Confidentiality

The confidentiality service protects sensitive information from unauthorized disclosure.

When sensitive data is stored locally, access control mechanisms might be sufficient to protect it on the assumption that the data cannot be read if it cannot be accessed. If a greater level of security is required, the data can be encrypted.

Encrypt sensitive data when it is transmitted over a communications network, especially over an insecure network such as the Internet. In a networking environment, access control mechanisms are not effective against attempts to intercept the data, such as wiretapping.

Confidentiality in IBM MQ

You can implement confidentiality in IBM® MQ by encrypting messages.

Confidentiality can be ensured in an IBM MQ environment as follows:

After a sending MCA gets a message from a transmission queue, IBM MQ uses TLS to encrypt the message before it is sent over the network to the receiving MCA. At the other end of the channel, the message is decrypted before the receiving MCA puts it on its destination queue.
While messages are stored on a local queue, the access control mechanisms provided by IBM MQ might be considered sufficient to protect their contents against unauthorized disclosure. However, for a greater level of security, you can use Advanced Message Security to encrypt the messages stored in the queues.
Messages stored on local queues can be encrypted at rest using z/OS® data set encryption.
See the section, confidentiality for data at rest on IBM MQ for z/OS with data set encryption. for more information.