IBM has unveiled the IBM Z, a next generation transaction system capable of running more than 12 billion encrypted transactions per day and making it possible to encrypt data associated with any application, cloud service or database all the time.
IBM Z’s new data encryption capabilities are designed to address the global epidemic of data breaches, a major factor in the $8 trillion cybercrime impact on the global economy by 2022 Of the more than nine billion data records lost or stolen since 2013, only four percent were encrypted, making the majority of such data vulnerable to organized cybercrime rings, state actors and employees misusing access to sensitive information.
In the most significant re-positioning of mainframe technology in more than a decade, when the platform embraced Linux and open source software, IBM Z now dramatically expands the protective cryptographic umbrella of the world’s most advanced encryption technology and key protection. The system’s advanced cryptographic capability now extends across any data, networks, external devices or entire applications – such as the IBM Cloud Blockchain service – with no application changes and no impact on business service level agreements.
“The vast majority of stolen or leaked data today is in the open and easy to use because encryption has been very difficult and expensive to do at scale,” said Ross Mauri, General Manager, IBM Z. “We have created a data protection engine for the cloud era to have a significant and immediate impact on global data security.”
Technology Breakthrough: Industry-First Pervasive Encryption for the Cloud Era
A recent study found that extensive use of encryption is a top factor in reducing the business impact and cost of a data breach. To put that in context, the IBM X-Force Threat Intelligence Index reported that more than four billion records were leaked in 2016 (a 556 percent increase from 2015).
However, encryption is often largely absent in corporate and cloud data centers because current solutions for data encryption in x86 environments can dramatically degrade performance (and thus user experience), and can be too complex and expensive to manage. As a result, only about two percent of corporate data is encrypted today, while more than 80 percent of mobile device data is encrypted.
IBM Z pervasive encryption reflects a call to action on data protection articulated by Chief Information Security Officers and data security experts worldwide, and more than 150 IBM clients around the world who participated and provided feedback in IBM Z’s system design over three years.
As a result of this collaboration, IBM Z brings significant advances in cryptography technology, building on a proven encryption platform that safeguards the world’s banking, healthcare, government and retail systems. IBM Z pervasive encryption delivers breakthroughs including:
· Pervasive encryption of data – all the time. IBM Z makes it possible, for the first time, for organizations to pervasively encrypt data associated with an entire application, cloud service or database in flight or at rest with one click. The standard practice today is to encrypt small chunks of data at a time, and invest significant labor to select and manage individual fields. This bulk encryption at cloud scale is made possible by a massive 7x increase in cryptographic performance over the previous generation z13 – driven by a 4x increase in silicon dedicated to cryptographic algorithms. This is 18x faster compared to x86 systems (that today only focus on limited slices of data) and at just five percent of the cost compared to x86-based solutions.
· Tamper-responding encryption keys. A top concern for organizations is protection of encryption keys. In large organizations, hackers often target encryption keys, which are routinely exposed in memory as they are used. Only IBM Z can protect millions of keys (as well as the process of accessing, generating and recycling them) in “tamper responding” hardware that causes keys to be invalidated at any sign of intrusion and can then be reconstituted in safety. The IBM Z key management system is designed to meet Federal Information Processing Standards (FIPS) Level 4 standards, where the norm for high security in the industry is Level 2. This IBM Z capability can be extended beyond the mainframe to other devices, such as storage systems and servers in the cloud. In addition, IBM Secure Service Container protects against insider threats from contractors and privileged users, provides automatic encryption of data and code in-flight and at-rest, and tamper-resistance during installation and runtime.
· Encrypted APIs. IBM z/OS Connect technologies can make it easy for cloud developers to discover and call any IBM Z application or data from a cloud service, or for IBM Z developers to call any cloud service. IBM Z now allows organizations to encrypt these APIs – the digital glue that links services, applications and systems – nearly 3x faster compared to alternatives based on x86 systems.
“The pervasive encryption that is built into, and is designed to extend beyond, the new IBM Z really makes this the first system with an all-encompassing solution to the security threats and breaches we’ve been witnessing in the past 24 months,” said Peter Rutten, analyst at IDC’s Servers and Compute Platforms Group.
