Resource Access Control Facility (RACF) - Revision history

User at 19:20, 20 January 2023

2023-01-20T19:20:28Z

User at 16:08, 17 February 2021

2021-02-17T16:08:33Z

User at 16:00, 17 February 2021

2021-02-17T16:00:31Z

User at 16:00, 17 February 2021

2021-02-17T16:00:11Z

User: Created page with "'''Resource Access Control Facility''' or '''RACF''' provides the tools to manage user access to critical resources. RACF is an add-on Software|softwar..."

2021-02-17T15:59:33Z

Created page with "'''Resource Access Control Facility''' or '''RACF''' provides the tools to [[|manage user access to critical resources. RACF is an add-on Software|softwar..."

New page

'''Resource Access Control Facility''' or '''RACF''' provides the tools to [[[[Access Control||manage user access]] to critical resources. RACF is an add-on [[Software|software]] product that provides basic security for a[[Mainframe|mainframe]] system (examples of other security software packages include ACF2 and Top Secret, both from Computer Associates).

RACF protects resources by granting access only to authorized users of the protected resources. RACF retains information about users, resources, and access authorities in special structures called profiles in its database, and it refers to these profiles when deciding which users should be permitted access to protected system resources. To help your installation accomplish access control, RACF provides the ability to:
*Identify and authenticate users
*Authorize users to access protected resources
*Log and report various attempts of unauthorized access to protected resources
*Control the means of access to resources
*Allow applications to use the RACF macros
RACF uses a user ID and a system-encrypted password to perform its user identification and verification. The user ID identifies the person to the system as a RACF user. The password verifies the user's identity. Often exits are used to enforce a password policy such as a minimum length, lack of repeating characters or adjacent keyboard letters, and also the use of numerics as well as letters. Popular words such as "password" or the use of the user ID are often banned.

The other important policy is the frequency of password change. If a user ID has not been used for a long time, it may be revoked and special action is needed to use it again. When someone leaves a company, there should be a special procedure that ensures that the user IDs are deleted from the system.

RACF, with its lists of users and lists of resources, allows[[Management| management]] to delegate the authority to the owners of these entities in such a way as to maintain the separation of duties while maintaining a flexible, responsive [[Access Control|access control]] strategy.

The delegation mechanism in RACF and the easy, nontechnical commands that change the relationship of a user to a resource mean that adopting the principle of least possible privilege need not be burdensome nor inflexible when unusual circumstances dictate that access permission should be changed. When an unforeseen circumstance requires a change in access privilege, the change can be made by a nontechnical person with access to a TSO terminal, and management can be alerted to review the fact that the change was made.

Major subsystems such as CICS® and DB2® can use the facilities of RACF to protect transactions and files. Much of the work to configure RACF profiles for these subsystems is done by the CICS and DB2 system programmers. So, there is a need for people in these roles to have a useful understanding of RACF and how it relates to the software they manage.<ref>What is Resource Access Control Facility (RACF)? [https://www.ibm.com/support/knowledgecenter/zosbasics/com.ibm.zos.zsecurity/zsecc_042.htm IBM]</ref>

