Wed, Oct
2 New Articles

Security Patrol: Pretend You've Been Hacked

Security - Other
  • Smaller Small Medium Big Bigger
  • Default Helvetica Segoe Georgia Times

In her return to her Security Patrol post, Carol Woodbury discusses the ways you can prepare for the unthinkable.


I'd like you to imagine the unthinkablethat your organization's been hacked. Please entertain that thought with me for a few minutes. Let's pretend that you've just been notified that the personal data of your organization's customers has been posted to an underground website where it's up for sale. In addition to fighting back a severe case of nausea, what do you do? You'd reach for the printed copy of your organization's incident response plan, right? What do you mean there is no such document? Are you telling me that you have never thought through this scenario and documented the steps to take in the case your organization experiences a breach?


Unfortunately, I believe the majority of the IBM i shopslarge and smallare unprepared should their networks and/or systems be breached. I believe it's because most organizations think it will never happen to them. If that's your attitude, start reading the news. A new article about another company being breached appears almost daily. I'm guessing that the former (note, I said "former") CIO of Target never thought her organization wouldn't be breached either. Look how well that worked out for her.


This month's Security Patrol talks about preparing an incident response plan, that piece of paper that's pulled out of a drawer should you get that dreaded phone call.

Assembling the Incident Response Team

Assembling the right team is critical to successfully responding to an incident. A section of your incident response is the list of people who need to be called for each type of incident. You'll want to designate a team leader and include individuals who can represent information security, internal audit, risk management, fraud detection, as well as administrators from all system typesfirewall, servers, IBM i, AIX, Linux, etc. Selected management and, depending on the type of incident, representatives from the business side of the organization may also be required.


Depending on the size of your organization, several of the areas described previously may be filled by the same person. That's not a problem as long as, in the case of an event, they are physically able to fulfill all of the roles in the stress-filled situation of investigating and handling an incident. It's not the number of people assigned to the team that's important. What's important is to assemble the right skills to handle the incident, keeping in mind the personalities of the various team members. The team needs to be able to work well together and be able to handle the stress this type of event produces.


Two other critical members of the team are a representative from your organization's legal counsel and a public relations/media contact. Legal counsel is required to ensure the company is complying with the law as well as to protect the company and its contracts (e.g., Service Level Agreements, aka SLAs) with customers and vendors. The media contact is vital if you have to make a public announcement about the breach. If a breach of your data occurs, your organization's reputation and image is at risk; therefore, the situation must be handled carefully. The media representative may not be the one who actually appears in front of a TV camera, but he or she would be the one to field all media inquiries, write any statements being released to the public, as well as prepare the person who makes the public statements.


You'll want to assemble this team prior to an incident and work out the details of how you'd respond to various types of incidences. The people called and actions taken will likely be different depending on, for example, whether your network comes under a denial-of-service attack vs. your personnel file is posted on a public website.

The Correct Response

One reason it's so important to be prepared ahead of a breach is because it's vital that your response be appropriate. Not only do you want to stop the attack as quickly as possible but you want to do so in a way that preserves information so that forensics can be performed. This is important, not just to discover how the breach occurred, but also to preserve evidence so the guilty parties can be identified and prosecuted.


I highly recommend that you consider having on retainer a company that specializes in investigating data breaches. These companies have the expertise to investigate and stop the breach as well as preserve evidence along the way.


Another reason it's important to respond correctlyespecially to a data breachis so that your organization doesn't violate any laws that govern the lost or stolen data. For example, depending on the state or country in which you do business, you may have to notify individuals if their personal data is lost or stolen. Your legal counsel will have to provide input on how you respond to certain types breaches.

Data Preservation

Critical to an incident investigation is data preservation. How data is preserved depends on the type of computer. For a PC, tools exist that let you obtain a mirror image of the contents of the PC's hard drive without affecting the files' dates. Again, consider having a company specializing in this type of investigation on retainer. If you have no experience in using these types of tools, the last thing you want to be doing in the midst of a breach is negotiating a contract to bring in the expertise you lack but you need onsite immediately.


