Is it more secure to have a mainframe or a collection of servers?

By Michael Cobb | Feb 23, 2009

0 comments

Digg

 Email

 Print

From a security perspective, is it better to have a mainframe, a collection of servers, or a combination of the two? I'm sure the general public thinks that mainframe computing is a thing of the distant past, given all the press coverage of developments like client/server technology, distributed systems, server farms and cloud computing. The mainframe, however, is still the cornerstone of most large IT projects around the world. One of the main reasons for this is that a mainframe has a proven security track record that others can only dream of.

Interestingly, if you compare security based on the Common Criteria for Information Technology Security Evaluation (CC), both mainframe computers running Linux or IBM's z/OS system software and various versions of Microsoft's Windows 2003 server software have all been certified at Evaluation Assurance Level (EAL)-4+. (CC specifies seven levels of security from EAL-1 to EAL-7.)

Effective distributed security across a network of systems, which is what's necessary when running a collection of run-of-the-mill servers, is hard to achieve. As the number of machines increases, there's more to protect. A variety of tools – many of which often operate independently of each other – are needed, making it difficult for anyone to truly understand the overall security picture and be confident that security policies and procedures have been correctly implemented.

Mainframes, on the other hand, have the benefit of centralized management and auditing features. And, of course, there are no monthly security patches to be tested and rolled out. Viruses, too, are almost unheard of on mainframe computers because their architecture makes it virtually impossible for unauthorized programs to execute functions that could bypass security. Also, mainframe computer security tends to include additional access control functions, often due to their size and price, not commonly found on other types of computers. These include features such as verification of tape access, access control over printouts and the automated destruction of data when disk data sets are erased.

Alternatively, a server-based approach does offer benefits. A lower entry cost is an obvious one, and that leaves more money left over for security. Although the initial cost of acquiring distributed servers may be less than the cost of a mainframe, it may cost more in the long run to maintain them. Infrastructure and energy costs have become a big consideration now. Distributed systems require additional NICs, hubs, switches and routers to be used, all of which add to floor space, power consumption and heat dissipation costs.

0 comments

Digg

 Email

 Print