Previous Topic: Reviewing the Operating System

Next Topic: What About Access Control Software?

Why Worry about the Operating System?

You can compare z/OS to a house with many rooms that contain your most valuable possessions. The house can be well built, with a strong front door and a massive lock. However, if you leave the windows and back doors wide open, the house is as vulnerable as it would be without those precautions. Similarly, you can regularly review the computer’s data sets and program change authorization, but if you do not also review the computer’s operating system, you cannot be sure that there are not other ways of accessing and modifying data through the operating system.

Before the mid‑1970s, few people had access to computer systems or the knowledge to access the components of the operating system. The late 1970s and early 1980s, however, saw a technological explosion in the use of computers to process all types of information. Today, more people have access to more data than ever before, and they also have more access to and know more about the operating system. You can no longer assume that only a systems programmer can make changes to your operating system.

Computer viruses, worms, Trojan horses, and trap doors all threaten the security of your computer. These mechanisms cannot only damage your files; they can infect the operating system and generally interrupt the processing on your system.

Therefore, any security review of a computer system that addresses the data sets and programs processed on the computer, but ignores the operating system that physically controls that data is an incomplete review.