Why being an IBM Champion is hard!

Working within the mainframe industry is a great way to spend your day. The technology is interesting, and the people who understand it are interesting. And being recognized as an IBM Champion is a great accolade. IBM said: “On behalf of IBM, it is my great pleasure to recognize you as a returning IBM Champion in 2021. Congratulations! We would like to thank you for your continued leadership and contributions to the IBM technology community. This recognition is awarded based on your contributions for the 2020 calendar year.” I’ve been a Champion since 2009.

So, if the industry is great and the people are great, and I’m being recognized by my peers for my work, why am I suggesting that being an IBM Champion is hard? The answer is simply that it’s everyone outside the mainframe world who make life hard. For them, the mainframe is a legacy system (and not in the nice sense of receiving a bequest from some rich old uncle that you hardly ever met) that one day soon will completely disappear off the face of the Earth – and, in the meantime, it’s really strange that anyone should still be using them.

Now, I know that if you read the works of some self-help guru, they will tell you to be positive. And that positive people are happier and get the most out of life. And in many ways that’s true, but at the same time, it’s important to spend some time (and definitely not most of your time) looking at what might go wrong, or, perhaps, what would be better if it were different. And that’s roughly how I spend my time talking and writing about the mainframe. I look at the positive aspects about it – and I also highlight areas where I think it could be even better. What I don’t ever think is that mainframes should go away any time soon.

And that’s why I was concerned about PCI compliance on mainframes. This is all to do with mainframes that take credit card payments – and, according to IBM, 44 of the top 50 banks in the USA use IBM mainframes. Section 10.5.5 of the PCI regulations asks: “Is file-integrity monitoring or change-detection software used on logs to ensure that existing log data cannot be changed without generating alerts (although new data being added should not cause an alert)?”. And section 11.5 asks: “Is a change-detection mechanism (for example, file-integrity monitoring tools) deployed to detect unauthorized modification (including changes, additions, and deletions) of critical system files, configuration files, or content files?”.  

As I wrote in a previous blog, to be PCI compliant, mainframes would need to be running File Integrity Monitoring (FIM) software on their mainframe – and most of them aren’t. In addition, someone in the company, the CEO, CFO, even the CIO, will, each year, will be signing off the section 3 PCI validation form saying that they are. These execs may be convinced that there are ‘compensating controls’ being used, which there probably aren’t. Or they may consider their mainframe to be ‘out of scope’, which it probably isn’t.

So, what makes life hard is that when the finance industry press became aware of this situation, rather than highlighting the problem for their CFO to investigate and make changes to what was happening at their organization, the article used a headline making it look like it was only a problem for those last remaining companies that were “still using mainframes”. As we saw from the IBM figures, that would be 88 percent of banks. That’s a bit like referring to people who still travel by car, or who still use a laptop! It’s not some tiny minority, it’s the majority!

I once described it to a colleague as being like King Canute (Knut) who tried to tell the tide to go out when it was coming in. It sometimes seems like everyone is thinking one way and I, like the king, are thinking differently. It’s said that Knut knew he couldn’t control the incoming tide. However, I don’t have the king’s wisdom – I still strongly believe in the future of the mainframe. I’m just waiting for the rest of the world to catch up with my way of thinking. Perhaps I have more in common with Richard Doll, who, in 1948, published a study proving that smoking could cause serious health damage. Or Alfred Wegener, who, in 1915, came up with the idea of plate tectonics and continental drift.

I’m not saying that people are prejudiced against mainframes – nothing so active. I think that the problem is that people generally don’t understand what a mainframe can do – and how powerfully it can do it. They tend to view it as a vintage 1918 biplane, when, stretching my aviation metaphor to its limits, it’s more like the latest stealth fighter. And, I think it’s the role of IBM Champions, like myself, to spread the word, not only about the power, the security features, and everything else that a mainframe can do, but also explain how Open Source tools make the mainframe accessible by people with skillsets usually associated with Windows and Linux, etc.

However, thinking about it again, being an IBM Champion isn’t all bad. IBM provides regular online meetings where experts discuss the latest technologies. And there are IBM Champion-badged items that Champions can choose from that are sent out every year. There are Champion discussion groups. And much more.

So, thinking about it, maybe being an IBM Champion isn’t that hard after all!

Mainframes and Open Source

Everyone knows that mainframes work differently from other computing platforms. And if you leave university with a degree in computing, you still won’t have a clue about how a mainframe works. Everyone knows you have to be at least 50 and prefer to work on a green screen to have the slightest idea of what’s going on inside your z/OS box.

