ICSF
Integrated Cryptographic Service Facility: the part of z/OS that gives programs access to the mainframe's encryption hardware and keys.
Also written Integrated Cryptographic Service Facility, Crypto Express, CPACF, CKDS, PKDS, hardware security module
ICSF, the Integrated Cryptographic Service Facility, is how z/OS programs use encryption. It provides services for encrypting and decrypting data, creating and checking digital signatures, generating random numbers and managing keys, and it uses the mainframe's cryptographic hardware to do them.
There are two kinds of hardware. CPACF is built into every processor and does fast encryption. Crypto Express cards are hardware security modules: tamper-resistant cards that keep the most important keys protected, so that even someone with full access to the system cannot read them. Banks rely on them for things like PIN checking for card payments.
ICSF keeps keys in its own datasets, such as the CKDS for symmetric keys and the PKDS for public key pairs. Access to keys and services is controlled by RACF, through classes such as CSFKEYS and CSFSERV.
ICSF runs as a started task and is looked after by security and system programmers. If it is not running, anything that needs encryption, including encrypted datasets and many secure connections, can stop working.
Where can I learn this hands-on?
Right here, at ZedBank. You take a junior job at a simulated bank and learn each part of the work by doing it, with Zed beside you. There's nothing to install.
Start at ZedBankRelated
- Dataset encryptionA z/OS feature that encrypts a dataset's contents automatically, so only users allowed to use its key can read the data.
- Digital certificateA file that proves the identity of a server or user for encrypted connections; on z/OS, RACF stores them and groups them in key rings.
- RACFThe security manager for z/OS, which decides who may sign on, read a dataset, or run a transaction.
- IBM ZIBM's current family of mainframe hardware, and the brand name you will see on most modern mainframe job adverts.
- Started taskA long-running program that the system starts and leaves running, rather than a job that runs once and finishes.