DB2 UDB for z/OS Version 8 Performance Topics - IBM Redbooks

4.8.3 Recommendations
For both DB2 encryption and the IBM Data Encryption Tool, we recommend you move to the
current z990 or z890 hardware, where the hardware-assisted encryption instructions are
available on all processors.
The IBM Encryption Tool (row level) performs generally better than the DB2 encryption and
decryption (column level). The break
even point varies depending on how many other columns are in the table and their size.
However, performance is not the only reason to choose one encryption strategy over the
other, as they also vary in function.
Encryption is done before compression, so compression and encryption cannot be effectively
combined. Encrypted data does not tend to compress very well because repeating
unencrypted characters are no longer repeating after they are encrypted.
Important: Be aware that if you plan to use DRDA encryption, you need the PCIXCC
function on your z990, because the hardware requires it.
4.9 Row level security
DB2 recognized the need for more granular security of DB2 data and introduced support for
Row Level Security in V8. Multilevel security support in z/OS 1.5 and RACF Security Server
1.5, in conjunction with DB2 V8, simplify row level security implementation and management
significantly.
In this section we first introduce Row Level Security, then describe the performance impact of
Row Level security on DB2 workloads.
Security is becoming increasingly important in the past few years. Row level access control is
increasingly critical. Many customers need to extend the granularity from table level to row
level, so that an individual user is restricted to a specific set of rows. Good examples are Web
hosting companies that need to store data from multiple customers into a single subsystem,
database or table.
In the past, views have been used to hide data. They can subselect data to provide only
certain columns or fields. By creating a view and granting privileges on it, you can give
someone access to only a specific combination of data. However, the application tends to
become much more complex when views are used in this way. Separating the data into
different databases or base tables has also been used to provide more granular security.
DB2 recognizes this need and introduces support for Row Level Security in V8. Multilevel
security (MLS) support in z/OS 1.5 and RACF Security Server 1.5, in conjunction with DB2
V8, simplify row level security implementation and management significantly.
Multilevel security is a security policy that allows the classification of data and users based on
a system of hierarchical security levels, combined with a system of non-hierarchical security
categories. A multilevel-secure security policy prevents unauthorized individuals from
accessing information at a higher classification than their authorization (read-up), and
prevents individuals from declassifying information (write-down).
You can use MLS for multiple purposes in DB2:
Chapter 4. DB2 subsystem performance 191