Arcati Mainframe Yearbook 2007Arcati Mainframe Yearbook ... · emails hacked. The WannaCry global ransomware attack locked computers and delivered messages demanding $300 in Bitcoins

copy Arcati Limited 2018 1

Arcati Mainframe Yearbook 2007Arcati Mainframe Yearbook 2018

Mainframe strategy

The Arcati Mainframe Yearbook 2018

The independent annual guide for users of IBM mainframe systems

SPONSORED BY PUBLISHED BY

Arcati Limited19 Ashbourne WayThatchamBerks RG19 3SJUK

Phone +44 (0) 7717 858284Fax +44 (0) 1635 881717Web httpwwwarcaticomE-mail mainframearcaticom

copy Arcati Ltd 20182

Arcati Mainframe Yearbook 2018

Mainframe strategy

ContentsWelcome to the Arcati Mainframe Yearbook 2018 3Staying secure and compliant 5How to Ditch Waterfall for DevOps on the Mainframe 10Health Solutions Provider Accelerates Integration Sparks IT

Collaboration Using Server-Side JavaScript 16zOS Code Scanning Is Essential to System zreg Security 21DevOps for the mainframe 27lsquoReports of my death have been greatly exaggeratedrsquo 33

The 2018 Mainframe User Survey 36An analysis of the profile plans and priorities of mainframe users

Vendor Directory 52Vendors consultants and service providers in the zOS environment

A guide to sources of information for IBM mainframers 136Information resources publications social media and user groups for the zOS

environment

Glossary of Terminology 142Definitions of some mainframe-related terms

Mainframe evolution 173Mainframe hardware timeline 1952-2017 mainframe operating system development

Action Software 55 56Azamour Solutions 61 141Compuware Corporation 10 72Data Kinetics 51 76 EPV Technologies 83Fischer International Systems Corporation 85

Hostbridge Technology 16 92Key Resources Inc 21 99Software AG 27 120Software Diversified Services 4 121UBS Hainer 129 130

SPONSORS



Mainframe strategy

We are very grateful ndash as always ndash to all those who have contributed this year by writing articles taking part in our annual user survey or updating their company profiles In particular I must thank the sponsors and advertisers without whose support this Yearbook would not be possible

2017 seems to be picking up where 2016 left off and there seems to be a spring in the step of the mainframe world Vendors who never claim business is a bit flat anyway seem to have bigger smiles when they tell me that business has been good And at user group meetings sites seem to be trialling newer software and techniques whereas before there had been a certain reluctance to try anything new

On the downside of course the IT world has been reeling from ransomware and other cyber attacks In June 2017 Wannacry locked computers and messages appeared demanding $300 in Bitcoins to regain access We also heard in 2017 that Members of the British Parliament had had their e-mails hacked Deloitte was hit by a cyberattack which accessed e-mails usernames passwords health information and details from Deloittersquos clients Equifax had 143 million customer account details including names social security numbers driversrsquo licences and credit card numbers of around 200000 people hacked And the list goes on

In July IBM announced the new Z14 processor and we all started saying ldquopervasive encryptionrdquo The new mainframe had more total system capacity compared to the z13 faster uniprocessor performance than the z13 170 cores to configure (141 on z13) up to 32TB of available Redundant Array of Independent Memory (RAIM) real memory per server 2x more on-chip cache per core compared to z13 hardware accelerated encryption on every core with the Central Processor Assist for Cryptographic Function (CPACF) feature new instructions in Single Instruction Multiple Data (SIMD) which are designed to give a performance boost for traditional workloads using COBOL and new applications like analytics and much much more

But what is pervasive encryption It doesnrsquot have an official definition but generally means the ability to encrypt everything everywhere without interfering with the user experience The new IBM Z14 mainframe can do real-time encryption of all mobile transactions up to 12 billion encrypted transactions per day The new mainframe has an encryption engine which gives a 7 times increase in cryptographic performance over the z13 with a 4 times increase in silicon dedicated to cryptographic algorithms It protects encryption keys with so-called tamper responding hardware which invalidates keys at any sign of meddling and IBM says they can be safely restored later This capability can be extended outside the Z14 to storage systems and servers in the cloud A Secure Service Container is claimed to protect against insider threats from contractors and privileged users providing automatic data and code encryption in-flight and at-rest and tamper-


Publisher Mark LillycropEditorial Director Trevor EddollsContributors SDS Compuware Hostbridge Ray Overby Zvonimir Ivanetic Mark Wilson

copy 2018 Arcati Limited

All company and product names mentioned in this publication remain the property of their respective owners

This Yearbook is the copyright of Arcati Limited and may not be reproduced or distributed in whole or in part without the permission of the owner A licence for internal e-mail or intranet distribution may be obtained from the publisher Please contact Arcati for details

Welcome to the Arcati Mainframe Yearbook 2018



Mainframe strategy

resistance during installation and runtime The Z14 can ldquopervasively encrypt data associated with any application cloud service or database all the timerdquo

The new processor lifted IBMrsquos spirits as did its third quarter figures in October which registered a strong recovery following a weak first half of the year There was a 04 percent decline in revenue to $1915bn and IBMrsquos pro forma earnings per share rose 11 per cent to $330 In the third quarter revenue from the strategic initiatives (cloud analytics mobile social and security) rose 11 percent Cloud now represents 20 percent of IBMrsquos total revenue Revenue from the mainframe business jumped 60 percent in the third quarter The Z14 began shipping in mid-September

IBM has been much less acquisitive in 2017 with only three companies Firstly in February it acquired Agile 3 Solutions for its Information security business In May it acquired German-owned XCC (a division of TIMETOACT) for its collaboration software And in October it acquired Australian Vivant Digital for its innovation consultancy business

In terms of big software announcements during the year IBM announced CICS Transaction Server for zOS Version 54 And the company also announced IMS 15

2017 seems to have been the year when IBM changed case Things that used to be capitalized no longer are and things that werenrsquot capitalized are now People still talk about System z which changed its name to z Systems but is now IBM Z (yes thatrsquos a capital) Or what about DB2 or as we should now call it Db2 The lsquobrsquo is now lowercase ndash putting the emphasis on the data and not on the base

2017 also saw hackathons becoming more mainstream and a way for large organizations to offer better service to their customers Whereas much mainframe software is still developed using waterfall methodologies where two years could elapse between the identification of requirements and an application being delivered ndash and by then the circumstances that led to the need for the software could be very different For a hackathon to be successful the existing technology needs to be commoditized and abstracted APIs are the driver And if the product thatrsquos created by the end of the hackathon doesnrsquot work then it can be treated as a learning experience for the people working on that project For example Citibank runs Citi mobile challenges These get people to look at different ways people can consume their banking services ndash itrsquos a way to get the next big idea from people outside their company And Ciitbank can then monetize the ideas Blockchain is great for hackathons because it is digital and secure

As well as pervasive encryption other words or acronyms people in 2017 were starting to use in connection with mainframes include Swagger Bluemix GitHub Jenkins blockchain GDPR SIEM Enterprise Content Management (ECM) Destruction Of Service (DeOS) attacks Docker Digital Transformation (DX) edge computing

Itrsquos interesting to see what Gartner highlights as the three most dominant trends in 2017 They are Artificial Intelligence (AI) Everywhere Transparently Immersive Experiences and Digital Platforms In addition Gartner believes that the key platform-enabling technologies to look out for are 5G Digital Twin Edge Computing Blockchain IoT Platforms Neuromorphic Hardware Quantum Computing Serverless PaaS and Software-Defined Security Itrsquos interesting to see how many of those we see on mainframes already

So it looks like the mainframe industry is getting its old buzz back And with that in mind I can confidently predict that 2018 will be an interesting year and that the mainframe will continue to offer outstanding performance and reliability and be at the heart of the worldrsquos business-critical applications



Mainframe strategy

Staying secure and compliantSDS takes a look at the security challenges that mainframe sites are facing and suggests ways for zOS users to stay safe

THE BACKGROUNDThe quality of data stored on a mainframe can be the difference between those companies that successfully continue in business and those that donrsquot That data might include information about customers their purchasing preferences how much they like to spend where they live and what loans they have taken out There may also be information about your suppliers where theyrsquore based and how much they charge you for whatever theyrsquore supplying Each piece of that data could be useful to your competitors and to criminals Thatrsquos why itrsquos so important to keep data secure And you must be able to prove that your data is secure because itrsquos how you show that yoursquore compliant with all the regulations that apply to your industry

Is hacking that much of a problem Just in 2017 members of the British Parliament had their emails hacked The WannaCry global ransomware attack locked computers and delivered messages demanding $300 in Bitcoins to regain access US pharmaceutical giant Merck said that its network had been ldquocompromisedrdquo Norwayrsquos national security agency said ransomware was affecting an unnamed ldquointernational companyrdquo in the country And Rosneft a Russian government-owned oil firm said it was also targeted by a ldquomassive hacker attackrdquo on its servers

Global consultancy firm Deloitte was hit by a cyberattack which accessed emails user names passwords health information and details from Deloittersquos clients Consumer credit score company Equifax had hackers access up to 143 million customer account details including names social security numbers driverrsquos licenses and credit

card numbers of around 200000 people CeX a second-hand games DVDs and hardware retailer had around two million customersrsquo details stolen including names addresses email addresses phone numbers and encrypted credit card information from as far back as 2009 And the phone numbers names and PIN codes of six million Verizon customers were left online for around nine days

Gone are the days when hackers were high-spirited teenagers who were just pushing the limits of their knowledge to see how far they could reach inside lsquosecurersquo systems Hacking is now big business

Lists of names credit cards details and passwords are for sale on the dark web to any criminal that wants to make use of them Therersquos evidence of state-sponsored cyber-terrorism where governments are paying the finest cyber brains to find their way into the computers of other governments and international companies

And if that werenrsquot troubling enough therersquos still the threat from your own staff in what can be best categorized as a mixture of ignorance and malice Insider threats can be more financially damaging and more difficult to defend against In the 2016 Cyber Security Intelligence Index IBM found that 60 of all attacks were carried out by insiders with three quarters involving malicious intent and one quarter involving inadvertent actors

Back in 2015 Proctor amp Gamble filed suit against four former Gillette Company employees accusing them of wrongfully using and disclosing confidential information and trade secrets to a direct competitor Similarly an employee of Merit Health Northwest Mississippi was accused of removing patient information from the facility over a two-year period without authorization This included patient names addresses dates of birth Social Security numbers health plan information and clinical information Those are examples of malicious employees



