I think that being 'just another Linux box' is not an accurate description in a security context. The box -is- Linux, but I believe that it is better described as an 'appliance' or 'system console'. It should be viewed as a integral component of the zbox, not as a standalone 'workstation'. These terms have meaning to most auditors and they tend to leave them alone. More, the HMC's appear to be prepared to endure scans and probes without ill effect.
I agree that the HMC (and support elements) should not be on a company network, and should not be dependent on any other network component (LDAP servers, for example). A very private 'command and control' infrastructure seems to be an acceptable solution. Of course, access to that infrastructure would be restricted. I'm pretty sure that the Internet connections are outbound only initiated by a local human or via the POTS line. I believe that to be pretty easy to set up in a firewall. HTH and good luck. -----Original Message----- From: IBM Mainframe Discussion List [mailto:[email protected]] On Behalf Of Pesce, Andy Sent: Wednesday, January 12, 2011 8:02 AM To: [email protected] Subject: HMC of z/10-BC IBM has told us that would like us to move our HMC so that they can change the call home server to use the Internet. I am sure there are some white papers and articles about security. Our security dept. is concerned about putting it on the internal network since it is just another Linux box. Can anyone point me to some articles or share their experiences? I have been reading the "Intro" book on the HMC and it discusses some of the security issues. Andy Pesce z/OS Systems Email: [email protected] NOTICE: This electronic mail message and any files transmitted with it are intended exclusively for the individual or entity to which it is addressed. The message, together with any attachment, may contain confidential and/or privileged information. Any unauthorized review, use, printing, saving, copying, disclosure or distribution is strictly prohibited. If you have received this message in error, please immediately advise the sender by reply email and delete all copies. ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