Unfortunately, the highly prejudiced comments in that first paragraph are all too common amongst people – often execs and Windows users – who find it easier to trot out the usual anti-mainframe mantras than look at what’s really going on in the world of mainframes.

Firstly, mainframes and Linux have been in a relationship for a very long time. If you have expertise in Linux, you can work on a mainframe and get great work done. For example, Docker and Kubernetes can run easily on a mainframe using Linux

And, of course, there’s the idea that mainframes are islands of hardware that not only don’t talk to the cloud, but don’t even know that the rest of the world is using the cloud all the time. Again, the reality is that IBM is very keen on the use of cloud. They have Red Hat Open Shift and IBM Cloud. They offer Mainframe as a Service. There is so much cloud-related stuff going on that it just seems strange that some people aren’t aware of it.

What about the fact that mainframes have sixty (nearly) years of their own way of working, their own software, and their own practices that no-one else can use? That is true, but (and it’s a very big ‘but’) they also have all the things (pretty much) that non-mainframe platforms have. Java works on a mainframe! There are things like z/OSMF, VSCode, Zowe, and ZOAU, which enable developers with non-IBM Z backgrounds to work usefully on mainframes.

And picking up on that, there is the Open Mainframe Project (OMP), which is an open source initiative that enables collaboration across the mainframe community to develop shared tool sets and resources. And they are having their second annual Open Mainframe Summit digitally on 22-23 September.

The theme of this year’s Open Mainframe Summit expands beyond the mainframe to highlight influencers with strengths in the areas supporting or leveraging the technology like continuous delivery, edge computing, financial services, and open source. It will also highlight projects, diversity, and business topics that will offer seasoned professionals, developers, students, and leaders an opportunity to share best practices and network with like-minded individuals.

This year’s virtual event will feature keynote speakers Gabriele Columbro, Executive Director of Fintech Open Source Foundation (FINOS); Jason Shepherd, Vice President of Ecosystem at ZEDEDA and Chair of the LF Edge Governing Board; Jono Bacon, a leading community and collaboration speaker and founder of Jono Bacon Consulting; Steve Winslow, Vice President of Compliance and Legal at The Linux Foundation; Tracy Ragan, CEO and Co-Founder of DeployHub and Continuous Delivery Foundation Board Member, and more.

Conference sessions highlight projects, diversity, and business topics such as:

• Mainframe Mavens: 5 Women to Know – Stacey Miller, Global Product Marketing Manager at SUSE and Yvette LaMar, Director of the IBM Z Influencer Ecosystem at IBM
• The Facts about COBOL – Misty Decker, Product Marketing Director at Micro Focus; Derek Britton, Director of Communications and Brand Strategy at Micro Focus; and Cameron Seay, Adjunct Instructor at East Carolina University
• Making Our Strong Community Stronger moderated by Dr. Gloria Chance, CEO at Mousai Group – Jeanne Glass, CEO and Founder of VirtualZ Computing; David Jeffries, Vice President of Development IBM z/OS Software at IBM; Greg Lotko, Broadcom; Andy Youniss, Rocket Software
• ConsoleZ – Accessing z/VM Console Data from a Browser – Mike MacIsaac, Systems Programmer at ADP
• Workflow wiZard: A Flexible Workflow Creation Tool for z/OSMF – Ray Cole, Product Architect at BMC Software
• Feilong: The Open Source API for z/VM Automation – Mike Friesenegger, Solutions Architect at SUSE
• Integrating Tessia for Self-Provisioning of Linux Distributions on Z – Alexander Efremkin, Tessia Architect, Linux Workload Enablement on IBM Z at IBM
• Introducing ZEBRA - an Incubation Project for Zowe – Salisu Ali, Student at Bayero University Kano, Andrew Twydell, Intern at IBM and Alex Kim, Enterprise Solutions Architect at Vicom Infinity
• DIY: Zowe Explorer Starter Kit – Jessielaine Punongbayan, Product Marketing Engineer at Broadcom and Richelle Anne Craw, Senior Software Engineer at Broadcom

With a commitment to diversity, equity, and inclusion, Open Mainframe Project worked closely with the CHAOSS Diversity & Inclusion Badging Program, which encourages events to obtain D&I badges for leadership, self-reflection, and self-improvement on issues critical to building the Internet as a social good. Open Mainframe Summit earned a Gold Badge for prioritizing diversity and inclusion.

