Resource Access Control Facility

So what would some of those projects look like? You mentioned security side.

Is that penetration testing? Is that how to migrate to new versions of RACF, ACF2, Top Secret? Is it all of the above? What does a day in the life look like of what you're doing for your clients?

So I currently I've moved away from one client who was an insurance company and we ran a kind of security engineering service for them.

But it was more on the kind of rack F admin side.

It was it wasn't so technical, but I still oversee support for colleagues who are running that with some of our kind of newest staff.

um i've moved on to a kind of higher level uh more i guess difficult security and engineering uh service work uh with a major retailer in the uk um but then i'm also supporting uh esm migration so we've got um you know we've had previously uh uh some some uh you know for example i delivered some acf2 um to rack f training to help people understand the difference and kind of moving from one to the other but I'm now working on a kind of a table, which is like almost a cheat sheet.

And it's just, what is the equivalent command between ACF2, RACF, and TSS or top secret? Because I think it's really important that, you know, we never know in the future if someone's gonna move from RACF to ACF2, from ACF2 to TSS to TSS, and, you know, potentially in a circle.

And so we need to make sure they're equipped with the skills to know that.

That was NetMagic.

That then turned into NetMagic Pro, which was a help desk utility that went across Novell, Windows, Linux, RACF, ACF2, and it was a password resetting tool.

The front desk, so for each OS, we'd had a process that would log in and pull the user list.

And then the help desk could type in, oh, your name is Tony, T-O-N-Y.

You know, flash forward a couple of years.

It was, oh, I'm building RACF IDs and Lotus Notes IDs, you know, and again, it's still my Walgreens days.

I just, it was just like, oh, it's a security thing.

They need this ID file to be able to access this email address.

It has to be on their computer and blah, blah, blah.

Okay, what's this RACF thing? And why am I writing all these jobs? Why is it green screen? What's an AS400? Why am I doing it? I still don't like the AS400.

And unfortunately, I'm glad I don't do that.

anymore.

The word firewall didn't exist then, so we called it a relay.

And we had RACF on our mainframes and filtering routers in the network, so we were able to build coordinated access control management operating at multiple levels from the policy and user levels to the application, computer, and network levels.

This philosophy was reflected in the original BS7799 standard, but not implemented outside Shell.

It was really the equivalent of today's zero trust segmentation concept, but much more sophisticated.