Join John Pinkowski in discovering the new and not so new features available to ACF2 and Top Secret users. We will also tie a number of features to current industry requirements.

Often, auditors do not have a mainframe background and may not have an understanding of mainframe terminology, such as APF, SYS1.PARMLIB, ESM, LINKLIST, USS, etc. Where should auditors, compliance teams, and Mainframe cybersecurity teams start when auditing the mainframe? Where do STIGs (Security Technical Implementation Guides) fit into the picture? What does compliance within the mainframe environment mean? Do standards exist for auditors and compliance teams to validate for the z/OS Mainframe? What is the value for the organization to adopt mainframe cybersecurity standards? In this session, we will discuss these important questions.

Git has transformed distributed DevOps as a not-so-secret weapon for source code management (SCM) and version control. Now mainframe teams can get the same benefits-while making a seamless transition to a more streamlined DevOps lifecycle. BMC Compuware ISPW unlocks the power of Git to help mainframe organizations: "¢ Enable full support for Agile and DevOps best practices on the mainframe "¢ Leverage integrated tools from simple^ powerful code management through to deployment "¢ Onboard new mainframe developers more easily^ with lower training costs

With continually present ransomware attacks and security threats, a data-centric approach to privacy and security is integral to building a zero-trust environment. As data moves, it's essential to make sure the weakest link is protected by maintaining control of data throughout its lifecycle. This session will cover best practices for data-centric protection and how to achieve a zero-trust environment.

Want a z/OS instance for rapid dev/test cycles, or agile function delivery ahead of deploying for end to end integration testing? In this session you'll learn how to achieve this as a user, using Wazi-aaS in IBM Cloud: how to set up an IBM Cloud account ; how to create a virtual private cloud and secure the resources inside it; and how to create and connect to a z/OS instance.

Encryption is the solid foundation of a layered cybersecurity strategy. One of the challenges to a successful implementation and deployment of pervasive encryption is the number of groups and roles that have to be involved from the early planning stages to develop the appropriate policies and procedures. The speaker will leverage their experience of engaging with many clients as they started their pervasive encryption journey with z/OS data set encryption and provide best practices for planning and implementing pervasive encryption.

You've implemented Pervasive Encryption. Woohoo! You know the encryption pyramid and understand the tradeoffs between storage level encryption, file and dataset level encryption, database encryption and application level encryption. Very nice! How do you verify that you have configured your system to use your intended crypto engines? How do you determine if there are old applications using vulnerable algorithms or weak bit lengths? How do you show your auditor that your PCI workloads are using strong cryptography? With IBM z16, IBM provides processor activity instrumentation to count cryptographic operations. SMF 30 records have been enhanced to include new crypto counter sections that contain counters for CPACF cryptographic instructions utilized by a job in a given period. Join this session for a demo and discussion of ways to use this data to aid in compliance, performance, and configuration.

This session will discuss the next step in DevOps, moving to DevSecOps and scaling to the enterprise to support the needs for continuous compliance while reducing the workload for the individual product teams. Learn how we are building an internal Developer Experience team, that supports all platforms for the Hybrid Cloud including z/OS development and the model we are using to bring more consistency, better experience and reduced duplication of effort.

This session will discuss the transformation for DevSecOps for the IBM CIO internal systems to bring z/OS into the standard process and practices and pipelines used. This will discuss the steps to bring a common way of working across all teams and provide a core developer experience as a platform perspective.

The end-to-end DevOps pipeline is composed of several major phases representing the application lifecycle, from the Coding stage to the Monitoring stage. It combines the best practices and toolset for development and operations, to speed up the delivery lifecycle while enhancing the quality of applications and reducing risks of failures. In this session, we'll demonstrate an implementation of this pipeline with a Mainframe application and including a wide variety of products integrated and complementing one another to create an automated CI/CD pipeline.