If you’re interested, you can see the full conference schedule here. Conference Registration for the online event is $50 for general attendance and $15 for academia.

If you have an interest in Open Source software on the mainframe, or you just want to know more about what might be possible, then have a look on the Open Mainframe Project website.

Mainframe resilience

Have you ever been part of a Business Continuity Plan test? If you have, then you know that you tend to end up in a hotel, or some other building, with a variety of other people from an organization and ‘war game’ what would happen in the event of various scenarios. Often, an external company will be invited in to host the sessions and be on the other end of the phone when someone is trying to deal with the press. The day can often be quite fun, sometimes illuminating, and lunch is usually very good!

The big problem is that often, what can be resolved in the meeting room in a couple of minutes takes much much longer in real life. In many scenarios, a building has been burgled, or is full of terrorists, but the mainframe and the other servers are still working. If the communications line from one site have been cut, most people – as we’ve seen over the past year or so – can work from home. The organization is generally able to continue in business so long as the mainframe is still working. But what happens if it isn’t?

I can remember many years ago, at one site I worked at, putting a tick in the box for backups for a particular application. However, as all the operators knew, the backup tapes were 7-track tapes, and the last 7-track tape drive had been removed some months beforehand. There was no way that anything could be restored. I can also remember driving backup tapes to an offsite backup site at a company on the other side of town. If there had been a disaster out of hours, can you imagine how long it would have taken to get those tapes and restore the data?

Clearly, backup strategies have improved hugely since those days back in the early 1980s. Even so, a lot of emphasis is still being put on the backing up of data, and, all too often, not enough emphasis is put on restoring the data. I’m talking about mainframe resiliency.

Mainframe resiliency is the ability of the mainframe to provide and maintain an acceptable level of service even when things go wrong! Now we know that mainframes don’t crash like they used to in the 1980s, but even so, things can go wrong.

In an ideal world, organizations would take a copy of their data at regular and frequent intervals and restore from the most recent copy in the event of a problem. That would result in only a few minutes of recent changes being lost. It would also create a massive overhead and require a huge amount of storage space. Some companies can afford a hot standby site, which is updated almost as soon as the main site’s data is changed. Should the main site go down, the standby site can take over very quickly and, hopefully, no data is lost.

Other sites take full backups once a week, and incremental backups every evening. That way, it’s possible to restore a file to its state yesterday. If journaling takes place, there will be a file that can be used to restore data almost up to just before the failure.

What I’m illustrating is that a lot of work has gone into getting backups right. What I would also suggest is that not enough attention has been spent on getting the restore part of the operation working as quickly and effectively as possible.

Let’s suppose that one application has somehow had a catastrophic failure. Let’s suppose that the DASD housing the files has died. Where can the recovery files be restored to? Exactly which backup tapes do I need to restore just those files? How quickly can I get hold of them? It’s the orchestration of the recovery operation that needs to take place in software, not in the head of someone who is out of the office that day, or printed on a piece of paper that could be missing from the backup and restore manual.

I wrote recently about Safeguarded Copy on FlashSystem arrays. It creates a security isolated copy of data that can be used in the event of the original data becoming corrupted. In fact, multiple recovery points can be created, which is great. The question is, how can you quickly decide which recovery point backup you want to restore. What software is there available that would speedily work out which recovery point is the one required and make sure that it is restored? Because, in order to speed up the restoration stage, it needs to be done by software orchestration and not trial and error of someone sitting down in front of a screen and seeing which backup is exactly the one they want. I’m not criticizing FlashSystem arrays, I’m just suggesting that the problem with speedy restores is endemic. Everyone worries about backups and they happen all the time. Not enough people are concerned about the restore process because it doesn’t happen (I’m pleased to say!) very often.

To ensure mainframe resiliency, as much effort must be put into simplifying and organizing the restore process as is put into the backup process, so that any mainframe outages last for as little time as possible and no-one – in particular paying customers – notice.

But that’s not all. What happens if nation state or criminal gang bad actors get into your mainframe? Typically, there is a period of time during which hackers raise their security level, exfiltrate useful data, overwrite backups, encrypt data, and then display a ransom demand. Mainframe resiliency also demands that there be some way to identify the early stages of a ransomware attack and stop it spreading further. It also requires that the corrupted files are restored. For this to happen, some kind of software orchestration is required to ensure that the correct (and uncorrupted) backup files are identified, and the data is restored as quickly as possible.

There’s a lot more to mainframe resilience than people might think when they are sitting comfortably after a good lunch discussing the business continuity plan!