Mainframe strategy

The other problem is human error which can be a major factor in breaches where trusted but unwitting insiders are to blame Sometimes people trying to help will reveal passwords Other people may unwittingly have their identities stolen by malware or phishing attacks Too often security systems are focused on the external threat and assume that all company employees are trustworthy and savvy enough not to be fooled into revealing security-related information

Itrsquos bad enough for a company to lose client data but it could also lose confidential business-critical plans for new products that competitors could obtain And a company could find itself in court for being in contravention of regulations such as FISMA GLBA HIPAA PCI SOX and other standards

On the plus side mainframes enjoy an organizational structure and naming conventions that are different from Windows and Linux machines and are less familiar to low-level hackers This lsquosecurity by obscurityrsquo doesnrsquot make it completely safe These days mainframes are linking to mobile devices and the Internet of Things (IoT) mdash and that can provide a way for hackers to gain access to the mainframe

At first web services allowed CICS transactions using SOAP protocols to be exposed to off-mainframe users These days RESTful Web applications can be developed for example for Liberty in CICS This brings the mainframe squarely into the world of computing that is familiar to hackers and makes accessing information stored in IMS databases DB2 or flat files much easier With CICS TS 54 which supports applications written to the Java EE 7 full platform specification users can run JDBC JCA and JCICS in the Liberty JVM server And Java is very familiar to hackers

THE PROBLEMzOS security relies on the use of an External Security Manager (ESM) such as IBM RACF

(Resource Access Control Facility) or Computer Associates ACF2 (Access Control Facility 2) and TSS (Top Secret Security) Basically RACF ACF2 and TSS maintain mainframe security by either allowing or preventing access by for example a user or a program to a resource such as a dataset What these products donrsquot do is provide any form of real-time auditing or monitoring That is usually carried out by running a batch job overnight or if required a special job investigating a specific event after the event

Many organizations and federal agencies make use of Security Information and Event Monitoring (SIEM) products like HPE ArcSight and IBM QRadar and security log collection software such as Splunk A SIEM product works in near real time and can monitor security logs and events by receiving security logs However these facilities are not generally available for zOS Usually a batch job runs at regular intervals collecting the data which is then sent by FTP across the network to the security log collector This increases the time before a security breach on the mainframe is analyzed

Other sites may have SIEM products installed but donrsquot use them for their zOS security logs Instead they rely on their zOS security administrator to run the necessary batch jobs to identify any security-related events or breaches This is clearly a huge security issue because the zOS security administrator is best placed to carry out data theft and is then able to cover their tracks This is a lsquofox guarding the hen housersquo scenario Not only does it violate good security practices but also federal mandates for separation of dutyClearly these examples not only violate any number of regulations but are also examples of bad practice for continuously monitoring zOS security

Through stealth or through user error itrsquos possible for hackers to get inside the mainframe and acquire appropriate privilege settings Once they have administrator-level capabilities they can then access all sorts of confidential information They



Mainframe strategy

could access IMS databases and DB2 databases and send information off site Because they have acquired admin-level privileges therersquos no way to identify that a data violation has happened until much later when a batch report is run Itrsquos quite likely that this violation would not be picked up Whatrsquos needed is the ability to monitor the mainframe from outside of the mainframe and to monitor events even where the user has the appropriate authority

Many sites feel that the amount of security they need is too costly for them to install at the present time and they hope that everything will carry on the way it always has What they fail to take into account is that the cost of a security breach is even higher Like the companies mentioned earlier they will not only find that losing data has a cost to their company but also the loss of customer and partner confidence in them has an additional cost The likelihood of a fine for contravening the regulations that apply to their business makes the availability of comprehensive and cost-effective mainframe security software even more important

THE SOLUTIONWhatrsquos needed is a product that meets all the current needs of an organization in terms of securing the confidential records for their own businesses as well as of the information about their clients In addition such a product must have all the qualities that are required to counter todayrsquos security threats It must work efficiently with existing zOS security and make use of SMF (System Management Facility) and console messages The product must be capable of tracking audited events and insider threats delivering mainframe alerts in real time and easily integrating with existing security monitors

How can you choose from the zOS security monitoring products available What criteria should you use when evaluating such a product for your organization You want it tobull Offer scalabilitybull Be easy to use

bull Provide real-time 247 access to resources and event monitoring

bull Eliminate unwanted events by employing customer-defined filters

bull Promote true audit independence and analysis with decimal data presented in a clear-text format so it may be interpreted by non-technical people within the IT organization

bull Facilitate security spot checks at any time outside of the standard quarterly security audit

bull Be easy to configure and installbull Have a small footprint in terms of mainframe

processing with the minimum performance impact on mainframe systems

Software Diversified Services (SDS) markets VitalSigns SIEM Agenttrade for zOS (VSA) which forwards zOS system console and SMF messages in the proper format as well as those from RACF ACF2 Top Secret DB2 CICS and FTP to a central SIEM system such as HPE ArcSight IBM QRadar Splunk LogRhythm McAfee Enterprise Security Manager Dell RSA Security Analytics Dell SecureWorks and others It will gather intelligence from all zOS systems and LPARs in the network Mainframe data is then consolidated with security intelligence from other systems in the enterprise such as UNIX Windows and Cisco for total visibility into the zOS environment as well as distributed and open-systems environments Enterprise-wide monitoring of security events is critical not only for tracking malicious activity but also to meet stringent compliance requirements Once the data is in the SIEM it can then be indexed searched analyzed and visualized across the spectrum That means organizations no longer need multiple security teams to guard their enterprisersquos multiple platforms

Administrators can define specific items of interest for extra levels of monitoring for example files that contain credit information or health care details VSA uses both signature and anomaly-based attack detection It provides real-time alerts that can be managed filtered routed and searched using the SIEMrsquos GUI interface And it comes with



Mainframe strategy



Mainframe strategy

APIs that allow TSO CICS and batch events to be defined and filtered

This brings your zOS mainframes into the center of your enterprise security infrastructure without hassle and in real time With VSA your organizationrsquos security team has a central end-to-end view of all the events they need to capture and all the security threats they need to recognizeVitalSigns SIEM Agent canbull Detect malicious activity including an insiderrsquos

actions that have been authorized by existing security settings

bull Protect against insider threats unlike any other commercial mainframe software available

bull Identify internal patterns of abuse bull Meet government security requirements

and mandates for continuous monitoring of computer systems separation of duties and file integrity monitoring

bull Work in tandem with all other client server and firewall security monitoring products already deployed to provide complete real-time enterprise-wide threat management

bull Save hundreds of hours searching through batch reports when investigating a security breach

CONCLUSIONVitalSigns SIEM Agent for zOS gathers detailed information about security events on the mainframe The SIEM interprets the data normalizes it in standard TCPIP syslog format then delivers it in real time to the people and systems responsible for enterprise security

Proactive companies that have a track record of monitoring security logs from outside the box are best placed to be compliant with new regulations and have a solid framework to manage zOS data and its associated risks VitalSigns SIEM Agent from SDS can help you stay compliant with regulations recognize security threats and track and uncover policy violations in real time

REFERENCESAn Introduction to zOS Real-time Infrastructure and Security Practices by Stephen D Rubin William Buriak Jerry Harding

About SDSSDS provides enterprise software for multiple platforms with a 30-year history of delivering award-winning support and customer-centric IT infrastructure solutions wwwsdsusacom

A White Paper entitled The Business Value of the Connected Mainframe for Digital Transformation was sponsored by IBM and CA Technologies and concluded that mainframe computing is at a crossroads ndash it will either continue supporting enterprise operations or it can play an increasingly important role in enterprise digital transformations (DX) The modernized ldquoconnected mainframerdquo integrates into an organizationrsquos ecosystem ndash internally and externally ndash delivering innovations that drive revenue growth and improve operational efficiency ndash thatrsquos what the White Paper says The White Paper explains that ldquoModernizing on the mainframerdquo is about ldquocreating a platform that is integration-ready within the data center and with the outside worldrdquo

To be successful the mainframe must be connected to the rest of the data centre infrastructure and IT processes and the outside world Therersquos a need to expose services and capabilities on the mainframe to mobile apps Many sites were making use of internal and external APIs on the mainframe Other popular things to do were to use DevOps and Agile development on the mainframe And many sites were starting to utilize hybrid cloud strategies to move forward successfully into the future



Mainframe strategy

How to Ditch Waterfall for DevOps on the MainframeThe Story of Compuwarersquos Waterfall-to-Agile Transformation People in business talk a lot about transformation But most companies have only a vague understanding of what a successful transformation is let alone how to accomplish one before nimble digital disruptors swoop in to steal customers

Defining what to do and how to do it is especially hard for companies that rely heavily on the mainframemdasha historically siloed platform encumbered by slow process and outdated esoteric tools Regardless as the system of record for your customer-facing web and mobile apps itrsquos imperative to find a waterfall-to-Agile transformation path that brings your mainframe out of the dark corners of the data center and into your broader AgileDevOps environment

We accomplished this at Compuware and today wersquore a modern AgileDevOps software development organization delivering new

products and feature functionality to customers every 90 days Here is our story Use it as guidance to plan execute and accomplish your own waterfall-to-Agile transformation

Recognizing the Problem 40 Years of Waterfall DevelopmentIn 2014 we had an opportunity to transform Compuware Revitalized by new owners and management the company set out to solve a major problem it was a stagnant organization plagued with 40 years of waterfall development Maintaining the status quo of a 12-to-18-month software development and delivery cadence prevented us from providing customers with innovative software to meet their shifting needs We recognized three realities that would help us change

1 Fast Beats Slow In the modern digital economy big doesnrsquot

beat small anymore fast beats slow At the time our business methodology prevented us from outpacing competition and becoming a mainframe leader We needed to accelerate

2 Ideation and Innovation Are Key to SuccessCompetitive relevant companies create new



Mainframe strategy

things that delight customers They do this by establishing cultures that support innovation We needed to shift our culture to one that encouraged Compuware employees to stay engaged and bring forward new ideas that would dramatically alter what we off er customers

3 Measure Maintain and Improve Quality As a company accelerates and begins trying

new things generating new ideas innovating and transforming into a creator maintaining measuring and improving quality must become paramountmdashthis was especially true for Compuware as a mainframe software vendor to major corporations around the world

Defining the Desired State and How to Get ThereOnce we recognized our problem we needed to define our desired state and determine how to get there To become more competitive a thought leader and an innovative mainframe company we set a goal of delivering new products and feature functionality to our customers every 90 days setting a new industry standard We determined several things that would help us get there

AgilityWe needed to perform agile frequent rightsized code changes to fulfill business needs Not only through Agile Development but also by advancing business agility throughout the entire company

