IDUG NA 2026

This session explores a practical strategy for protecting mainframe data from ransomware by combining prevention, immutable backup design, and automated recovery. While strong identity controls and privileged-access protection remain the first line of defense, organizations also need resilient recovery options when logical corruption or credential-based attacks succeed. The presentation examines the strengths and limits of software-based and hardware-enabled immutable copies, including snapshots, safeguarded copies, and cyber vault architectures, and explains why backup frequency alone does not eliminate the risk of recovering corrupted data. It then addresses the critical recovery questions every enterprise must answer: when corruption began, which recovery point is trustworthy, and how to restore business-critical data without sacrificing post-backup transactions. The session concludes with an approach that pairs immutable storage for backups and transaction logs with automated forward recovery for Db2, IMS, and VSAM, helping organizations reduce data loss, strengthen cyber resilience, and align with growing regulatory expectations for isolated, restorable backups under frameworks such as DORA and industry guidance on resilient recovery.