Privileged Access Management for z/OS System Programmers: A Zero-Trust Control Framework for RACF, TSO, and SDSF Administrative Sessions

Abstract

The PAM in z/OS systems needs additional measures in the realm of protecting sensitive data from misuse by insiders and credential abuse. Classic approaches using authentication through static mechanisms do not provide adequate protection of administrative sessions that use RACF, TSO, and SDSF, thus leaving systems open to risks associated with administrative activities. To combat these risks, this paper proposes implementing a new control approach for PAM known as the Zero-Trust Control Framework, based on behavioural analysis, graph theory, and entropy calculations. The new tool developed as part of this framework is called Behavioural Identity Drift Analyzer (BIDA). As such, the Privilege Interaction Graph Transformer (PIGT) leverages graph neural networks and transformers to generate privilege interaction graphs that detect the escalation routes, dependencies, and propagation vectors of insider threats in near real-time. Lastly, the Entropy Adaptive Zero-Trust Orchestrator (EAZTO) analyzes uncertainties in user actions, commands, and privileges in order to apply adaptive control measures such as multi-factor authentication, privilege reduction, or even session termination. In combination, these four modules provide layers of protection and achieve continuous PAM decision-making at 90 percent accuracy for the purpose of enhancing zero trust enforcement in z/OS administration.