ConfidenceWe needed to have confidence that the new products and enhancements we delivered would meet the needs of our customers Part of attaining that confidence would come from improving quality through automation and agile testing practices but also through substantial collaboration with and regular feedback from customers

EfficiencyWe needed to be efficient with our t ime and maximize skills by recognizing cross-organizationally who could help deliver what in the best way Improving overall efficiency would help us meet the demands of customers more rapidly

Ease of UseWe needed intuitive uncomplicated modern tools that made information understandable and accessible in one place so our faster more efficient processes could flow continuously with ease This would improve overall developer productivity and enable less-experienced developers to efficiently and effectively make updates and enhancements to Compuware products IntegrationsWe needed to forge integrations with other tools to create and thrive in a modern cross-platform DevOps environment While our development focus is solely on mainframe software we recognized the importance of integrating with non-mainframe systems to help customers support hybrid applications that interact with both systems of engagement and systems of record

See Figure 1



Mainframe strategy

Using the Right Tools to Make It HappenUltimately integrating with and using the ldquorightrdquo AgileDevOps tools made our transformation possible When our software toolchain became easy to use we gained the confidence to implement an absolute DevOps culture across our development organization Topaz is the foundation of our mainframe development and testing toolset and integrations with both mainframe and non-mainframe partners have enabled the sharing of results and use of common tools across systems This is what forms our DevOps toolchainmdashand the mainframe is an integral part of that See Figure 2 Here are the Compuware mainframe DevOps tools as well as a few vital product integrations we leverage to move code through the software development lifecycle

Cultivating IdeasCompuware uses Atlassian Confluence and Jira to generate organize and collaborate on ideas using Agile Development methodologies like Scrum or Kanban This enables us to deliver what is needed and maintain what wersquore currently providing to existing customers

Development ProcessWhen an idea enters Jira we enter the development process which entails a standard code creation and updating phase These are the tools we use

bull Code Editing and Application Understanding All development is accomplished within

Compuware Topaz Workbench our Eclipse-based IDE and modern development interface that enables developers to stay in one environment We also use Compuware Topaz for Program Analysis which improves

Figure 1 Integrations



Mainframe strategy

program understanding by generating visual representations of applications

bull Validating and Debugging Code While moving through the software development

lifecycle Compuware uses SonarSource SonarLintrsquos integration with Topaz Workbench during continuous testing to ensure wersquore following coding standards and maintaining code quality We use Compuware Xpediter for debugging within Topaz

bull Editing and Managing Data We use Compuware File-AIDrsquos integration

with Topaz to create test data and obfuscate production data allowing us to have a solid set of test data to work with in developing and delivering our products and software

Version ControlCompuware ISPW is used for our mainframe source code management (SCM) By using ISPW we have the advantage of a modern mainframe SCM that is built for DevOps practices and can integrate with our other DevOps tools ISPW allows us to easily manage the concurrent development for multiple releases and provides powerful and flexible mainframe resident source change management compilationbuild processes and deployment across multiple LPARs

Continuous Integration and Code QualityWe use Jenkins for Continuous Integration including kicking off automated testing through integrations with ISPW as well as orchestrating other automations and integrations across the enterprise Code Coverage capabilities within

Figure 2 Using the right tools



Mainframe strategy



Mainframe strategy

Xpediter enable us to capture code execution statistics for quick assessments of test-related risk and documentation of testing

Test AutomationTest automation is key to maintaining code quality and delivering new updates with confidence We use Compuware Topaz for Total Test to automatically create and execute unit tests Compuware Hiperstation for automated functional tests and Compuware Strobe to ensure application performance isnrsquot negatively impacted All of these products integrate through Topaz We also use Zephyr a Jira plugin that allows us to post test results to Jira automatically update Jiras and track how well automated test suites are running DeployOnce testing is complete and quality is improved we use Compuware ISPW Deploy to deploy mainframe software Its REST APIs allow integrations with distributed tools enabling the deployment of mainframe and non-mainframe software together

ProductionOnce the application reaches production we monitor the application using Strobe for performance and Compuware Abend-AID to detect faults and errors that occur We use Compuware Application Audit for real-time auditing to ensure the security and integrity of the system Using integrations with Jira Abend-AID and Strobe issues can be opened within Jira when an issue is found in production Following Agile processes the Jira is opened prioritized on a backlog and assigned to the appropriate team to move forward

The Desired StateAfter implementing Agile Development and our DevOps toolchain over the last few years our speed innovation and quality have improved Through automating deployment wersquove been able to deploy software much more rapidly to carry out Continuous Integration and Continuous Delivery This hasnrsquot been measured by lines of code

delivered or written but by the actual deliverables that go to market Customer-reported product defects have decreased year over year As we increased test automation and fully integrated it into our SCM and development process we increased software quality

Going through our transformation we also discovered there are 10 fundamentals to achieving Agile Development on the mainframe We created a flexible step-by-step process available now as an eBook ldquo10 Steps to True Mainframe Agilityrdquo

Through these steps and the process discussed in this paper Compuware has ldquomainstreamed the mainframerdquo and enabled DevOps across our entire enterprise Use our story as your guide and remember that itrsquos possible for your mainframe team to accomplish a waterfall-to-Agile transformation and gain the agility confidence and inspiration necessary to develop and deliver innovative products that meet your customersrsquo rapidly changing needs

About CompuwareCompuware empowers the worldrsquos largest companies to excel in the digital economy by fully leveraging their high-value mainframe investments We do this by delivering highly innovative solutions that uniquely enable IT professionals with mainstream skills to manage mainframe applications data and platform operationsLearn more at Compuwarecom



Mainframe strategy

Health Solutions Provider Accelerates Integration Sparks IT Collaboration Using Server-Side JavaScript Mainframe-Based HB JavaScript Speeds APIServices Creation

Executive SummaryA leading health care and pharmacy solutions provider uses HBjs ndash the HostBridgereg JavaScript Engine ndash to rapidly integrate its core business systems with any other systems anywhere As a result the company provides modern solutions to employees and customers streamlines technology-driven business processes and innovates to better compete in its rapidly evolving industry HBjs specifically enables the company to develop and deploy RESTful APIs web services and microservices to modernize and integrate critical IBMreg z Systemsreg applications data and business logic

Objectivesbull Improve operations and outpace the

competition by integrating employee- partner- and customer-facing systems

bull Maintain proven CICSreg applications and DB2reg databases as operational systems of record

bull Deploy web services as the best means to modernize and extend the value of mainframe assets

bull Accelerate and simplify web services modernizat ion and integrat ion by transitioning to a RESTful services approach

Solutionbull HBjs ndash the HostBridge JavaScript Engine

the only server-side JavaScript solution for the IBM mainframe

Outcomesbull Create and deploy reusable APIs web

services and microservices faster and more easily than ever before

bull Address tactical objectives with reusable APIs and services while building strategically toward a RESTful enterprise architecture

bull Provide integration solutions that improve efficiency productivity and economy ndash and work for business

IntroductionA leading provider of healthcare and pharmacy solut ions ndash including pharmacy benef i t administration and prescription drug claims processing ndash continues to grow steadily in its fast-paced industry Keys to its mission are maximizing clinical outcomes for patients while managing operating expenses which it achieves in part by gathering and sharing information with greater speed and agility

The solutions provider is a mature mainframe shop running its most critical business processes on an IBM z13reg mainframe with CICS TS V51 applications DB2 databases zIIP and zAAP specialty engines and other mainframe tools Representing decades of investment these deliver exceptional processing power and reliability

Like every organization that uses information to drive business the company must continually integrate information systems whether it has used them for decades or they are just now emerging Some years ago the company turned from tightly coupled system-to-system integration to more flexible loosely coupled SOAP-based web services The SOAP services were a dramatic improvement but development cycles



Mainframe strategy

remained slow and a widening skills gap between mainframe and web developers threatened to slow development further

RESTful APIs and Services with HBjs ndash the HostBridge JavaScript EngineIn 2014 to address these concerns the company began adopting a faster easier more efficient integration methodology transitioning most of its services projects from the heavy SOAP methodology to a lighter more agile RESTful approach

To power this new approach it chose HBjs the HostBridge JavaScript Engine HBjs is the only server-side JavaScript for the mainframe and all HBjs processes and services are eligible to run on the lower-cost System z Integrated Information Processor (zIIP) HBjs suited the providerrsquos environment in other ways as well Like the mainframe and many other enterprise platforms HostBridge uses Eclipse for its development environment and CA Endevorreg for deployment processes

Along with all related HostBridge components HBjs is mainframe-based integration software Running under CICS it delivers exceptional performance and reliability HBjs is a JavaScript development and runtime engine for web servicesAPI integration the HostBridge base product auto-generates XML from CICS applications providing exact replicas of CICS screens within the HostBridge Eclipse IDE for easier more intuitive services development

The solutions provider chose HBjs specifically for the flexibility of its RESTful object-oriented approach With HBjs customers can easily create a service from any application function or CICS screen These can readily be aggregated into higher-level services or into effectively new applications HBjs also provides a unique and powerful way to orchestrate and automate complex CICS micro flows as single web services And HBjs services are language-agnostic

callable from COBOL Java C Python PHP or any other programming language

Implementation ExamplesTo date the company has completed a range of HBjs APIs services and microservices improving integration with partner systems developing streamlined internal tools for employees and extending mainframe business logic to distributed platforms to achieve new business objectives Two brief examples are outlined here

RESTful Integration of a Third-Party Tool with DB2 DatabasesLike most providers across the health care solutions industry the company uses a third-party formulary management tool to manage drugs covered under benefit plans Entering data into the third-party tool and in-house databases required separate data entry processes To eliminate duplication of effort and improve productivity and efficiency the company developed a simple integration of the third-party tool with its claims processing databases

Using HBjs developers wrote and embedded a RESTful API in the formulary toolrsquos user interface Now whenever an employee or claims agent enters data into the tool the data is automatically sent via JSON (JavaScript Object Notation) to HostBridge HBjs services then interact with DB2 entering the data into every database relevant to claims processing This integration was designed developed tested and deployed in three weeks

Streamlining Membership Card ReissuesBefore HBjs whenever the providerrsquos members needed membership cards reissued employees started a lengthy labor-intensive process that was prone to errors Call center personnel took requests over the phone and then created an Excel spreadsheet listing requests alongside member information The spreadsheet was sent to another team which ran an ad-hoc batch process to update a single database parameter with a value indicating the need to reissue cards Nightly



Mainframe strategy

the process would review all records and create cards for those whose records now included the indicator