IBM Z, deeply integrated with IBM Security software, automates and dramatically streamline security and compliance processes. For example, auditors are expected to manually inspect and validate the security of databases, applications and systems. Organizations can now immediately demonstrate that data within of scope of compliance is protected and the keys are secure. This can significantly reduce the mounting complexity and cost of compliance for auditors. The system also provides an audit trail showing if and when permissioned insiders accessed data.
New: Predictable and Transparent Container Pricing
IBM also announced three groundbreaking new Container Pricing models for IBM Z, providing clients greatly simplified software pricing that combines flexible deployment with competitive economics vs. public clouds and on-premises x86 environments:
· New microservices and applications that enable clients to maximize the value from security-rich on-premises enterprise systems in real time. Clients can now co-locate applications to optimize qualities of services that are priced competitively with public cloud and on-premises platforms.
• Application development and test with the freedom to triple capacity of all development environments on z/OS to support latest DevOps tooling and processes. Clients can triple capacity with no increase in monthly license charge.
• Payment systems pricing based on the business metric of payments volume a bank processes, not the available capacity. This gives clients much greater flexibility to innovate affordably in a competitive environment, particularly in the fast-growing Instant Payment segment.
These precedent-setting Container Pricing options are designed to give clients the predictability and transparency they require for their business. The pricing models are scalable both within and across logical partitions (LPARs) and deliver greatly enhanced metering, capping and billing capabilities. Container Pricing for IBM Z is planned to be available by year-end 2017 and enabled in z/OS V2.2 and z/OS V2.3.
The Most Powerful Transaction System for the Cloud Era
IBM Z builds on the capabilities of the world’s most powerful transaction engine at the center of global commerce today supporting:
· 87 percent of all credit card transactions and nearly $8 trillion payments a year.
· 29 billion ATM transactions each year, worth nearly $5 billion per day.
· Four billion passenger flights each year.
· More than 30 billion transactions per day – more than the number of Google searches every day.
· 68 percent of the world’s production workloads at only six percent of the total IT cost.
Banks and others in the financial services industry process thousands of transactions per second to keep the world’s financial systems running. The mainframe is more critical than ever for reliably handling high volumes of transaction data.
Ninety-two of the world’s top 100 banks rely on the IBM mainframe because of its ability to efficiently process huge volumes of transactions. To help financial services organizations more effectively compete in the cloud era, enormous amounts of sensitive data produced by transactions can now be better protected against fraud and cybercrime, analyzed, and monetized using IBM Z – without causing disruption of day-to-day operations. For banks, this means encryption at the click of a button — even while applications are running — and the ability to migrate data from unencrypted to encrypted with no impact to service level agreements.
The IBM Z, the next generation of IBM’s industry-leading CMOS mainframe technology, features the industry’s fastest microprocessor, running at 5.2GHz, and a new scalable system structure that delivers up to a 35 percent capacity increase for traditional workloads and up to a 35 percent capacity increase for Linux workloads compared to the previous generation IBM z13. The system can support:
· More than 12 billion encrypted transactions per day on a single system.
· The world’s largest MongoDB instance with 2.5x faster NodeJS performance than x86-based platforms.
· Two million Docker Containers.
· 1,000 concurrent NoSQL databases.
Other new capabilities announced today include:
· Three times the memory of the z13 for faster response times, greater throughput and accelerated analytics performance. With 32TB of memory, IBM Z offers one of the largest memory footprints in the industry.
· Three times faster I/O and accelerated transaction processing compared to the z13 to drive growth in data, transaction throughput and lower response time.
· The ability to run Java workloads 50 percent faster than x86 alternatives.
· Industry-leading Storage Area Network response time with zHyperLink, delivering 10x latency reduction compared to the z13 and cutting application response time in half – enabling businesses to do much more work such as real-time analytics or interact with Internet of Things (IoT) devices and cloud applications within the same transaction, without changing a single line of application code..
As part of today’s announcement, IBM also previewed new z/OS software that provides foundational capabilities for private cloud service delivery, enabling a transformation from an IT cost center to a value-generating service provider. When available, these capabilities will include the support of workflow extensions for IBM Cloud Provisioning and Management for z/OS and real-time SMF analytics infrastructure support.
IBM Global Financing can help credit-qualified clients acquire the new IBM Z, lower their total cost of ownership, and accelerate return on investment. IBM Global Financing offerings for IBM mainframe solutions are available from IBM and IBM Business Partners, and provide flexible terms and conditions that can be customized to align cost to project benefits or other client needs.
