Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite

I want to store SSH keys (used to connect to some devices that have sensitive data) and the encryption/decryption keys of a database application. They will be inside a LPAR (logical partition) in our mainframe.

I'm worried about security: does the fact that LPAR resides in the same machine (same hardware) as other virtual serves implies that there is some security risk ? Could an app running on a different virtual server get access to my server and read my keys ?

share|improve this question
1  
Can you update your question with some context? What are you protecting? – Rory Alsop♦ Mar 9 '12 at 7:16
1) SSH keys for SFTP connection keys 2) Keys used for password encryption/decyrption – wxyz Mar 9 '12 at 9:58
Sorry - what I meant was what information or assets are you protecting? What is their value? Are they credit card or personal sensitive data, or military secrets etc... – Rory Alsop♦ Mar 9 '12 at 10:15
1) SSH keys used for connecting to internal devices holding sensitive data 2)Encryption/decyrption keys for database credentials(stored at application server) – wxyz Mar 9 '12 at 10:22

1 Answer

up vote 2 down vote

For such small question, a small answer: even wikipedia is your friend:

IBM mainframe LPARs are Common Criteria EAL5 certifiable, equivalent to physically unconnected servers, so they support the highest security requirements, including military use.

And it also points to some docs from ibm: this link, for example can give you a lot of information.

share|improve this answer
The problem with IBM's statement is it only applies to correctly configured LPARs under a subset of use cases. We have successfully retrieved data from LPARs due to slight misconfigurations, re-use of passwords and other techniques, so while EAL5 is a possible, do not assume anything... – Rory Alsop♦ Mar 9 '12 at 14:04
@RoryAlsop : I agree with you, and I wouldn't trust to use anything without a proper configuration, training, consulting... well, that applies to almost everything about security. But it was a very small question, without that much context, and LPAR can be secure if properly used – woliveirajr Mar 9 '12 at 14:36
Absolutely - you got an upvote from me anyway :-) – Rory Alsop♦ Mar 9 '12 at 14:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.