Developers created a simple HTML front end and used HBjs to develop services that enable employees to complete the process in a single step The web page calls an HBjs service which then updates the memberrsquos database record and initiates the card creation process

Outcomes and BenefitsWith HBjs the solutions provider now develops APIs and web services ndash and completes integration projects ndash far faster and more easily than with any other method including Java-based SOAP development The providerrsquos services strategy has also evolved as development cycles have grown shorter deploymentmigration simpler and time to market faster

Development teams now focus increasingly on microservices ndash simple discrete services based on self-contained functions that can be reused and aggregated with other services running on the mainframe or any of its other enterprise platforms

Interoperability and Process ImprovementThe single greatest benefit of RESTful services integration using HBjs is that the solutions provider is achieving its IT and business objectives On the technology side the provider more readily integrates its mainframe assets with other enterprise systems and with web and mobile applications ndash even as it builds a flexible functional services architecture On the business side services-based integration implementations deliver improved process efficiency greater productivity lower operating costs and new opportunities for business growth

With HBjs the provider does more with and gains new value from its mainframe adopts disruptive technologies as they emerge and meets the changing expectations of employees and customers

AgilityLightweight reusable HBjs services and microservices make the provider more agile from both the technology and business perspectives At the most basic level a simple web service might ldquoserverdquo several backend systems For example a mailing address web service based on a DB2 database can instantly deliver address change information to any other application or database running anywhere ndash in-house at partner sites or in the cloud

At the highest levels the RESTful approach effectively enables the creation of entirely new business applications by decoupling services from both source and destination applications Services from any number of applications and platforms can be aggregated and repurposed to serve the most complex and fastest-changing business functions

Continuous Delivery A benefit related to the agility of RESTful services is continuous delivery ndash changes to any given backend application have almost zero impact on any higher-order business services Though aggregated services might be comprised of dozens or hundreds of microservices changes to backend systems are likely to affect only a few microservices and only those few services require updates The overall services-based business application and the vast majority of microservices remain unchanged As such business applications run without interruption

Collaboration Across IT TeamsThanks to HBjs and its JavaScript-based programming the solutions provider realized another unexpected benefit Walls that had existed between development teams broke down and cross-team collaboration improved Historically mainframe and web teams focused on different tasks After years of disconnection the groups functioned as if they were in discrete siloes Bridging the gap was a challenge



Mainframe strategy

Build a bridge from z to anywhere

HBjs the JavaScript engine delivers powerful flexible Web services modernization for Z Systemstrade applications and data

Orchestrate complex transactions programs and data into composite services Create dynamic new apps that tap the mainframersquos power and reliability Modernize on technology that drives mobile and cloud innovation

HBjs ndash easy to learn fast to deploy universally interoperable

Faster Simpler Web Services for CICS amp IBM Z SystemstradeHBjs ndash The HostBridge Java Script Engine

Investigate HostBridgecom | Free Pilot Inquiry +14055332900

See just how easy it is try HBjs in your environment

Contact us to set up a trial



Mainframe strategy

HostBridge JavaScript changed this dynamic Web teams already knew JavaScript but now they could readily observe how HBjs interacted with CICS applications and other z Systems assets leading to a better understanding of and appreciation for the mainframe COBOL programmers knew what the mainframe was doing so they quickly grasped how JavaScript could extend mainframe functionality Soon they were learning JavaScript finding it easy to understand and use and enjoying the opportunity to gain a new skill and join the large and growing JavaScript community

The FutureThe solutions provider continues to expand its use of HBjs to make improvements where it matters most ndash in day-to-day operations employee productivity customer service and the bottom line And as APIs services and microservices have come online and proven their value the company has accelerated its implementations

A clear sign of the success of the RESTful approach with HBjs is the rapid growth of web services used by the company From 2014 to

2016 the number of web services processed per year increased by more than 90 percent and now exceeds 1 billion

As it repeatedly realizes the core benefits of HBjs ndash ease of use renewed collaboration services agility faster time-to-market and broader more flexible integration ndash the company will continue shifting more of its integration workload to HostBridge and the HostBridge JavaScript Engine

Footnote1 Alternatively HostBridge can run inside zOS but outside of CICS In this configuration all HostBridge processes and services are eligible to run on the zIIP For more information see ldquozIIP-Enabling CICS Integration Workloads HostBridge for zIIPrdquo at httphostbridgecomindexphplibraryzIIP-enabling-CICS-integration-workloads

About HostbridgeF i n d o u t m o r e a b o u t H o s t b r i d g e a t httpwwwhostbridgecom

IBM has announced that it will deploy Docker Enterprise Edition across all its Linux-based systems This will enable IBM to deliver on its goal of moving the app to the data rather than the data to the app So what is Docker Docker is a software container platform Everything you need to make the software work is packaged into this container It includes libraries and settings to run on any platform This way you get an efficient lightweight self-contained system plus the assurance that the software will always run the same no matter where itrsquos deployed Container architecture introduces a change to how the code behaves with hardware in effect it abstracts the application from the infrastructure

Developers can use Docker to collaborate on the development of software while potentially working on completely different hardware According to the Docker Web site operators use Docker to run and manage apps side-by-side in isolated containers to get better compute density Enterprises use Docker to build agile software delivery pipelines to ship new features faster more securely and with confidence for both Linux and Windows Server apps

Docker runs on Ubuntu Debian Red Hat Enterprise Linux CentOS Fedora Oracle Linux SUSE Linux Enterprise Server Microsoft Windows Server 2016 Microsoft Windows 10 macOS Microsoft Azure and Amazon Web Services



Mainframe strategy

zOS Code Scanning Is Essential to System zreg SecuritySecurity analysts often state that in order to effectively safeguard the vast data volumes stored on a mainframe an organization must establish configuration-based security controls and then continuously monitor these controls to determine effectiveness and compliance to standards Establishing a baseline of the security configuration and then automatically monitoring and alerting on that status for ldquodriftingrdquo is considered a best practice in order to minimize the risk of exposure

Vendors translate this best practice into security software and services that focus on securing the enterprise through application code penetration testing for known vulnerabilities and security configuration monitoring against compliance standards such as the DoD STIGs For example as shown below IBM Securityrsquos zSecure suite provides products that audit configurations for standards compliance and reports on anomalies

to their QRadarreg SIEM They also provide ESM administrative support Yet it only takes one zero-day code-based vulnerability in the OS layer to afford a hacker with the ability to bypass everything that is considered essential and best practice in securing the applications and the source data associated with those applications These vulnerabilities when exploited allow the exploiter full access to any data and any application residing on that system Note that External Security Managers (RACFreg CA ACF2trade and CA Top Secrettrade) are not part of the solution nor are any Application Security Testing tools or Run-time Application Self Protection (RASP) tools No current ESM or Application Security Testing Tool can identify these vulnerabilities notify you when they are exploited nor remediate the vulnerabilities Ensuring system integrity is outside the scope of the current External Security Managers The ESMrsquos are not designed to enforce a security policy when a hacker (external or internal) uses an OS layer vulnerability to circumvent zOS system integrity by altering his security authority in memory and gains unauthorized access to the system

IBMrsquos Statement of IntegritySecurity professionals understand how to mitigate the risks caused by configuration-based vulnerabilities They have robust tools to monitor network traffic scan applications and monitor security configurations for documented vulnerabilities Unfortunately these tools are incapable of detecting zero day code-based vulnerabilities at the OS layer and in practice OS layer vulnerability assessments uncover serious exposures unrelated to ldquodriftingrdquo configurations and excessive access How is this possible when integrity and security are so integral to System z that the operating system will not start unless an ESM has been specified in the system configuration



Mainframe strategy

Traditionally the mainframe has depended upon the IBM Statement of Integrity as the cornerstone for the security of the mainframe In 1973 IBM announced its Statement of Integrity for its new Operating System OSVS2 OSVS2 was the predecessor to MVS and zOS In its current form the IBM Statement of Integrity states

ldquoIBMrsquos commitment includes design and development practices intended to prevent unauthor ized appl icat ion programs subsystems and users from bypassing zOS security ndash that is to prevent them from gaining access circumventing disabling altering or obtaining control of key zOS system processes and resources unless allowed by the installation Specifically zOS ldquoSystem Integrityrdquo is defined as the inability of any program not authorized by a mechanism under the installationrsquos control to circumvent or disable store or fetch protection access a resource protected by the zOS Security Server (RACFreg) or obtain control in an authorized state that is in supervisor state with a protection key less than eight (8) or Authorized Program Facility (APF) authorized In the event that an IBM System Integrity problem is reported IBM will always take action to resolve it ldquo

It is important to note in the first statement that IBM does not state that zOS will have no system integrity problems but rather that if one is reported they will always take action to resolve it And the second reference clearly states that it is the installationrsquos responsibility that any authorized code they add (and this would include products from Independent Software Vendors and any installation developed code) also conforms to the same high level of standards that zOS uses to maintain its integrity

According to IBMrsquos zOS Authorized Assembler Services Guide you are responsible for the following for each zOS system you have to ensure that system integrity is effective and to avoid compromising any of the integrity controls

provided in the system the installation must assume responsibility for the followingbull Physical environment of the computing systembull Adoption of certain procedures (for example

the password protection of appropriate system data sets) that are a necessary complement to the integrity support within the operating system itself

bull That its own modifications and additions (3rd Party Software) to the system do not introduce any integrity exposures That is all installation-supplied authorized code (for example an installation SVC) must perform the same or an equivalent type of validity checking and control that the system uses to maintain its integrity

Code-based VulnerabilitiesCode-based vulnerabilities are caused by poor design and coding errors in programs that reside in the mainframersquos OS layer (PC routines SVCrsquos) They do not follow the rules laid down by the IBM Statement of Integrity Most zOS systems have tens of thousands of authorized programs including software from internal teams and independent software vendors Operating system code Independent Software Vendor (ldquoISVrdquo) supplied products and installation-added authorized programs and interfaces are part of the operating system layer and can contain these security vulnerabilities

In most cases these vulnerabilities must be remediated by the code owner The code owners are in the case of zOS IBM and in the case of third-party add-on products either IBM or an ISV or ndash in the case of internally developed code ndash the Company

One of the strengths of zOS is that programs can be developed anywhere in the world and (for the most part given similar supporting software) will run unchanged on any other system in the world In the case of OS-level code vulnerabilities this is a danger because it means that vulnerabilities can be researched and developed anywhere and the exploits can be ldquoimportedrdquo into any companyrsquos



Mainframe strategy

internal environment Therefore it is not a viable risk assumption that very few individuals with access to the companyrsquos systems would have the expertise to carry out an attack There is a large distinction between developing an exploit and being able to implement it In fact the majority of security code vulnerabilities can be exploited using a CLIST or REXX Exec