===References===
<references/>

@@ Line 1: / Line 1: @@
-'''Resource Access Control Facility''' or '''RACF''' provides the tools to [[Access Control|manage user access]] to critical resources. RACF is an add-on [[Software|software]] product that provides basic security for a[[Mainframe|mainframe]] system (examples of other security software packages include ACF2 and Top Secret, both from Computer Associates).
+'''Resource Access Control Facility''' or '''RACF''' provides the tools to [[Access Control|manage user access]] to critical resources. RACF is an add-on software product that provides basic security for a [[Mainframe|mainframe]] system (examples of other security software packages include ACF2 and Top Secret, both from Computer Associates).
 RACF protects resources by granting access only to authorized users of the protected resources. RACF retains information about users, resources, and access authorities in special structures called profiles in its database, and it refers to these profiles when deciding which users should be permitted access to protected system resources. To help your installation accomplish access control, RACF provides the ability to:
@@ Line 11: / Line 11: @@
 The other important policy is the frequency of password change. If a user ID has not been used for a long time, it may be revoked and special action is needed to use it again. When someone leaves a company, there should be a special procedure that ensures that the user IDs are deleted from the system.
-RACF, with its lists of users and lists of resources, allows[[Management| management]] to delegate the authority to the owners of these entities in such a way as to maintain the separation of duties while maintaining a flexible, responsive [[Access Control|access control]] strategy.
+RACF, with its lists of users and lists of resources, allows management to delegate the authority to the owners of these entities in such a way as to maintain the separation of duties while maintaining a flexible, responsive access control strategy.
 The delegation mechanism in RACF and the easy, nontechnical commands that change the relationship of a user to a resource mean that adopting the principle of least possible privilege need not be burdensome nor inflexible when unusual circumstances dictate that access permission should be changed. When an unforeseen circumstance requires a change in access privilege, the change can be made by a nontechnical person with access to a TSO terminal, and management can be alerted to review the fact that the change was made.
@@ Line 23: / Line 23: @@
 RACF establishes security policies rather than just permission records. It can set permissions for file patterns — that is, set the permissions even for files that do not yet exist. Those permissions are then used for the file (or other object) created at a later time. RACF has continuously evolved to support such modern security features as digital certificates/public key infrastructure services, LDAP interfaces, and case sensitive IDs/passwords. The latter is a reluctant concession to promote interoperability with other systems, such as Unix and Linux. The underlying zSeries (now IBM Z) hardware works closely with RACF. For example, digital certificates are protected within tamper-proof cryptographic processors. Major mainframe subsystems, especially DB2 Version 8, use RACF to provide multi-level security (MLS). Its primary competitors have been [[Access Control Facility (ACF2)|ACF2]] and TopSecret, both now produced by CA Technologies.<ref>What Does RACF Do? [https://en.wikipedia.org/wiki/Resource_Access_Control_Facility Wikipedia]</ref>
 ===References===
 <references/>

← Older revision		Revision as of 16:00, 17 February 2021
Line 1:		Line 1:
−	'''Resource Access Control Facility''' or '''RACF''' provides the tools to [[Access Control\|\|manage user access]] to critical resources. RACF is an add-on [[Software\|software]] product that provides basic security for a[[Mainframe\|mainframe]] system (examples of other security software packages include ACF2 and Top Secret, both from Computer Associates).	+	'''Resource Access Control Facility''' or '''RACF''' provides the tools to [[Access Control\|manage user access]] to critical resources. RACF is an add-on [[Software\|software]] product that provides basic security for a[[Mainframe\|mainframe]] system (examples of other security software packages include ACF2 and Top Secret, both from Computer Associates).

	RACF protects resources by granting access only to authorized users of the protected resources. RACF retains information about users, resources, and access authorities in special structures called profiles in its database, and it refers to these profiles when deciding which users should be permitted access to protected system resources. To help your installation accomplish access control, RACF provides the ability to:		RACF protects resources by granting access only to authorized users of the protected resources. RACF retains information about users, resources, and access authorities in special structures called profiles in its database, and it refers to these profiles when deciding which users should be permitted access to protected system resources. To help your installation accomplish access control, RACF provides the ability to:

← Older revision		Revision as of 16:00, 17 February 2021
Line 1:		Line 1:
−	'''Resource Access Control Facility''' or '''RACF''' provides the tools to [[[[Access Control\|\|manage user access]] to critical resources. RACF is an add-on [[Software\|software]] product that provides basic security for a[[Mainframe\|mainframe]] system (examples of other security software packages include ACF2 and Top Secret, both from Computer Associates).	+	'''Resource Access Control Facility''' or '''RACF''' provides the tools to [[Access Control\|\|manage user access]] to critical resources. RACF is an add-on [[Software\|software]] product that provides basic security for a[[Mainframe\|mainframe]] system (examples of other security software packages include ACF2 and Top Secret, both from Computer Associates).

	RACF protects resources by granting access only to authorized users of the protected resources. RACF retains information about users, resources, and access authorities in special structures called profiles in its database, and it refers to these profiles when deciding which users should be permitted access to protected system resources. To help your installation accomplish access control, RACF provides the ability to:		RACF protects resources by granting access only to authorized users of the protected resources. RACF retains information about users, resources, and access authorities in special structures called profiles in its database, and it refers to these profiles when deciding which users should be permitted access to protected system resources. To help your installation accomplish access control, RACF provides the ability to: