EXSM - External Security Module
An External Security Module (EXSM) is a specialized program module on z/OS that provides an interface between an application or system component and an External Security Manager (ESM) product, such as IBM RACF, CA ACF2, or Broadcom Top Secret. Its primary purpose is to enable these components to request security services, like user authentication and resource authorization, from the ESM.
Key Characteristics
-
- Interface to ESM: Acts as a bridge, translating security requests from applications into calls understood by the specific ESM product.
- Standardized Access: Often invoked via the
System Authorization Facility (SAF)interface, providing a consistent way for z/OS components to request security services. - Product-Specific: An EXSM is typically tailored to a particular ESM (e.g., a RACF EXSM, an ACF2 EXSM), handling the nuances of that product's security database and APIs.
- Resource Protection: Enforces access control over various mainframe resources, including datasets, programs, transactions, terminals, and system commands.
- Performance-Critical: Designed for high-volume, low-latency security checks, crucial for interactive subsystems like CICS and IMS.
- Customizable: While many EXSMs are provided by vendors, organizations can also develop custom EXSMs to implement unique security requirements or integrate with non-standard security solutions.
Use Cases
-
- CICS Transaction Security: CICS uses an EXSM to validate user authorization for executing specific transactions, accessing CICS programs, or utilizing CICS resources like files and queues.
- IMS Command and Transaction Security: IMS leverages an EXSM to authorize users to issue IMS commands or execute IMS transactions.
- DB2 Connection and Object Security: While DB2 has its own internal security, it often integrates with an ESM via an EXSM to authenticate users connecting to DB2 and to authorize access to DB2 objects like tables and views.
- Custom Application Authorization: A homegrown z/OS application can use an EXSM to perform user authentication, verify group membership, or check resource access permissions against the ESM.
- System-Level Component Security: Various z/OS system components, such as
JES(Job Entry Subsystem) orTSO/E(Time Sharing Option/Extensions), utilize EXSMs for functions like job submission authorization or dataset access control.
Related Concepts
The EXSM is a crucial component in the z/OS security architecture, sitting between applications and the actual External Security Manager (ESM) product (like RACF). It typically receives requests via the System Authorization Facility (SAF) interface, which is the standard z/OS mechanism for requesting security services. The EXSM translates these SAF calls into specific API calls or database lookups against the ESM's security profiles, thus enforcing the application security policies defined within the ESM.
- Least Privilege: Configure EXSMs and their associated ESM rules to grant only the minimum necessary access required for an application or user to perform its function.
- Performance Optimization: Regularly review and optimize ESM rules and EXSM configurations to minimize overhead, especially for high-volume transactions, potentially using in-memory caching where appropriate.
- Auditing and Logging: Ensure the EXSM is configured to pass relevant security events to the ESM for logging, enabling comprehensive auditing and compliance reporting.
- Regular Review of Rules: Periodically audit the security rules and profiles that the EXSM enforces to ensure they remain current, accurate, and aligned with security policies.
- Robust Error Handling: Implement thorough error handling within custom EXSMs to gracefully manage scenarios where the ESM is unavailable or returns unexpected results, potentially logging failures and providing fallback mechanisms.