The balance between defenses and exposures isnrsquot static or even predictable itrsquos impossible to monitor and comprehend consequences of vendor development and maintenance streams In the same way that PCs and servers need constant monitoring so do mainframes

OS Layer Vulnerabilities Within the application and operating system layers of zOS are programs and memory When memory is allocated to a program by the operating system a storage key is assigned to it This storage key dictates whether the storage belongs in the application layer (storage key 8) or the OS layer (storage keys 0-7) In the application layer application programs have the ability to modify application memory Application layer programs are normally run within the application layer PSW Key 8 problem state The PSW key allows these programs to alter any private area storage key 8 memory (APPLICATION DATA) in their address space This is known as a non-reentrant application program state and the data is loaded into storage key 8 memory and can be modified directly by application layer programs

Reentrant (RENT) programs are loaded into the OS layer memory and cannot be directly updated by an application program However if an application layer program is given READ authority by the ESM to the program libraries it can copy them to another library modify the programs stored in that library then load and execute the modified copy

Application programs CANNOT directly modify OS layer programs or memory Typically ESM

programs and credentials are located in the OS layer A common exploitable vulnerability within application security interfaces is caused by the failure to place application security programs and credentials in the OS layer

Note that security credentials for all current ESMs (RACF ACF2 and Top Secret) should be in the OS layer This denies application programs the ability to directly update security credentials associated with the authorization and authentication of resources associated with the application An OS layer program must be used for an exploiter to modify security credentials Scanning application code for vulnerabilities will NEVER find severe security vulnerabilities that allow OS layer programs or memory to be modified While there are benefits to scanning application layer programs for vulnerabilities finding severe security code vulnerabilities is not one of them

In the case of a storage alteration vulnerability an authorized program allows a non-authorized user the ability to modify operating system memory locations These locations would include where the ESM ie RACFreg keep their security credentials Storage alteration vulnerabilities occur when a non-authorized user can invoke an authorized function (eg a SVC or PC routine) that will modify operating system memory A non-authorized user will usually be able to control which addresses are modified by the authorized function

To exploit a storage alteration vulnerability a non-authorized user would invoke the authorized program passing an address to be modified (eg the zOS or ESM security credentials) The authorized program would update the address specified by the non-authorized caller while executing in an authorized PSW Key The exploit of this vulnerability could be written as a script (CLIST or REXX) or an assembler program Using a storage alteration vulnerability the exploiter could



Mainframe strategy

bull Change exploiters authority ndash Elevate zOS authority to allow MODESET

or bypass password authorityndash Elevate ESM authority to allow access to

protected resourcesndash Change ESM credentials to impersonate

other usersbull Make changes to the operating system

ndash Disable or bypass ESM security checksndash Disable zOS logging (SMF)ndash Allow the capture of Userids and password

or other sensitive datandash Modify network configuration to allow

sensitive data to be sent out into the networkndash Allow signonlogon without the proper

credentials

Comprehensive Risk ManagementToday System z supports zOS integrity with controls that include separation of functions 2 factor authentication logging of privileged access standards based defaults for system configurations the ability to classify data and encryption of sensitive data

The focus has always been to protect data using the ESMrsquos Access and Authentication security strategies Unfortunately protecting the volume of data coming from the numerous sources available today makes this traditional methodology impractical and hackers have sophisticated means to bypass these traditional strategies to exploit exposures A comprehensive security compliance program should always include analysis for configuration-based and code-based vulnerabilities Mainframes need constant evaluation for exposures created not only by configuration changes but also vendor software releases and patches Failure to do both leaves your mainframe system at risk

Establishing and monitoring policy driven security settings is fundamental to a robust risk management strategy Additionally code-based vulnerability

scanning can test for zero-day vulnerabilities in the operating system layer caused by poor coding techniques This is known as Operating System Integrity Testingtrade (OSIT) Code reviews isolated and manual are not only impractical and costly but inaccurate Dynamic review of code during testing or run-time goes further but cannot point to the line of code where the vulnerability originated

The recommended approach is a persistent interactive approach to identifying zOS and application code vulnerabilities Interactive application and OS layer code vulnerability scanning with dynamic testing to determine the location of the vulnerability in the code is necessary to ensure that both data and systems are protected To successfully manage the zOS security code vulnerability problem requires an Operating System Integrity Testingtrade (OSIT) approach using an interactive and persistent testing methodology along with monitoring of critical zOS and ESM functions The outcome for you is a mainframe that both maintains its system integrity and delivers effective security that in the end provides the least risk of exposure to breaches

In ConclusionRemember ensuring system integrity is outside

Deep Intelligence Provides Greater Security



Mainframe strategy

Its All About Integrity

Initial scan to baseline the systems Review the Vulnerability Detail Reports for each code

vulnerability Provide VDRrsquos to vendors Apply vulnerability patches obtained from vendors Rescan to verify the code vulnerability has been addressed Scan every time maintenance is applied

Visit wwwkrisecuritycom to learn more

STOP ADVANCED THREATSThe zAssurereg Vulnerability Analysis Program (VAP) is available to quickly and efficiently identify zero day mainframe vulnerabilities and protect your organization from denial of service (DDOS) attacks and much more



Mainframe strategy

the scope of the External Security Managers The ESMrsquos were not designed to enforce your security policy when an OS-layer code vulnerability is exploited and bypasses the ESM security controls allowing unauthorized and undocumented access to data

System integrity is a critical component of zOS Regardless of which ESM you have they all depend upon system integrity in order to function properly Your zOS system is vulnerable with a single system integrity exposure Without Operating System Integrity there can be no System Security

Where does all this lead It surely does not undermine the mainframersquos well-deserved reputation for integrity no other platform rivals what its integrated architecture development and maintenance philosophies and fundamental reliability mindset provides

It does however recall the sage advice ldquoTrust but verifyrdquo Mainframes remain the ideal platform for supporting business processes and especially for building future successes (mobile cloud payment) but their use must include appropriate verification that the systemrsquos architectural foundation -- zOS -- provides no ldquobasement kitchen windowrdquo exposures

About the author Ray Overby is the President and CTO at Key Resources Inc a mainframe software and security services firm founded in 1988 Ray is a recognized authority in mainframe security risk and compliance for IBM zSystem environments For the past 12 years he has been providing security consulting services to Fortune 500 institutions focusing on comprehensive zOS vulnerability assessments

A hackathon is a way to bring together like-minded people divide them up into teams and develop customer-focused ideas very quickly The important things for a hackathon are creativity and innovation adopting a start-up mentality rapid prototyping and producing a Minimum Viable Product (MVP) and including your mainframe Teams will combine internal APIs with externally-available APIs to produce something new and unique using modern programming languages such as nodejs and swiftlang

But would any self-respecting mainframe-using business indulge in hackathons The answer is definitely lsquoyesrsquo because they provide a way to circumvent waterfall development methodologies where a new application could be two years away and by then out of date Citibank runs Citi mobile challenges These get people to look at different ways people can consume their banking services ndash itrsquos a way to get the next big idea from people outside their company And Ciitbank can then monetize the ideas Blockchain is great for hackathons because it is digital and secure

So whatrsquos needed for a hackathon to be a success Here are some ideas positive energy IT skills a venue and a date sponsorship a code of conduct mixer sessions and resources (venue food and drink) On the day you need a keynote speaker food and drink and people to develop their ideas At the end of the hackathon teams should have produced a viable product that has been tested and can be shown It can then be further developed and tested and possibly used commercially A hackathon is definitely an idea thatrsquos worth giving a try



Mainframe strategy

DevOps for the mainframeDevOps has moved beyond being the latest trendy buzzword to mainstream Today it receives attention from industry analysts marketers bloggers software developers and more importantly IT departments in large and small enterprises Why DevOps helps businesses compete by delivering innovations to customers faster and more reliably Learn how the mainframe can be part of the DevOps conversation

What is DevOps and why should I careOccasionally I am asked if DevOps is a tool that can be bought If only it was that easy DevOps is really about organizational change It is the practice of Development and IT Operations working together through the entire software lifecycle from design through the development process to production This not only requires a change in behavior and culture but the implementation of processes and the use of a new tool-chain to bring it all together

The main goal of a DevOps approach is to develop and deploy innovation fastermdashto meet the needs of your customers or constituents But speed cannot come at the price of quality As leading industry analystsrsquo note ldquoDevOps emphasizes collaboration automation and integration of development and operations teams resulting in more frequent releases at higher qualityrdquo1 CIOs are keen to use DevOps in order to respond to Line of Business (LOB) requirements faster by leveraging agile development When development is agile small teams work interactively on tasks in iterative work cycles with focus on delivering value to customers By taking down the walls of hierarchy there is transparency between teams ensuring better coordination Harmonizing the change management and development processes also allows CIOs to better scale development teams

Figure 1 The Benefits of DevOps

1 A CIOrsquos Guide to DevOps On-Demand Video - Watch Anytime Anywhere Retrieved from httpswwwgartnercomwebinar3165618



Mainframe strategy

Yes you may say our Javareg teams and new developers are using DevOps but we are the mainframe team so this isnrsquot relevant to us I beg to differ Mainframe teams can play an integral role in the DevOps processes of your organization Donrsquot let your CIO overlook your teamrsquos ability to participate

Why DevOps is relevant for the MainframeA key feature of DevOps is cont inuous deploymentmdashwhich means tests are automated and immediately deployed to production Googlereg and Amazonreg do thismdashthey make changes to live apps at a rate of 20000 deployments per day It is estimated that ldquoAmazon deploys every 116 secondsrdquo2 They are the pioneers of DevOps and need the speed to meet the dynamic needs of their market place The speed of change is breathtaking in this environment

In the mainframe world this break-neck speed of change is just not realistic But this does not preclude mainframe teams from participating in DevOps While mainframe developers donrsquot have a culture of implementing changes willy-nilly and certainly donrsquot throw out changes continuously they can benefit from many of the principals of DevOps such as repository-based development and Continuous Integration If mainframe teams can get to a state where they can deploy on a weekly basis using DevOps this is a big advantage over the waterfall models which take months and lock processes

Repository-based development supports parallel developmentAs simple as it sounds it is a big change in the mindset of mainframe developers to realize that a repository like Git takes lead over the source code All changes are now committed to this repository and from there distributed to the corresponding environments Developers have to pull source code out of the repository implement and change code on a local workspace then execute and test in a private and isolated mode on a remote development environment Using the