Cybercrooks eye smart buildings
In countries like the United States, the growth of smart buildings is estimated to reach 16.6% by 2020 compared to 2014, although this expansion is not limited to the US but rather is taking place on a global scale. This growth is largely due to the fact we live in a world increasingly permeated by technology, in which process automation and the search for energy efficiency contribute not only to sustainability, but also to cost reduction – a goal pursued in all industries, public and private alike. Naturally, the construction industry is no exception, says Carey van Vlaanderen, CEO at ESET South Africa.
Smart buildings use technology to control a wide range of variables within their respective environments with the aim of providing more comfort and contributing to the health and productivity of the people inside them. To do so, they use so-called Building Automation Systems (BAS). With the arrival of the Internet of Things (IoT), smart buildings have redefined themselves. With the information they obtain from smart sensors, their technological equipment is used to analyse, predict, diagnose and maintain the various environments within them, as well as to automate processes and monitor numerous operational variables in real time. Ambient temperature, lighting, security cameras, elevators, parking and water management are just some of the automatable services currently supported by the technology.
To put the possibilities of this smart infrastructure into perspective, is the example of a smart building in Las Vegas where, two years ago, they decided to install a sophisticated automation system to control the use of the air conditioning (keeping in mind Las Vegas has a hot desert climate and very little rain), so it is turned on only when there are people present. This decision led to a saving of US$2 million during the first year after the smart system was installed, due to the reduction in energy consumption achieved by automating the process. Marriott Hotels implemented a similar system across the entire chain that is expected to generate an estimated US$9.9 million in energy savings.
Another example of automation through smart devices is that of a supermarket in the United Kingdom. The store installed a smart system in its parking lot that generates a kinetic energy from the movement of cars passing through it, and then uses that energy to power the checkouts.
At first glance, we may not see any security risk in these smart buildings. It is likely, however, that at some point the entire smart network is connected to a single database, and that is where the risk is. Particularly if we consider that many IoT devices are manufactured by different suppliers, who may not have paid due attention to security considerations during their design and manufacturing process.
Possibility of a smart building being attacked
The risk of a security incident taking place in an intelligent building is linked to the motivations of cybercriminals, who mainly seek to achieve economic gain through their actions, as well as to impact and spread fear.
There are already some tools such as Shodan that allow anybody to discover vulnerable and/or unsecured IoT devices connected publicly to the internet. If you run a search using the tool, you can find thousands of building automation systems in its lists, complete with information that could be used by an attacker to compromise a device. In February 2019, around 35,000 building automation systems worldwide appeared in Shodan within public reach via the internet.
This means that someone could take control of a BAS after finding it through a search. If, for example, a criminal used Shodan for building automation systems to attack, they will find IP addresses. If they copy those IP addresses into the address bar of a web browser, in many cases this will bring up an interface for gaining access, where they need to enter a username and password. If the password is a default password of if it can be cracked easily through a brute force attack, the attacker will gain access to the system monitoring panel, which contains information similar to the companies located in the smart building.
Once the attackers have access to this public information and can monitor, for example, how the air conditioning works, they could make a phone call pretending to be from the maintenance company and say they are going to send a technician. At the same time, the attackers could request remote access, which would give them access to the server and allow them to control the building. Once they have control, they could alter the building’s heating or air conditioning or adjust the way any of the other automated systems operate and then demand payment of a ransom in using a system that allow them to remain anonymous, such as cryptocurrency, in exchange for not shutting the building down.
Siegeware: a very real threat
Cybercriminals are already carrying out such attacks when they have the opportunity. This kind of attack is siegeware, or “the code-enabled ability to make a credible extortion demand based on digitally impaired building functionality”
In conclusion, the low cost of IoT devices for buildings and the advances of technology for building automation systems is leading to changes with an impact on security. This drive toward automation and the use of smart devices to gather data – in order to give a building’s users more comfort and to make more efficient use of resources such as energy – is also leading to increased security risks. As a result, the possibility of a cybercriminal launching a ransomware attack on asmart building is already a reality.
