the complexity of solutions like DevOps. While DevOps tools increase an organization's ability to deliver applications and services at a faster pace than ever before, security must remain a priority.
Risks of Open-Source Tools
While open-source DevOps tools pave the way for myriad benefits, they still come with a fair share of risks. These tools allow for community collaboration and transparency, but that also means that potential attackers can examine the code for vulnerabilities. A predominant concern centers around the security and integrity of open-source components embedded within mainframe applications.
The good news is that organizations are taking open source and mainframe security seriously. The report found proactive measures dominate the landscape, with 62% of organizations routinely conducting vulnerability assessments and security audits.
Additionally, 58% of respondents noted they engage in continuous monitoring and updating of open source to address security patches promptly, and 54% noted they are training developers on best practices for secure coding and proper usage of open-source components.
Incorporating security best practices into the DevOps toolchain — also known as DevSecOps — helps ensure security remains a consistent, shared responsibility throughout the software development life cycles and that security updates are added quickly and smoothly. This reduces the chance of threats within the mainframe and ensures companies get the most out of their DevOps investments.
Compliance and Third-Party Security
While many organizations take mainframe security seriously, about 68% according to the report, unfortunately compliance can fall to the wayside. Only 27% of survey participants are highly confident in their organization's mainframe security compliance effectiveness. Compliance regulations provide guidelines for how businesses should be protecting critical customer data. Due to the sensitive nature of this data — and the potential harm to customers if it is not protected — the penalties for organizations that fail to comply with security regulations are quite considerable.
The large fines given to businesses that do not meet compliance can cause irrevocable damage to the business both financially and in terms of the organization's reputation. Following relevant security compliance regulations will help maintain the security and integrity of sensitive data stored on mainframe systems. Organizations that implement security-focused tools on the mainframe will be in a better position to comply with their compliance requirements.
Compliance isn't just an internal endeavor. Businesses must also keep an eye on their third-party suppliers. Making sure suppliers meet quality standards (QA) is as important as internal compliance, especially for heavily regulated industries like banking and healthcare. Yet only 31% of respondents are fully convinced of their organization's effectiveness in making certain that vendors stick to these rigorous QA benchmarks. Organizations should maintain ambitious standards for vetting third-party vendors, ensuring the rights of individuals and their data are at the forefront of each digital interaction within the vendor. These evolving regulations underscore the need for businesses to be transparent, accountable, and proactive in safeguarding user data in an increasingly interconnected world.
Taking an Integrated Approach
Resilient mainframe security programs do not rely on a singular strategy — instead, business leaders should modernize their infrastructure and take a holistic approach. Integrating security best practices into the DevOps toolchain and mainframe ensures that security remains an unwavering, collective responsibility throughout software development life cycles. This integration promotes swift and efficient security updates, diminishing potential threats.
Rocket Software found that many organizations already take an integrated approach — 44% of organizations implement DevSecOps, 56% implement encryption of data, and 57% implement user authentication access controls. This is the most effective way to buffer against both internal and external controls and make sure any threats are identified quickly and efficiently. Upgrading security measures to be more integrated empowers organizations to keep their mainframe secure while opening the door for the level of growth and innovation necessary for modern business success. By taking a holistic approach, organizations can take proactive steps to protect the mainframe and its assets.
In this age of rapid technological change, mainframe systems remain a cornerstone for businesses. With digital transformation projects well underway and the introduction of DevOps tools in every enterprise, modernizing mainframe systems and security approaches will enable businesses to better adapt to new risks and data management needs. Organizations must consider solutions that leverage the security and reliability of the mainframe. A resilient defense mechanism for mainframes is not a singular strategy, but instead, an integrated approach.
Industry News
Elastic, the Search AI Company, announced the Elasticsearch Open Inference API now integrates with Anthropic, providing developers with seamless access to Anthropic’s Claude, including Claude 3.5 Sonnet, Claude 3 Haiku and Claude 3 Opus, directly from their Anthropic account.
Broadcom unveiled VMware Cloud Foundation (VCF) 9, the future of VCF that will accelerate customers’ transition from siloed IT architectures to a unified and integrated private cloud platform that lowers cost and risk.
Broadcom announced VMware Tanzu Platform 10, a cloud native application platform that accelerates software delivery, providing platform engineering teams enhanced governance and operational efficiency while reducing toil and complexity for development teams.
Red Hat announced the general availability of Red Hat OpenStack Services on OpenShift, the next major release of Red Hat OpenStack Platform.
Salesforce announced new innovations in Slack that make it easier for users to build automations, no matter their technical expertise.
GitLab announced the general availability of the GitLab Duo Enterprise add-on.
Tigera now delivers universal microsegmentation capabilities with Calico.
Tabnine announced a new platform partnership with Broadcom Inc., an integration with IBM, as well as continuing extensions of existing partnerships with Amazon Web Services (AWS), DigitalOcean, Google Cloud, and Oracle Cloud Infrastructure (OCI).
Wallarm released API Attack Surface Management (AASM), an agentless technology to help organizations identify, analyze, and secure their entire API attack surface.
LambdaTest launched KaneAI, an end-to-end software AI Test Agent.
Kubiya has closed its $12 million seed round with a $6 million extension of equity and debt financing and launched a paradigm-breaking new platform, AI Teammates, that enables true delegation of complex tasks to digital colleagues through organic, human-like conversations.
The Cloud Native Computing Foundation® (CNCF®), which builds sustainable ecosystems for cloud native software, announced the schedule for KubeCon + CloudNativeCon North America 2024, happening in Salt Lake City, Utah from November 12 – 15.
Diagrid announced the latest version of Dapr, a Cloud Native Computing Foundation incubating project maintained by Diagrid, Microsoft, Intel, Alibaba, and others, as well as an update to Conductor, a Software as a Service (SaaS) that helps manage, upgrade, and monitor Dapr on Kubernetes clusters.
Spectro Cloud announced two new formal recognitions of its strengthening position in the government technology space: the Government Software competency from AWS, and ‘Awardable’ status on the CDAO Tradewinds Solutions Marketplace for AI/ML solutions at the tactical edge.