2 Hacker News Retrieved from httpsnewsycombinatorcomitemid=2971521 Lawton George (2013 Sep 5) How Amazon Made the Leap to a DevOps Culture Retrieved from httpservicevirtualizationcomhow-amazon-made-the-leap-to-a-devops-culture

Figure 2 DevOps on the Mainframe with NaturalONE



Mainframe strategy

Natural programming language as an example the single source of truth is now the repository and no longer the FUSER Development happens in an EclipseTM-based platform like NaturalONE Private mode supports work performed in parallel by allowing developers to test and execute their implementation in isolation from each other A source code repository supports ldquobranchingrdquo where multiple teams can work on multiple branches of the code then merge the branches upon completion In your typical mainframe environment today without DevOps you have to lock modules and no one else is able to make changes The waiting for unlock kills efficiency and productivity By working on a repository in parallel you are not blocked

What happens next if all this code is developed in parallel conflicts with one another Fortunately at the end it all gets merged with the help of the merge capabilities of the source code management system After committing and pushing your changes Continuous Integration ensures your application can be built with your changes incorporated into the shared development environment

Continuous Integration ensures application build is successfulldquoA cornerstone of DevOps is Continuous Integration (CI) a technique designed and named by Grady Booch that continually merges source code updates from all developers on a team into a shared mainline This continual merging prevents a developerrsquos local copy of a software project from drifting too far afield as new code is added by others avoiding catastrophic merge conflicts In practice CI involves a centralized server that continually pulls in all new source code changes as developers commit them and builds the software application from scratch notifying the team of any failures in the process If a failure is seen the development team is expected to refocus and fix the build before making any additional code changes While this may seem disruptive in practice it focuses the development team on

a singular stability metric a working automated build of the softwarerdquo3

Any modification is uploaded and compiled in an isolated private mode Once a developer has finished the work on a feature he makes the changes available to others by committing the changes to the repository Through Continuous Integration the new changes are transferred from the repository to the central development environment It ensures our application is built successfully and should run unit-tests to prove all functionality is still given Continuous Testing is required for DevOps successFaced with increasingly complex applications delivered at dramatically faster speed software testers have the potential to be the bottleneck that determines if a DevOps initiative fails or succeeds To implement full DevOps the testing process must be automated and transformed to happen continuously This should dramatically reduce the level of effort required for testing Testing must also be collaborative to ensure quality while reducing the time it takes to deliver new features

Fortunately there are a number of tools available in the market that can help Like Java developers mainframe developers using Natural can also establish and automate unit tests using NaturalONE and Continuous Integration tools such as Jenkinsreg All modules can be continuously tested to ensure quality and even Natural programs can be fully tested using the newly available Natural screen-based Tester For Natural mainframe developers NaturalONE tools like Profiling and Code Coverage for runtime testing complement the testing process These tools ensure that the performance of the components delivered meets the business requirements and the code coverage of your unit tests is high enough

3 Cois Aaron (2015 Jan 26) Continuous Integration in DevOps Retrieved from httpsinsightsseicmuedudevops201501continuous-integration-in-devops-1html



Mainframe strategy

Project and change management must be collaborativeLast but not least effective project and change management is a key component in setting up DevOps in your organization It is good practice in DevOps that no development and no change should happen if it is not linked to a proper task in a project or change management tool So even at the beginning of DevOps project and change management stands and all activities should support an existing task Every source code change and every build and deployment should be tracked and of course fully automated This will give you full transparency into the whole development lifecycle of your organization

For mainframe developers running mission-critical applications the stakes are high You need the right tools to effectively coordinate and govern your systems development lifecycle Fortunately if you use an Eclipse-based platform like NaturalONE there are many open source and third party tools that you can leverage to help manage your project NaturalONE integrates with all tools with Eclipse plugins like Atlassian Jirareg and Redmine an open source tool

Benefits of DevOps for the MainframeFrom the CIO down to the application developer implementing DevOps means delivering better code faster and more efficiently Productivity is improved by automating processes and leveraging Eclipse and repository-based tools for parallel development Transparency is also greatly improved with a change-management record which contains a history of all changes version comparison and the ability to roll back to a previous version With Continuous Integration test efforts are reduced while quality of deployment is improved

One of the most empowering reasons CIOs will want to pursue DevOps is that it will help reduce the risk of business disruption due to the retirement of skilled workersmdashthe generational

change in workforce This is particularly true especially in the case of IT departments that still use Natural on the mainframe NaturalONE is the recommended development environment for Natural because it is fully integrated with the DevOps tool chain familiar to Java developers who will also appreciate NaturalONErsquos familiar Graphical User Interface (GUI) and wizards Because NaturalONE is Eclipse-based you can standardize on a single platform across all program languages You can efficiently cross-train personnel to deploy resources where theyrsquore most neededmdashand at a momentrsquos notice Yoursquoll find it easier to recruit new programmers who will appreciate the collaborative DevOps support of NaturalONE for agile development and Continuous Integration

It is also interesting to mention that Natural applications running on a Mainframe can very successfully run on Open Systems platforms as well In fact about the half of Natural applications operating worldwide are running on Linux UNIX or Windows If your company is thinking about re-hosting its Natural applications to Linux for example your implemented DevOps approach can be fully applied the same way in your new Open Systems environment It can even be a valuable first step when heading in this direction

Jump start DevOps for your mainframe with NaturalONEIf you run Natural on a mainframe I strongly encourage you to give NaturalONE a try NaturalONE embraces the DevOps approach to development enabling you to develop new applications and modernize existing Natural applicationsmdashfastermdashto meet changing business requirements and reduce application development costs

NaturalONE operates in Linuxreg or Windowsreg and because it is based on Eclipse easily integrates with multiple Eclipse-based tools Since



Mainframe strategy

TACKLE THE SKILLS CHALLENGE

WITH DEVOPS FORTHE MAINFRAME

Modernize your mainframe application development tools and processes for DevOps to increase responsiveness to business improve development quality and attract new talent With Eclipsetrade-based NaturalONE you can easily recruit new programmers who will appreciate its collaborative DevOps support for agile development and continuous integration

Try NaturalONE for free download at wwwSoftwareAGcomNaturalONE

Software AG is leading the way for the next generation to innovateand harness the potential of Digital Transformation withits Adabas amp Natural 2050+ Agenda

Learn how at 2050softwareagcom



Mainframe strategy

work can be executed from one platform without having to open accompanying applications on their base platform developers of Natural as well as Java or COBOL can efficiently collaborate and work on multiple platforms using a range of developer productivity tools from a single user interface NaturalONE is well-suited for developing applications to run natively on the mainframe Linux UNIXreg and Windows (LUW)

NaturalONE can accelerate delivery of new applications with automatic interactive testing and debugging tools Open source versioning tools allow for team development where developers can write test and execute programs independently while sharing the source code of the project in a team repository Like Java developers you can establish and automate unit tests using open source tools such as Jenkins NaturalONE tools like profiling for runtime testing complement the testing process and ensure that the performance of the components delivered meet the business requirements

From NaturalONE you can use Construct EntireX Predict and many other tools by remotely connecting to your mainframe or LUW environment For example conduct Predict data dictionary maintenance and browse data using the integrated data browser for Natural Data Definition Modules

Bring your mainframe into the DevOps conversation by leveraging NaturalONE This Eclipse-based Integrated Development Environment (IDE) lets developers code test and maintain applications expose Natural objects as services create Rich Internet Applications (RIAs) and web interfaces and manage the complete DevOps lifecycle from one environment so you can modernize and deploy new applications more quickly with better quality to immediately satisfy your customers

About the authorZvonimir Ivanetic is a Senior Adabas amp Natural Customer Success Architect at Software AG He has been with Software AG for more than 10 years working as a consultant on the integration and modernization of Adabas amp Natural applications and the development of distributed scalable web applications With the introduction of the Adabas amp Natural 2050+ Agenda Zvonimir joined the global core team as an Architect supporting all customers in transforming to a digital architecture optimizing their infrastructure and bringing innovation to their valuable Adabas amp Natural applicationsAbout Adabas amp Natural 2050+

Countless organizations rely on the Adabas amp Natural platform for their mission- and business-critical applications With ldquoAdabas amp Natural 2050+ Agendardquo Software AG is fully supporting customers in harnessing the innovation potential provided by digitalization From skills to connectivity to DevOps development and cost efficient platforms Software AG is leading the way for the next generationLearn more at http2050softwareagcom

About Software AGSoftware AG (Frankfurt TecDAX SOW) helps companies with their digital transformation With Software AGrsquos Digital Business Platform companies can better interact with their customers and bring them on new lsquodigitalrsquo journeys promote unique value propositions and create new business opportunities In the Internet of Things (IoT) market Software AG enables enterprises to



Mainframe strategy

lsquoReports of my death have been greatly exaggeratedrsquoWith vinyl music back in fashion the mainframe is in vogue again too writes Mark Wilson Technical Director at RSM Partnersrsquo

The mainframe is already the centre of gravity for many organizations Should it be at the heart of your world too ndash underpinning your enterprisersquos digital transformation journey

The keynote address at the 2017 Guide Share Europe (GSE) UK conference came from Chris OrsquoMalley CEO and President of Compuware Titled The Future Ready Imperative A Mainstreamed Mainframe his central point was that the mainframe is not only here to stay but that the value of its stock is rising fast (By the way the Mark Twain quotation heading this article is actually a misquote but itrsquos the version in common use and neatly sums up my starting position) In his keynote Chris described the mainframe as the most future-ready platform in the world the most reliable securable scalable and cost efficient He said it remains ldquothe dominant growing and vital backbonerdquo for the global economy The problem however is that ldquooutdated processes and tools ensnared in an apathetic culture doggedly resistant to change prevent far too many enterprises from unleashing its unique technical virtues and business valuerdquo As I blogged at the time it was fascinating to

hear a leader speak so candidly describing a companyrsquos transformation from ldquoa declining business oppressed in annual waterfall release cycles to an energized software company 100 committed to Agile and DevOpsrdquo He has already lived through what he is proposing others should do genuine digital transformation underpinned by a lsquomainstreamed mainframersquo

Wersquore seeing this trend with our own clients too the mainframe is more in vogue today than has been for more than 20 years and is becoming even more critical to an organizationrsquos business success (and good health) The mainframe has become a streamlined super-fast data monster a transaction eating behemoth the system of record There is a good reason why z stands for ldquozero downtimerdquo It is the only platform you can really properly trust

As people recognize that todayrsquos mainframe is brilliant at what it does a logical next step is to ask ldquowhy donrsquot we lsquomainstream the mainframersquo and move it to the centre of everything we dordquo The problem as Chris OrsquoMalley noted in his GSE keynote is that not everybody possesses the in-house experience or skills they believe are required But times and technology are changing