Considerations to keep in mind
There are a number of security considerations and requirements to keep in mind:
- Review the devices’ security specifications and work on the basis of the ‘security by design’ concept
- Set a suitable budget for security
- Choose partners that have knowledge of security issues
- Install software for managing vulnerabilities
- Ensure cooperation between the different areas and/or departments
For operational issues:
- Update the devices regularly
- Implement a replacement plan for when devices’ support life cycles end
- Exercise a precaution in respect of connected devices
- Monitor connected devices
How we can break out of the productivity/technology trap
The tyre industry is a microcosm of the dilemma in which South African manufacturers find themselves, writes JACQUES RIKHOTSO, MD at Bridgestone
Many of South Africa’s industries have been built on the back of abundant cheap labour. Mining is the obvious example, but the manufacturing sector has also been shaped by thefact of cheap labour. For many years, cheap labour was arguably a huge advantage, enabling us to become a world-leading mining country and also to create significant agricultural and manufacturing capabilities. But, in the end, it has had the unintended consequence stifling investment in equipment and masking a skills deficit that will be very hard to overcome.
To understand the dynamics, it’s as well to begin by reminding ourselves that productivity is, at the crudest level, the relationship between output and input. Humans are still the most important input contributors, and so labour costs are a significant factor in the productivityequation.
In South Africa and other developing economies, labour costs are low whereas in thedeveloped world, they are high. South African manufacturers (and miners and farmers) have thus typically used more people to produce the same amount of units than a European or American manufacturer would do, while still managing to compete on price and often on quality. However, the much more expensive labour costs in the developed world, while causing short-term pain, have always meant that the business case for investing in the latest technology to make those expensive humans even more productive has always been strong.
By contrast, the business case for investing in up-to-date equipment has been weak in South Africa. If more output was required, more people was typically a cheaper answer than better equipment. We have therefore remained a fairly labour-intensive market, which is good given our unemployment issues, but raises two specific and daunting challenges:
We need to make major investments in equipment. In my industry, I would venture to say we are 15-20 years behind developed countries when it comes to the deployment ofequipment. This was not too much of a problem for a long while because the old equipment was still cost-effective and could turn out the products needed at the right quality and price. However, tyre technology has now moved on to such an extent that the old machines simply are not capable of producing the new generation of products. Radiallised Agricultural/Underground Mining Sector Tyres and light weighted tyres for electric cars, for example, represent significant advances in tyre design. Current machinery cannot be adapted to produce either them; a substantial investment in new equipment will be necessary.
Another factor is that the industry dynamics have changed over the past few years. Theadvent of cheap, mass-produced tyres from the Far East means that in many instances, fleet owners are not retreading existing tyres but rather purchasing these cheap ones new. To compete, local tyre manufacturers need to move upwards on the Technology Cost Curve by investing in technology is less electricity-intensive, deploys minimum labour and requires maintenance in order to compete with high-volume producers.
The other consequence of competing with lower cost producers is the need to write down older retreading capacity and invest in more modern equipment.
Because our investment in equipment has been so low for so long, we are not talking about incremental investment but something much more significant in many areas at once.
This massive new wave of investment will not be restricted to manufacturing equipment. High-tech data-driven modern equipment associated with the Fourth Industrial Revolution will also require factory layouts to be revamped in order to accommodate new IT infrastructure and robotic capacity, as is already being used in the developed world.
This is essential if we are able to compete in the longer term.
We need to make major investments in skills, both at the corporate and national levels. Investments in new technology will create a need for a new generation of skilled operators. The new machines require totally different skills—hard-won dexterity with gears and levers is making way for skills on touchscreens, the ability to type and, crucially, to read and action screen-based instructions quickly. Sadly, many of the cadre of experienced operators will not be able to reskill and companies will need to give serious thought to their future.
However, in Bridgestone’s experience, the younger generation of operators often has thepotential for reskilling on modern machines, and we are already busy with that process.
Being part of a global group is a massive advantage, because our regions are all at different stages of industrial development, and some have undertaken a similar journey into the modern era. Our Japanese factories, in particular are industry leaders in tyre manufacture. We can therefore rely on previous experience and, most important of all, cansend key employees to acquire the necessary training and experience at one of our sister facilities. Such a person can then be used as a champion within the company, to train colleagues and promote new ways of working. In our experience, such an approach does work, but it takes time and effort.
South Africa’s status as a manufacturing country has been in the balance for some years thanks to our lack of investment in new technology, but there is no doubt that a strong manufacturing sector is critical in rebuilding in the economy. To re-ignite our manufacturing, we have to escape the technology/ production trap.