Abstract

This IDC Market Perspective discusses the need for analytics for the security operations center (SOC) in securing the mainframe.

Mainframes remain relevant for the way they can process a high number of transactions without conflict and without latencies. However, mainframe performance and mainframe security are inextricably tied. In securing the mainframe, the SOC will have telemetry and analytics needs similar to other components of the IT architecture. The integration and utility of the mainframe data and the ability to analyze the mainframe data in the SOC are key; simple ingestion of mainframe data does not create an outcome. Today, auditors seem to just validate whether data is there and the checkbox is checked, even if the data is not analyzed.

"Mainframe security seems esoteric, but the same key fundamentals that apply to enterprise networks still apply — visibility remains king, identity and access management matters, and a perimeter defense is fine but should contain elements of redundancy and monitoring beyond the perimeter," according to Christopher Kissel, research vice president, Security and Trust with IDC.

Coverage