Firms simply cannot give up mainframes.
Whereas cloud infrastructure hogs the highlight, mainframe methods proceed to dominate main segments of the financial system, particularly people who require high-performance and high-reliability functions, such because the processing of monetary transactions — mainframe methods deal with an estimated 90% of bank card transactions, for instance. In line with a Deloitte examine, 71% of Fortune 500 firms proceed to depend on mainframes, and 90% of executives count on to increase their mainframe footprint.
Securing mainframes stays prime of thoughts, with 61% of mainframe and IT professionals rating safety as the highest downside they’re going through, in line with an annual survey of mainframe customers. Whereas mainframe {hardware} is usually up to date, the software program structure typically consists of an agglomeration of added options and elements which can be onerous to safe, says Jeff Emerson, built-in mainframe service lead at Accenture.
“Regardless of the screaming efficiency of many mainframe functions, they’re more and more brittle resulting from a long time of ‘simply add this’ code modifications that drive exponential will increase in software program complexity,” Emerson says. Inheriting software program architectures from two to a few a long time in the past, he provides, has additionally led designers “in the direction of extremely shared knowledge constructions on a single, monolithic platform — which has change into extremely troublesome to tear aside.”
The issues will solely worsen, as a result of removed from dying out, mainframe methods proceed to energy a lot of the infrastructure that underpins the knowledge financial system. This poses a problem to software program growth and safety due to mainframes’ monolithic nature and the rising shortage of mainframe technical experience.
Safety Is Prime Concern for Mainframe Customers
Beginning within the Fifties, the mainframe structure was synonymous with computing. Whereas many mainframe customers are in search of methods to maneuver some workloads to the cloud, the overwhelming majority of enterprise and IT executives (94%) have a constructive view of the way forward for mainframes. A sizeable share (62%) foresee their use of mainframes rising with new workloads, in line with the 2023 BMC Mainframe Survey report.
The market continues to develop. IBM Z Programs, Fujitsu’s GS sequence, and Unisys’ Libra servers are the preferred mainframe ecosystems. Z Programs alone noticed 21% year-over-year income progress in 2022, in line with IBM’s monetary statements.
Nevertheless, sustainable progress can solely occur if mainframe customers determine methods of constructing their infrastructure simpler to safe and extra agile, says Linda Betz, performing CISO and insurance coverage sector lead for the Monetary Companies Info Sharing and Evaluation Middle (FS-ISAC). As a result of mainframes are constructed to final, the software program portfolio linked to mainframe methods is commonly advanced and onerous to handle.
“There’s a side of ‘if it ain’t broke, do not repair it’ to the cloud migration debate,” she says. “Monetary establishments who use mainframes should weigh the price of upending their present mainframe system for one thing else, they usually could not see sufficient profit in doing so, or they might achieve this for sure capabilities and methods however not for others.”
The system has a plethora of safety controls — corresponding to consumer authentication and entry controls, decentralized safety administration, discretionary and obligatory entry controls, logging to the methods administration facility (SMF), useful resource management, and auditability and accountability — however the software program is tough to safe, says Accenture’s Emerson.
“The mainframe platform supplies safety, audit, and monitoring capabilities practically ‘out of the field’ offering nice assurances for the information held inside,” he says. “That is each a blessing and a curse, because the mainframe platform is extremely strong, however software program that has been developed over 4 and even 5 a long time is more and more advanced, but beneath ever-increasing demand for flexibility and agility to satisfy rising enterprise wants.”
The obscurity helps in some methods, as attackers typically have no idea the way to entry the methods, even when they may run the gauntlet of safety measures thrown as much as defend mainframes. Nevertheless, no firm ought to depend on a security-through-obscurity strategy, says Kevin Stoodley, chief expertise officer for IBM Z, the corporate’s mainframe division.
“That is the previous philosophy, truthfully, and anyone who’s counting on that, I believe, is on skinny ice,” Stoodley says. “With trendy strategies round protection in depth, corresponding to community segmentation, even when there are breaches, which there inevitably will likely be in a corporation, mainframes are most likely not the primary place they’ll get to.”
Mainframe, Cloud, or Hybrid
Many firms are transitioning workloads from their mainframe methods to cloud infrastructure. Within the subsequent 5 years, two-thirds of banks (67%) will transfer no less than half of their mainframe workloads to the cloud, up from 31%, in line with a 2022 Accenture report. The limitations of migration are important, nevertheless. Practically half of all monetary companies apprehensive about enterprise disruption and the complexity of coping with their vital functions throughout any try to maneuver away from mainframes.
Furthermore, whereas mainframe methods can run Linux and functions written in trendy languages, many utility are written in COBOL, which is extra vulnerable to SQL Injection assaults that may compromise the underlying knowledge, in line with Accenture’s Emerson.
“Cleansing up this code in place or placing applicable protections in place as it’s modernized is paramount to defending the world’s vital knowledge,” he says.
Whereas most firms are contemplating rearchitecting mainframe software program to extend developer agility and scale back prices, improved safety is one other profit. Transferring to a hybrid cloud might assist, says Cynthia Overby, director safety for buyer options engineering at Rocket Software program.
“Mainframes are such an intrinsic a part of a corporation, housing a lot vital knowledge, that the method to utterly rip and substitute would take an excessive amount of money and time,” she says. “For that reason, we’re seeing an increase in demand for hybrid cloud infrastructure, which gives customers the most effective of each worlds.”
AI Might Sub for Disappearing Mainframe Specialists
Modernizing mainframe infrastructure to safer architectures will likely be troublesome with out the appropriate individuals. Extremely specialised mainframe operators and engineers are a quickly disappearing demographic within the trendy office, with 90% of enterprise leaders discovering it reasonably or extraordinarily troublesome to seek out the appropriate individuals to keep up mainframes, in line with a Deloitte report.
“Particularly given the dearth of expert employees accessible, discovering individuals to keep up these methods — or worse, reply within the case of an outage — might change into very costly,” the report said.
As a result of the mainframe expertise stack will not be typically taught in colleges, specialists must be taught the structure and its vagaries on the job, and safety groups must learn to defend them on their very own. This downside is one which AI could possibly assist firms resolve by mapping mainframe code to extra trendy languages, FS-ISAC’s Betz says.
“With the continued cybersecurity expertise scarcity, establishments could not have the manpower and experience to transition to a distinct infrastructure,” she says. “Nevertheless, AI truly poses a chance for translating between mainframe languages and newer ones to assist youthful engineers in sustaining mainframes.”
