Planet Mainframe on LinkedIn
Planet Mainframe on LinkedIn
Planet Mainframe
Vertali Mainframe Security

Cybersecurity Trivia Challenge: Spot the Security Gap

Oct 12, 2026

Security, Trivia

Spot the Security Gap

Sonja Soderlund

Sonja Soderlund is an Oregon-based B2B freelance writer. Whether writing about mainframe computers, educational technology, or sustainable retail, she strives to bring clarity to complex issues. Connect with her or LinkedIn.

October is Cybersecurity Awareness Month, and this week’s Trivia Challenge puts you in the reviewer’s seat. Each question presents a short scenario involving mainframe data, applications or operations. Your task is to spot the security gap supported by the given information (not imagine every other thing that might go wrong). 

The situations range from everyday access decisions to the less obvious limits of encryption, audit trails, and recovery plans. No command syntax is required, but a careful reading will help: a control can work exactly as intended and still leave an important risk unaddressed. Can you identify what is missing before an attacker, an insider or an incident exposes it?

Choose the one answer best supported by each scenario.

1. The missing name
Four operators use the same privileged mainframe ID. Password changes follow policy, and every command is logged. However, there is no individual sign-in, credential checkout record or other way to link a session to a particular operator. What gap remains?

 
 
 
 

2. The helpful extra permission
A scheduled mainframe reporting job needs to read customer records and write a separate report. Its service account has those permissions, but can also modify the source customer records, although the job has no need to do so. What gap does this illustrate?

 
 
 
 

3. The encrypted connection
A support script connects to a mainframe API over a properly configured encrypted connection. The script contains a working production password, and employees without production access can read the script in the team repository. Which gap remains despite the encrypted connection?

 
 
 
 

4. The recovery copies
An organization keeps several generations of mainframe recovery copies at a separate location. Restores have been tested successfully. However, the same production administrator account can delete the live data and every retained recovery copy, with no independent deletion safeguard. What weakness is established?

 
 
 
 

5. The quiet dashboard
Mainframe security events reach a central monitoring system promptly, and the records are protected from alteration. High-risk alerts are generated, but no team is assigned to review them or investigate them. Which gap is illustrated?

 
 
 
 

6. The realistic test
Developers copy production customer records into a mainframe test environment. The copy includes real account numbers and personal details. Test access is appropriately limited to the developers, but those developers are not authorized to see the corresponding production customer information. What gap has the copy introduced?

 
 
 
 

7. The second identity
When a contractor leaves, the organization disables her everyday mainframe user ID. A separate named ID issued to her for occasional production support remains active, and its credentials still work. What gap does this establish?

 
 
 
 

8. The approved change
A mainframe application requires approval before a user can change a supplier’s payment details. Each action is logged under an individual ID. However, the person proposing the change can also provide its only approval. Which weakness remains?

 
 
 
 

9. The encrypted data set
A mainframe data set is encrypted at rest. Nevertheless, employees who have no business need for its contents have been granted sufficient permissions to open it through an application and read the decrypted records. What gap remains?

 
 
 
 

10. The successful backup
An organization protects its mainframe backups against unauthorized deletion and monitors backup jobs for failures. The jobs complete successfully, but the organization has never tested restoring the required data and restarting the application from those backups. What remains unverified?

 
 
 
 

0 Comments

Submit a Comment

Your email address will not be published. Required fields are marked *

Sign up to receive the latest mainframe information

This field is for validation purposes and should be left unchanged.

Recently Published

Read More

❓Think You Know Mainframe AI

❓Think You Know Mainframe AI

by

Mainframes have powered intelligent decisions for decades. Today, artificial intelligence (AI) takes that role further – spotting fraud as transactions happen, anticipating workload demands, helping developers understand legacy code, and strengthening system...

You Can Now Carry a Teaching Mainframe in Your Bag

You Can Now Carry a Teaching Mainframe in Your Bag

by

For years I have told mainframe security newcomers the same thing: If you want to learn how to attack and defend a system, you need to use that system. Unfortunately, z/OS is not something you spin up on a laptop over lunch or throw into your home lab. Mainframe...

Mainframe Jargon Challenge

Mainframe Jargon Challenge

by

Every technical field develops its own language, and the mainframe world is no exception. Whether we’re talking about the alphabet soup of multi-letter acronyms or terms that have been part of the platform for decades, mainframe jargon serves as a kind of shorthand...

❓Mainframes at the Movies

❓Mainframes at the Movies

by

With summer blockbuster season upon us, it’s time to turn our attention away from the workaday world of the datacenter to its fictional representation. Mainframes have made memorable appearances on both the big and small screen for decades—sometimes portrayed as...