Chapter 6. Security 149
Stash file information for z/OS
To use arsstash with Content Manager OnDemand for z/OS, the Integrated Cryptographic 
Service Facility (ICSF) must be available on the z/OS system to provide AES-128 encryption. 
The encryption can be performed in either software or hardware.
In the examples, a started task name of CSF is used. If CSF is not running, when you try to 
create a stash file, you get the following message, which does not identify the problem:
Verify OnDemand Password:
ARS1602E The stash file >/u/myuser/prodstash.stash< is invalid.
/usr/lpp/ars/V9R5M0/bin: >
To verify that CSF is up and running so that Content Manager OnDemand V9.5 can use it, 
use the MODIFY command against ARSSOCKD. 
On a system where ICSF is up and running, run the following command:
F ARSSOCKD,D,ICSF
ARS0438I 15.21.18 DISPLAY ICSF
CSFIQF RC=00, RSN=00000000, AES=3, FMID=HCR7780
On a system where CSF is not running, run the following command:
F ARSSOCKD,D,ICSF
ARS0438I 15.28.36 DISPLAY ICSF
CSFIQF RC=12, RSN=00000000, AES=0, FMID=N/A
6.6  Data encryption
Encrypting data is a way of providing security and protection to your Content Manager 
OnDemand data.
6.6.1  Encrypting data at rest
Depending on how the database tables and archived data are stored, you can encrypt the 
data by using either DB2 encryption or device encryption. The advantage of encrypting the 
data is to make it “unintelligible” to unauthorized access even if it is accessed (as an extreme 
example, the storage device is stolen). The cost of encrypting the data is increased processor 
consumption and slower response time. This cost varies based on the device and encryption 
methods that are used.
Backup data must always be encrypted because it is more susceptible to unauthorized 
access.
6.6.2  Encrypting data in motion: Secure communications
Transport Layer Security (TLS) and Secure Sockets Layer (SSL) allow secure communication 
between the Content Manager OnDemand server and the Content Manager OnDemand 
clients. Since Content Manager OnDemand version 8.5, support for SSL and its successor, 
TLS, is enabled for all transmissions between the Content Manager OnDemand servers and 
clients. When this section mentions SSL, the same information applies to TLS, unless 
otherwise noted.
SSL is the standard technology for creating secure connections between servers and clients. 
The secure connection allows authentication and verification, and data encryption.