IDUG NA 2026

This session will cover the new features in Db2 12.1 security, covering 12.1.3, 12.1.4 and 12.1.5. Attend to hear about new auditing capabilities, including audit to cloud object storage, and directly to CSV files. You will also learn about new JWT authentication enhancements features online key retrieval. 12.1.5 sees the completion of the reduce file permission feature started in 12.1.2 that really locks down a Db2 instance. You will also hear about new Quantum Safe Crypto support in TLS.

Are you, and all of your sub-systems, ready for Db2 vNext that is coming to an enterprise near you soon? Are you aware that you cannot even get to Db2 13 FL511 if you have any of the specially announced “deprecated” items that we all have hanging around? Do you have a plan to get you out of this mess?
This session explains how you can find all the migration blockers that exist in your system and how to fix nearly all of them as well. It will also delve into VTAM/SNA and workfile usage to round off everything that can bite you!

Security is often treated as an afterthought—apps launched without proper controls, cloud environments spun up outside organizational standards, third-party vendors granted excessive access to sensitive data. These missteps vary in form, but they all share a common denominator: data. And for attackers, data is the only thing that truly matters.
Regardless of how strong your perimeter defenses are, once an attacker gets inside, your ability to detect and respond quickly becomes critical. That’s where Guardium Database Activity Monitoring (DAM) comes in. DAM helps organizations understand what “normal” looks like—enabling real-time detection of anomalies, suspicious behavior, and potential breaches before serious damage is done.
In this session, we’ll explore how implementing IBM Guardium can reduce risk, improve incident response, and stop data leaks before they happen. Because when everything else can be bypassed, your best defense is knowing your data patterns.
Key scenarios we’ll examine include:- Privilege escalation and misuse- High-volume data extraction- Cross-site scripting (XSS) via database inputs- OS command injection through vulnerable queries- Abuse of privileged accounts- Unauthorized access to restricted or sensitive data- Password spraying and brute-force attempts- Anomalous behavior outside of baseline operations- Change reconciliation failures (e.g., Guard App event correlation)
For each use case, we’ll analyze:- What the attack looks like in terms of raw database activity- How DAM tools can be tuned to detect these patterns- Alerting and response workflows for containment and remediation

This session is a deep dive into 3 new Db2 12.1 security features, Reduce file permissions, RCAC mask at read enhancements, and defining a Trusted Context using the new trust procedure and client callbacks. This will be a face paced session offering practical details on how to make use of these new features in more depth than a what's new session can cover. Reduced file permissions address the common concern of everyone having access to the db2diag.log (and others). Mask at read offers an alternative masking behaviour with fundamental changes to SQL behaviour. And Trust Procedures allow custom definitions of trust for determining a trusted connection.

Generating digital certificates while installing a product like DB2 and related products on z/OS frequently involves intricate hurdles, where minor errors lead to postponed rollouts, service interruptions, and heavy manual workloads. This session breaks down the core principles of certificates while offering actionable techniques and proven methods to refine your workflow. Furthermore, we will debut an innovative utility engineered to simplify the baseline certificate configuration during mainframe software deployment, minimizing technical friction and fast-tracking your path to production.

As enterprise security threats evolve, Multi-Factor Authentication (MFA) has become essential for safeguarding access to mission-critical systems like Db2 for z/OS. This session provides an inside look at a day in the life of a Db2 for z/OS administrator navigating an MFA-enabled environment. From securely logging in and managing authentication challenges to executing routine database tasks with enhanced security controls, we’ll examine how MFA impacts daily workflows, troubleshooting, and compliance requirements. Attendees will gain practical insights into best practices, potential challenges, and strategies for balancing security with productivity. Additionally, we’ll explore a range of access methods, from traditional TSO to modern tools like Db2 for z/OS Administration Foundation, SQL Tuning Services, and the Db2 for z/OS Developer Extension for VS Code.

Are you challenged with tasks having to provide audit reports detailing who has access to which objects and who has which privileges – even worse, who had access 3 months ago ?Many Db2 sites are using a log tool to accomplish these tasks – but are you aware of the relatively new capabilities in Db2 dealing with security information stored in the catalog ?We will dive into what Db2 has to offer natively and how you can handle regulatory requirements in an easier way augmenting your current processes.

As Transport Layer Security (TLS) becomes mandatory across enterprise environments, Db2 professionals increasingly play a pivotal role in protecting data in transit—both on the client and server sides. While this session briefly reviews core TLS fundamentals such as trust models and server authentication, its primary focus is on mutual (client) certificate authentication for Db2 for z/OS. Attendees will be guided through the complete configuration workflow, including certificate management, RACF keyring setup, AT TLS policies, DDF configuration, and identity mapping for client certificates.

Db2 Z and the CIA is a powerful informational combination. To be clear, the CIA is the Compliance Information Analysis product available for free to many users of Db2 Z (if you have Broadcom products). Broadcom introduced the CIA as a subproduct of ACF2. It is now an independent product available to most users of their products. The CIA provides a series of Db2 tables that can contain all the information from your external-security-manager (ESM), whether it is ACF2, RACF, or TopSecret. Once your ESM is loaded into the CIA, it is relatively more accessible to the curious end-user! SQL SELECT can be used to easily build interesting and useful and focused reports about your security configuration. This presentation will go over the basics of mainframe security and the basics of the CIA and how to build and populate. Finally, interesting CIA tables and views (and sample SELECTs) will be highlighted to show why it is useful.