Securing IBM MQ

Security is an important consideration for both developers of IBM MQ applications, and for system administrators configuring IBM MQ authorities.

• Security updates
  Ensure that all hardware and software inside the secure zone and on operator workstations are within their support lifecycle, have been upgraded with mandatory software updates and have had security updates promptly applied.
• Security overview
  This collection of topics introduces the IBM MQ security concepts.
• Plan for the security requirements
  This collection of topics explains what we need to consider when planning security in an IBM MQ environment.
• Set up security
  This collection of topics contains information specific to different operating systems, and to the use of clients.
• Identifying and authenticating users
  We can identify and authenticate users by using X.509 certificates, the MQCSP structure or in several types of user exit program.
• Authorizing access to objects
  This section contains information about using the object authority manager and channel exit programs to control access to objects.
• LDAP authorization
  We can use LDAP authorization to remove the need for a local user ID.
• Confidentiality of messages
  Encrypting messages ensures that the contents of messages remains confidential. There are various methods of encrypting messages in IBM MQ depending on your needs.
• Confidentiality for data at rest on IBM MQ for z/OS with data set encryption
  IBM MQ for z/OS can harden customer and configuration data by writing the data to the active log data sets, the archive log data sets, page sets, boot strap data sets (BSDS), and shared message data sets (SMDS).
• Data integrity of messages
  To maintain data integrity, we can use various types of user exit program to provide message digests or digital signatures for the messages.
• Auditing
  We can check for security intrusions, or attempted intrusions, by using event messages. We can also check the security of our system by using the IBM MQ Explorer.
• Keeping clusters secure
  Authorize or prevent queue managers joining clusters or putting messages on cluster queues. Force a queue manager to leave a cluster. Take account of some additional considerations when configuring TLS for clusters.
• Publish/subscribe security
  The components and interactions that are involved in publish/subscribe are described as an introduction to the more detailed explanations and examples that follow.
• IBM MQ Console and REST API security
  Security for the IBM MQ Console and the REST API is configured by editing the mqweb server configuration in the mqwebuser.xml file.
• Manage keys and certificates on UNIX, Linux, and Windows
  Use the runmqckm command (UNIX and Windows), and runmqakm command (UNIX, Linux, and Windows) to manage keys, certificates, and certificate requests.
• Protection of database authentication details
  If your are using user name and password authentication to connect to the database manager, we can store them in the MQ XA credentials store to avoid storing the password in plain text in the qm.ini file.
• Securing Managed File Transfer
  Directly after installation and with no modification, Managed File Transfer has a level of security that might be suitable for test or evaluation purposes in a protected environment. However, in a production environment, we must consider appropriately controlling who can start file transfer operations, who can read and write the files being transferred, and how to protect the integrity of files.
• Securing AMQP clients
  You use a range of security mechanisms to secure connections from AMQP clients and ensure data is suitably protected on the network. We can build security into your MQ Light applications. We can also use existing security features of IBM MQ with AMQP clients, in the same way that the features are used for other applications.
• Advanced Message Security
  Advanced Message Security (AMS) is a component of IBM MQ that provides a high level of protection for sensitive data flowing through the IBM MQ network, while not impacting the end applications.