I have always been amazed at the menagerie of security features that IBM has placed on the AS/400. It’s like having an army of well-trained guard dogs watching over your data. Eight years ago, I moved from a S/36 shop to a site with an old AS/400 Model B10. I was immediately impressed by its security levels and object authorities. An administrator could restrict users to certain things on the system. For instance, users could be restricted from looking at certain data, such as payroll. Cool!
After studying some of these security features, I was lucky enough to attend COMMON. I listened to Wayne O. Evans, the father of AS/400 security and frequent contributor to Midrange Computing. When I learned more about the intricacies and features of security on the AS/400, I was even more amazed. My security musings for the AS/400 were affirmed by items such as object authority and authority lists.
When I first started at the AS/400 shop, I noticed that there was a key in the front panel of the B10. As a newbie, I wasn’t greatly concerned with its use. I just figured it had something to do with high-level stuff, so I put it in the normal position, took the key out, and locked it up in a drawer. Later, after attending Wayne’s security sessions, I found out about the power this key held. I was glad that I did. Why, with this key and a good working knowledge of dedicated service tools (DST), you can easily wreak havoc on any AS/400. You could change the QSECOFR profile’s password and initialize your disk. When I found that out, along with the fact that DST passwords shipped with each AS/400 were exactly the same, I changed those passwords quickly.
The old B10 was a good machine, but the organization’s needs grew. We needed more disk and more horsepower. Our shop got newer and bigger boxes, but that key was always an integral part of our security arsenal on each machine we purchased. From the cream-colored Model B10 to the jet-black Model 300, some form of security key was provided. That is, until now.
Recently, we purchased a RISC Model 620, which tripled our available disk space and quadrupled the memory. I expected a lot of speed and power on this box, and I got it. But there is one small thing that I did not get—a system key.
There were two sets of keys that came with our AS/400. One was for a Magstar tape drive, and one was for the front panel. Thinking the front panel key was the system key, I asked my Customer Engineer (CE) where the lock positions were. With an “I know what you are asking, and you will not like my response” look in his eye, he informed me that this key was only for removing the front panel of the AS/400. It was not a system key.
Imagine my shock! IBM slacking on AS/400 security? What had happened? IBM, a longtime security powerhouse, fumbled the ball first and goal on the one-yard line. A proverbial sure score, but this one was lost to the defense. I personally have a hard time believing that IBM, with its vast array of resources, simply forgot a system key on the latest and greatest AS/400 line.
You may be asking, “Why is this little key so important?” Simple, the default DST password when installed is 22222222, and the DST password to change the QSECOFR user profile password is QSECOFR. Armed with these two pieces of information (which are published here for the entire planet to see), any disgruntled or curious employee could accidentally or intentionally perform irreparable damage to any AS/400.
Attention IBM—you need to get your priorities in order. We have speed, we have functionality, we have connectivity options, we have Internet capabilities, and we have virtually limitless DASD, but in the immortal words of Apollo 13, “Houston, we have a problem.” First, you need to immediately provide current RISC boxes with some mechanism (key, integrated circuit) to make them physically secure. These boxes are being sold on a daily basis, and the potential for data destruction is growing at an increasing rate. Second, reinstate the system key in all future models of the AS/400. Bring the AS/400 back to the high levels of security that it once had.
More than ever, there is a demand for IT to deliver innovation. Your IBM i has been an essential part of your business operations for years. However, your organization may struggle to maintain the current system and implement new projects. The thousands of customers we've worked with and surveyed state that expectations regarding the digital footprint and vision of the company are not aligned with the current IT environment.
TRY the one package that solves all your document design and printing challenges on all your platforms. Produce bar code labels, electronic forms, ad hoc reports, and RFID tags – without programming! MarkMagic is the only document design and print solution that combines report writing, WYSIWYG label and forms design, and conditional printing in one integrated product. Make sure your data survives when catastrophe hits. Request your trial now! Request Now.
Forms of ransomware has been around for over 30 years, and with more and more organizations suffering attacks each year, it continues to endure. What has made ransomware such a durable threat and what is the best way to combat it? In order to prevent ransomware, organizations must first understand how it works.
Disaster protection is vital to every business. Yet, it often consists of patched together procedures that are prone to error. From automatic backups to data encryption to media management, Robot automates the routine (yet often complex) tasks of iSeries backup and recovery, saving you time and money and making the process safer and more reliable. Automate your backups with the Robot Backup and Recovery Solution. Key features include:
Business users want new applications now. Market and regulatory pressures require faster application updates and delivery into production. Your IBM i developers may be approaching retirement, and you see no sure way to fill their positions with experienced developers. In addition, you may be caught between maintaining your existing applications and the uncertainty of moving to something new.
IT managers hoping to find new IBM i talent are discovering that the pool of experienced RPG programmers and operators or administrators with intimate knowledge of the operating system and the applications that run on it is small. This begs the question: How will you manage the platform that supports such a big part of your business? This guide offers strategies and software suggestions to help you plan IT staffing and resources and smooth the transition after your AS/400 talent retires. Read on to learn:
LATEST COMMENTS
MC Press Online