From 1964 to 2018In 2018 mainframe technology is all about modernity speed and agility Modern intuitive user

integrate connect and manage IoT components as well as analyze data and predict future events based on Artificial Intelligence (AI) The Digital Business Platform is built on decades of uncompromising software development IT experience and technological leadership Software AG has more than 4500 employees is active in

70 countries and had revenues of euro872 million in 2016 To learn more visit wwwsoftwareagcom Software AG and all Software AG products are either trademarks or registered trademarks of Software AG Other product and company names mentioned herein may be the trademarks of their respective owners



Mainframe strategy

interfaces mean green screens can be consigned to the dustbin of history The mainframe sits at the heart of the API community Itrsquos the best cloud server on the planet And wersquove been doing it since 1964

If yoursquove got one already then you should ask yourself what more could it be doing to support and secure my enterprise The opportunity is to sweat the mainframe to exploit it and achieve more with it

If you havenrsquot got one and want to tap into all those acknowledged benefits ndash quality of service reliability availability scalability and security ndash but are worried about a lack of knowledge and skills around the zOS operating system then you can look to the open source resource of Linux

Making it easy Linux for ZIt may be worth remembering at this point the amazing degree to which the economy depends on the mainframe a fact that few non-mainframe lsquociviliansrsquo appreciate They donrsquot know just how much is underpinned by the platform The majority of ATM transaction debit or credit card transaction touch a mainframe in one form or another Airlines run on them Most of the big banks insurers and retailers depend on mainframes in some way It has been estimated that more than 70 of global Fortune 500 companies use the mainframe to run core business functions The platform is part of critical national infrastructure

With IBM Z hardware known for RAS ndash Reliability Availability Security ndash using open source Linux for Z means organizations can benefit from all those Z capabilities and strengths in a simple efficient and secure way enabling data security and business continuity operational efficiency high availability superior performance DevOps and application development content management and on and on More than a decade old Linux for Z originated as two separate efforts to port Linux to IBMrsquos biggest servers Bigfoot (i370) and Linux for s390 Server consolidation enabled by

this technology can now help a business to save serious money and work ever more efficiently from absorbing workload spikes to reducing energy costs to do more with less Indeed allied with Z virtualization capabilities it can make a massive difference to bringing down IT costs enabling the running of hundreds of virtual Linux servers concurrently with ensured isolation of each for security and recoverability Solutions like Red Hat for management and automation Docker for software containerization Kubernetes to automate deployment scaling and management of containerized applications ndash and many many more ndash all run on IBM Z just as well if not better than on other platforms And in an age of massive data breaches and security concerns one of the best things is that it can all be all so secure

A new era in security Crypto as a ServiceFor enterprises that donrsquot currently run Z one of the biggest benefits to be gained is in the security space Of course security is critical for any organization that has embarked on a lsquodigital transformation journeyrsquo and wants to expose its services to external and internal clients As we know the IBM Z hardware architecture along with several software solutions ensure that Z is a true market leader the most securable server on the planet And goodness knows thatrsquos what we need If you look at the serious data breaches that have taken place over the last few years the sobering fact is that only four percent of the data stolen was encrypted 96 percent was clear and unencrypted so it was free and available for use Could the mainframe become the advanced crypto service provider (ACSP) for the enterprise The simple answer is yes

With IBMrsquos development and launch of the z14 Crypto cards and Pervasive Encryption (PE) in 2017 the Z world has met the challenges of cyber security in the modern world head on tackling the threats while creating new opportunities IBM said these capabilities ldquousher in a new era of game-changing security capabilitiesrdquo and I agree The huge potential of Pervasive Encryption is



Mainframe strategy

clear you can now encrypt enterprise business data relatively quickly and easily at scale with minimal overheads and at rest or in flight And the implications go way beyond the Z world into the non-mainframe security community If we can do this using the mainframe at high speeds and to such a remarkable degree of quality then pervasive encryption might just be the harbinger of a big change the mainframe becoming a trusted security service provider for the entire enterprise Crypto as a Service (CaaS) becomes a reality

My own team at RSM Partners has a potential collaboration with IBM to develop a lsquoblack boxrsquo appliance or container solution to deliver Crypto as a Service into enterprises that do not have the time or resources to develop their own capability in-house or who canrsquot afford to and for data centers and hosting providers who want to provide CaaS as another service offering to their own clients This appliance would deliver capabilities including secure data encryption and public key infrastructure (PKI) directly into distributed platforms Exciting times If trust is genuinely ldquothe new currency that drives the economyrdquo then end-to-end protection made easy for all will surely have a significant impact

Meanwhile in academiaRunning alongside these developments in Z technology and security is the resurgence in interest wersquore seeing in the academic world among students and institutions which is highly encouraging People are continuing to wake up to the potential of the mainframe and to the rising demand for skilled people ndash not least as z specialists from previous generations finally hit retirement An article in University Business

in August 2017 made it clear that ldquoDemand for mainframe programmers is about to take off 10000 baby boomers are retiring every day It is overwhelmingly this generation that was trained to program mainframes Compounding the issue is the expectation that 20 of mainframe programmers will retire in the next five yearsrdquo I am increasingly confident that a new generation is already in the pipeline with a growing number of institutions designing and delivering mainframe-related education For example Manchester Metropolitan University which is part of IBMrsquos Academic Initiative programme introduced a four-year mainframe-specific degree course in September 2017 for up to 25 students This is designed as a highly practical degree and so includes work-based projects Other universities are developing their own courses At the same time the big banks including Barclays and Lloyds Banking Group have started running mainframe apprenticeship programmes And IBM has its own Master the Mainframe challenge which promotes computing to schools and university students in more than 35 countries across six continents

The mainframe is Irsquom very glad to say here to stay If I had to summarize recent developments in our world and particularly the progressive upturn in the mainframersquos fortunes it would be this the future is bright Or more precisely the future is Z

About the authorA passionate advocate of all things Z and international speaker in mainframe technology and secur i ty Mark Wi lson heads RSM Partnersrsquo Technical and Security teams wwwrsmpartnerscom



Mainframe strategy

ContentsWelcome to the Arcati Mainframe Yearbook 2018 3Staying secure and compliant 5How to Ditch Waterfall for DevOps on the Mainframe 10Health Solutions Provider Accelerates Integration Sparks IT

Collaboration Using Server-Side JavaScript 16zOS Code Scanning Is Essential to System zreg Security 21DevOps for the mainframe 27lsquoReports of my death have been greatly exaggeratedrsquo 33

The 2018 Mainframe User Survey 36An analysis of the profile plans and priorities of mainframe users

Vendor Directory 52Vendors consultants and service providers in the zOS environment

A guide to sources of information for IBM mainframers 136Information resources publications social media and user groups for the zOS

environment

Glossary of Terminology 142Definitions of some mainframe-related terms

Mainframe evolution 173Mainframe hardware timeline 1952-2017 mainframe operating system development

Action Software 55 56Azamour Solutions 61 141Compuware Corporation 10 72Data Kinetics 51 76 EPV Technologies 83Fischer International Systems Corporation 85

Hostbridge Technology 16 92Key Resources Inc 21 99Software AG 27 120Software Diversified Services 4 121UBS Hainer 129 130

