GS|UK Security Working Group – Next Meeting - Thursday 25th June 2026

Kick-off welcome session.

(GS|UK)

Rui Feio

(GS|UK)

Beyond passwords, we must standardise enterprise security with Enhanced  Authentication options, such as the titular IBM Z MFA.

Mainframes sit at the core of global banking, healthcare, and corporate infrastructure, making them top targets for advanced cyber threats but many organisations still rely solely on traditional passwords, which is no longer enough to secure these critical environments.

This session explores why implementing Multi-Factor Authentication (MFA) is a vital step in modernizing your mainframe security posture and achieving a true Zero Trust architecture.

We will examine how IBM Z MFA goes beyond simple compliance checkmarks to actively prevent credential-based attacks and secure privileged access.

Whether you are a security administrator, system programmer, or IT executive, this session will give you insights about single points of failure and a goal defend your most valuable enterprise assets. 

(Vertali)

This session will show how to switch from UserID and password authentication, to use certificates instead.

We’ll look at SSH login and using SSH keys as a warm-up and then look at replacing HTTPS passwords with x509 certificates.

Finally, we’ll look at how to replace TSO logins with terminal emulators with x509 certificates.

The session is hands on with demos (that I’ll have videos for if the demo Gods decide to slay me as backup) and will be step by step to follow along.

At the end folks will have seen us go from three use of passwords (ssh login, z/OSMF login and 3270 TSO login) to end with all 3 working WITHOUT a password!!!!! 

(IBM)

Mainframes power many of the world’s most critical banking, insurance, government, and enterprise workloads. While they are known for their reliability and strong security controls, they are not isolated from today’s cyber threats.

This session explores how recent ransomware and other high-profile cyberattacks could impact mainframe environments, even when the mainframe itself is not the initial target. Through real-world examples, we will examine how attackers exploit third-party tools, backup infrastructure, privileged access, and connected enterprise systems, and how these attack paths can extend to the mainframe ecosystem.

Attendees will gain a practical understanding of modern mainframe security, common misconceptions about mainframe immunity, and key strategies for strengthening cyber resilience and recovery confidence in an increasingly connected world.

(BMC)

The global economy runs on IBM z/OS, yet the industry standard for threat detection – MITRE ATT&CK, has a critical blind spot: the Mainframe. While we meticulously map Tactics, Tools and Procedures (TTPs) for Windows, Linux and Cloud, the platform processing $8 trillion in daily card payments remains a ‘Security Black Hole.’ In this session, I will unveil a new TTP matrix specifically for z/OS bringing together the known attacks and adding my own research, and how it can be used. I’ll move beyond obscurity, mapping real-world mainframe attacks to actionable mitigations, and demonstrating why ignoring these TTPs is a direct threat to economic stability especially in light of the Nation Cyber Security Centres 2026 warning of Nation States pivoting to financial services as part of their attacks on National Critical Infrastructure.

Jonathan and Kev will present updates and the way forward for the project as we aim to improve security awareness and further the integration between mainframe payments systems, red-team engagements and traditional security operations centres (SOC).

(Neuro Training)

Jonathan Prince

(NVISO GmbH)

Db2 security exits (connection, sign on, and authorization) are critical components of the Db2 security. Do you fully understand what they do and how? Do you have customized versions? Do you want full control? In this session we will explain the purpose and internals of the security exits, we will navigate through them and will show how open-source tools such as VSCode can significantly help with their comprehension.

(Broadcom)

RACF environments often contain thousands of users, groups, permits, and naming conventions. Over time, complexity grows — and so does the risk of configuration drift, audit findings, and undocumented exceptions.
What if RACF compliance checks could be automated, repeatable, and version-controlled?
In this session, the creator of MFPandas (formerly known as pyRACF) demonstrates how to transform RACF data into structured datasets using Python and pandas, enabling automated compliance validation against:

• Internal naming standards
• Segregation-of-duties rules
• External audit requirements
• Security baselines and conventions

By treating RACF data as analysable dataframes, we can implement “Compliance as Code” principles on z/OS — bringing DevOps-style validation to mainframe security.
The session includes live demonstrations and practical implementation patterns that attendees can adapt directly within their own environments.

(zdevops)

Latest RACF Updates, focusing on the RACF support for the IBM zSecure Secret Manager.

(IBM)

End of meeting session.

(GS|UK)

Rui Feio

(GS|UK)