SPONSORS



Mainframe strategy














Mainframe strategy












Mainframe strategy












Mainframe strategy












Mainframe strategy















Mainframe strategy



Mainframe strategy

















Mainframe strategy











Mainframe strategy









See Figure 1



Mainframe strategy









Mainframe strategy











Mainframe strategy



Mainframe strategy











Mainframe strategy



















Mainframe strategy













Mainframe strategy













Mainframe strategy











Mainframe strategy













Mainframe strategy







Mainframe strategy













Mainframe strategy












Mainframe strategy








credentials










Mainframe strategy








Mainframe strategy











Mainframe strategy








Mainframe strategy









Mainframe strategy










Mainframe strategy











Mainframe strategy









Mainframe strategy










Mainframe strategy












Mainframe strategy











Mainframe strategy









Mainframe strategy














Mainframe strategy












Mainframe strategy












Mainframe strategy












Mainframe strategy















Mainframe strategy



Mainframe strategy

















Mainframe strategy











Mainframe strategy









See Figure 1



Mainframe strategy









Mainframe strategy











Mainframe strategy



Mainframe strategy











Mainframe strategy



















Mainframe strategy













Mainframe strategy













Mainframe strategy











Mainframe strategy













Mainframe strategy







Mainframe strategy













Mainframe strategy












Mainframe strategy








credentials










Mainframe strategy








Mainframe strategy











Mainframe strategy








Mainframe strategy









Mainframe strategy










Mainframe strategy











Mainframe strategy









Mainframe strategy










Mainframe strategy












Mainframe strategy











Mainframe strategy









Mainframe strategy












Mainframe strategy












Mainframe strategy












Mainframe strategy















Mainframe strategy



Mainframe strategy

















Mainframe strategy











Mainframe strategy









See Figure 1



Mainframe strategy









Mainframe strategy











Mainframe strategy



Mainframe strategy











Mainframe strategy



















Mainframe strategy













Mainframe strategy













Mainframe strategy











Mainframe strategy













Mainframe strategy







Mainframe strategy













Mainframe strategy












Mainframe strategy








credentials










Mainframe strategy








Mainframe strategy











Mainframe strategy








Mainframe strategy









Mainframe strategy










Mainframe strategy











Mainframe strategy









Mainframe strategy










Mainframe strategy












Mainframe strategy











Mainframe strategy









Mainframe strategy












Mainframe strategy












Mainframe strategy















Mainframe strategy



Mainframe strategy

















Mainframe strategy











Mainframe strategy









See Figure 1



Mainframe strategy









Mainframe strategy











Mainframe strategy



Mainframe strategy











Mainframe strategy



















Mainframe strategy













Mainframe strategy













Mainframe strategy











Mainframe strategy













Mainframe strategy







Mainframe strategy













Mainframe strategy












Mainframe strategy








credentials










Mainframe strategy








Mainframe strategy











Mainframe strategy








Mainframe strategy









Mainframe strategy










Mainframe strategy











Mainframe strategy









Mainframe strategy










Mainframe strategy












Mainframe strategy











Mainframe strategy









Mainframe strategy












Mainframe strategy















Mainframe strategy



Mainframe strategy

















Mainframe strategy











Mainframe strategy









See Figure 1



Mainframe strategy









Mainframe strategy











Mainframe strategy



Mainframe strategy











Mainframe strategy



















Mainframe strategy













Mainframe strategy













Mainframe strategy











Mainframe strategy













Mainframe strategy







Mainframe strategy













Mainframe strategy












Mainframe strategy








credentials










Mainframe strategy








Mainframe strategy











Mainframe strategy








Mainframe strategy









Mainframe strategy










Mainframe strategy











Mainframe strategy









Mainframe strategy










Mainframe strategy












Mainframe strategy











Mainframe strategy









Mainframe strategy















Mainframe strategy



Mainframe strategy

















Mainframe strategy











Mainframe strategy









See Figure 1



Mainframe strategy









Mainframe strategy











Mainframe strategy



Mainframe strategy











Mainframe strategy



















Mainframe strategy













Mainframe strategy













Mainframe strategy











Mainframe strategy













Mainframe strategy







Mainframe strategy













Mainframe strategy












Mainframe strategy








credentials










Mainframe strategy








Mainframe strategy











Mainframe strategy








Mainframe strategy









Mainframe strategy










Mainframe strategy











Mainframe strategy









Mainframe strategy










Mainframe strategy












Mainframe strategy











Mainframe strategy









Mainframe strategy



Mainframe strategy

















Mainframe strategy











Mainframe strategy









See Figure 1



Mainframe strategy









Mainframe strategy











Mainframe strategy



Mainframe strategy











Mainframe strategy



















Mainframe strategy













Mainframe strategy













Mainframe strategy











Mainframe strategy













Mainframe strategy







Mainframe strategy













Mainframe strategy












Mainframe strategy








credentials










Mainframe strategy








Mainframe strategy











Mainframe strategy








Mainframe strategy









Mainframe strategy










Mainframe strategy











Mainframe strategy









Mainframe strategy










Mainframe strategy












Mainframe strategy











Mainframe strategy









Mainframe strategy

















Mainframe strategy











Mainframe strategy









See Figure 1



Mainframe strategy









Mainframe strategy











Mainframe strategy



Mainframe strategy











Mainframe strategy



















Mainframe strategy













Mainframe strategy













Mainframe strategy











Mainframe strategy













Mainframe strategy







Mainframe strategy













Mainframe strategy












Mainframe strategy








credentials










Mainframe strategy








Mainframe strategy











Mainframe strategy








Mainframe strategy









Mainframe strategy










Mainframe strategy











Mainframe strategy









Mainframe strategy










Mainframe strategy












Mainframe strategy











Mainframe strategy









Mainframe strategy











Mainframe strategy









See Figure 1



Mainframe strategy









Mainframe strategy











Mainframe strategy



Mainframe strategy











Mainframe strategy



















Mainframe strategy













Mainframe strategy













Mainframe strategy











Mainframe strategy













Mainframe strategy







Mainframe strategy













Mainframe strategy












Mainframe strategy








credentials










Mainframe strategy








Mainframe strategy











Mainframe strategy








Mainframe strategy









Mainframe strategy










Mainframe strategy











Mainframe strategy









Mainframe strategy










Mainframe strategy












Mainframe strategy











Mainframe strategy









Mainframe strategy









See Figure 1



Mainframe strategy









Mainframe strategy











Mainframe strategy



Mainframe strategy











Mainframe strategy



















Mainframe strategy













Mainframe strategy













Mainframe strategy











Mainframe strategy













Mainframe strategy







Mainframe strategy













Mainframe strategy












Mainframe strategy








credentials










Mainframe strategy








Mainframe strategy











Mainframe strategy








Mainframe strategy









Mainframe strategy










Mainframe strategy











Mainframe strategy









Mainframe strategy










Mainframe strategy












Mainframe strategy











Mainframe strategy









Mainframe strategy









Mainframe strategy











Mainframe strategy



Mainframe strategy











Mainframe strategy



















Mainframe strategy













Mainframe strategy













Mainframe strategy











Mainframe strategy













Mainframe strategy







Mainframe strategy













Mainframe strategy












Mainframe strategy








credentials










Mainframe strategy








Mainframe strategy











Mainframe strategy








Mainframe strategy









Mainframe strategy










Mainframe strategy











Mainframe strategy









Mainframe strategy










Mainframe strategy












Mainframe strategy











Mainframe strategy









Mainframe strategy











Mainframe strategy



Mainframe strategy











Mainframe strategy



















Mainframe strategy













Mainframe strategy













Mainframe strategy











Mainframe strategy













Mainframe strategy







Mainframe strategy













Mainframe strategy












Mainframe strategy








credentials










Mainframe strategy








Mainframe strategy











Mainframe strategy








Mainframe strategy









Mainframe strategy










Mainframe strategy











Mainframe strategy









Mainframe strategy










Mainframe strategy












Mainframe strategy











Mainframe strategy









Mainframe strategy



Mainframe strategy











Mainframe strategy



















Mainframe strategy













Mainframe strategy













Mainframe strategy











Mainframe strategy













Mainframe strategy







Mainframe strategy













Mainframe strategy












Mainframe strategy








credentials










Mainframe strategy








Mainframe strategy











Mainframe strategy








Mainframe strategy









Mainframe strategy










Mainframe strategy











Mainframe strategy









Mainframe strategy










Mainframe strategy












Mainframe strategy











Mainframe strategy









Mainframe strategy











Mainframe strategy



















Mainframe strategy













Mainframe strategy













Mainframe strategy











Mainframe strategy













Mainframe strategy







Mainframe strategy













Mainframe strategy












Mainframe strategy








credentials










Mainframe strategy








Mainframe strategy











Mainframe strategy








Mainframe strategy









Mainframe strategy










Mainframe strategy











Mainframe strategy









Mainframe strategy










Mainframe strategy












Mainframe strategy











Mainframe strategy









Mainframe strategy



















Mainframe strategy













Mainframe strategy













Mainframe strategy











Mainframe strategy













Mainframe strategy







Mainframe strategy













Mainframe strategy












Mainframe strategy








credentials










Mainframe strategy








Mainframe strategy











Mainframe strategy








Mainframe strategy









Mainframe strategy










Mainframe strategy











Mainframe strategy









Mainframe strategy










Mainframe strategy












Mainframe strategy











Mainframe strategy









Mainframe strategy













Mainframe strategy













Mainframe strategy











Mainframe strategy













Mainframe strategy







Mainframe strategy













Mainframe strategy












Mainframe strategy








credentials










Mainframe strategy








Mainframe strategy











Mainframe strategy








Mainframe strategy









Mainframe strategy










Mainframe strategy











Mainframe strategy









Mainframe strategy










Mainframe strategy












Mainframe strategy











Mainframe strategy









Mainframe strategy













Mainframe strategy











Mainframe strategy













Mainframe strategy







Mainframe strategy













Mainframe strategy












Mainframe strategy








credentials










Mainframe strategy








Mainframe strategy











Mainframe strategy








Mainframe strategy









Mainframe strategy










Mainframe strategy











Mainframe strategy









Mainframe strategy










Mainframe strategy












Mainframe strategy











Mainframe strategy









Mainframe strategy











Mainframe strategy













Mainframe strategy







Mainframe strategy













Mainframe strategy












Mainframe strategy








credentials










Mainframe strategy








Mainframe strategy











Mainframe strategy








Mainframe strategy









Mainframe strategy










Mainframe strategy











Mainframe strategy









Mainframe strategy










Mainframe strategy












Mainframe strategy











Mainframe strategy









Mainframe strategy













Mainframe strategy







Mainframe strategy













Mainframe strategy












Mainframe strategy








credentials










Mainframe strategy








Mainframe strategy











Mainframe strategy








Mainframe strategy









Mainframe strategy










Mainframe strategy











Mainframe strategy









Mainframe strategy










Mainframe strategy












Mainframe strategy











Mainframe strategy









Mainframe strategy







Mainframe strategy













Mainframe strategy












Mainframe strategy








credentials










Mainframe strategy








Mainframe strategy











Mainframe strategy








Mainframe strategy









Mainframe strategy










Mainframe strategy











Mainframe strategy









Mainframe strategy










Mainframe strategy












Mainframe strategy











Mainframe strategy









Mainframe strategy













Mainframe strategy












Mainframe strategy








credentials










Mainframe strategy








Mainframe strategy











Mainframe strategy








Mainframe strategy









Mainframe strategy










Mainframe strategy











Mainframe strategy









Mainframe strategy










Mainframe strategy












Mainframe strategy











Mainframe strategy









Mainframe strategy












Mainframe strategy








credentials










Mainframe strategy








Mainframe strategy











Mainframe strategy








Mainframe strategy









Mainframe strategy










Mainframe strategy











Mainframe strategy









Mainframe strategy










Mainframe strategy












Mainframe strategy











Mainframe strategy









Mainframe strategy








credentials










Mainframe strategy








Mainframe strategy











Mainframe strategy








Mainframe strategy









Mainframe strategy










Mainframe strategy











Mainframe strategy









Mainframe strategy










Mainframe strategy












Mainframe strategy











Mainframe strategy









Mainframe strategy








Mainframe strategy











Mainframe strategy








Mainframe strategy









Mainframe strategy










Mainframe strategy











Mainframe strategy









Mainframe strategy










Mainframe strategy












Mainframe strategy











Mainframe strategy









Mainframe strategy











Mainframe strategy








Mainframe strategy









Mainframe strategy










Mainframe strategy











Mainframe strategy









Mainframe strategy










Mainframe strategy












Mainframe strategy











Mainframe strategy









Mainframe strategy








Mainframe strategy









Mainframe strategy










Mainframe strategy











Mainframe strategy









Mainframe strategy










Mainframe strategy












Mainframe strategy











Mainframe strategy









Mainframe strategy









Mainframe strategy










Mainframe strategy











Mainframe strategy









Mainframe strategy










Mainframe strategy












Mainframe strategy











Mainframe strategy









Mainframe strategy










Mainframe strategy











Mainframe strategy









Mainframe strategy










Mainframe strategy












Mainframe strategy











Mainframe strategy









Mainframe strategy











Mainframe strategy









Mainframe strategy










Mainframe strategy












Mainframe strategy











Mainframe strategy









Mainframe strategy









Mainframe strategy










Mainframe strategy












Mainframe strategy











Mainframe strategy









Mainframe strategy










Mainframe strategy












Mainframe strategy











Mainframe strategy









Mainframe strategy












Mainframe strategy











Mainframe strategy









Mainframe strategy











Mainframe strategy









Mainframe strategy







Arcati Mainframe Yearbook 2007Arcati Mainframe Yearbook ... · emails hacked. The WannaCry global ransomware attack locked computers and delivered messages demanding $300 in Bitcoins

Documents