From an IBM i perspective, if you believe you know when the incident occurred and you don't have a full backup since the incident, you will want to perform a full system save on new tapes as soon as possible. The intent is to take a "picture" of the system and its configuration in case there are any clues or evidence that can be used in the investigation. Note: you may have to adjust your procedures because you don't want to clear any outqs, message queues, or history logs prior to performing this save; you literally want to save everything.


Once the system has been saved or if the system was already saved, you need to establish the "chain of command" for the save media. In other words, you must clearly document who performed the save and when it was performed. Then you must document where the media goes. You will want to get this set of media into a safe and secured place as quickly as possible.


Finally, if you're using tapes as your save media and you re-use or rotate them, you will want to stop until the investigation has been completed. The incident response team may need to examine the data on those tapes to determine the configuration of the system or previous actions taken by the intruder.

Prepare for Absurd Scenarios

Some of the following scenarios you may have considered in your disaster recovery plan, but my guess is that some you wouldn't stop to consider outside of the context of a breach. Here are some scenarios to consider:


What if your PC was breachedthat is, malware was installed on your PC and you aren't allowed to use it much less attach it to your network? Do you have the information written down or available (think passwords and client software and licenses) so you can re-establish a working PC quickly?


What if your network has been compromised and the only connections allowed to your IBM i systemuntil more investigation can be performedare directly attached devices? Could you quickly configure a new subnet on your network to allow you to start managing and monitoring your IBM I, or would you have to do all work from the console? Does your business have processes that can be run using old-fashioned paper and pencil should the automated process not be available from the IBM i (not necessarily because the system was compromised but because the network has been taken down)?


If you're using VoIP for your telephone system and your network is hit with a denial-of-service attack, do you have a backup plan for communicating with employees?


What if your mobile phone has been compromised? Do you have key contacts written down on a piece of paper and stored in a place that you'll remember? Be sure to include both phone numbers and email addresses because you don't know which you'll lose.


What if your email server is compromised and you know that some email accounts have been hijacked. You have no idea how many accounts have been compromised. How do you re-establish email for all of your employees?


What if all of the Windows servers in your organization were compromised or could have possibly been compromised? For example, the Admin profile was compromised and malware may have been installed or data could have been deleted or altered. Would you allow those servers to continue to automatically connect to your IBM i? (The correct answer is no.) In that case, what business processes are affected? How important are these processes in the priority of getting processes re-established?


What if the servers where all of your documentation (think vendor contact information, backup copies of software licenses, critical processes, etc.) is located have been compromised and have to be re-built? The information may never be able to be recovered because you don't know how long the servers have been compromised (so you don't know what backups can be trusted). Do you have your critical information in more than one place, perhaps in a good old-fashioned print-out?


Educating your employees and vendors on breach prevention should be a part of preparing for an incident. Employees need to be educated to watch for suspicious behavior. Specifically, users need to be trained to not click on links in unknown emails. Spear-phishing (targeted emails containing a link to malware that is downloaded to the user's PC) is one of the top ways malware makes its way into an organization. Many of the recent breaches were successful because of the malware introduced into the organization's network through spear-phishing.

Be Protactive

Before an incident occurs, assemble the team and role play various types of incidences and breaches. Based on this, create the policy and document the incident-reporting process for each type of incident. It's likely to take several meetings before you have developed the appropriate addition to your policy and have your process defined to the point that it can be followed. Together with your legal counsel, you may want to call in police investigators or federal agencies to understand the data-gathering/preservation requirements of your specific city, state, or country and make sure these are accommodated in your processes.


I hope that this Security Patrol has caused you to pause and think about whether you're prepared should a breach occur in your organization. If you're not, please do not assume that hackers are going to bypass your organization. In today's world, whether your organization is large or small, you cannot make that assumption. Planning for this type of event will help you recover more quickly. I have been involved with organizations that have experienced a breach. Trust me when I say that you do not want to be in that situation without a plan.


IBM i provides many resources to aid in the investigation of an incident. Next month, I'll discuss specific actions you can take to look for evidence of an intrusion on IBM i.


Carol Woodbury


Carol Woodbury is President and CTO of DXR Security and has over 30 years’ experience with IBM i Security. She started her career as Security Team Leader and Chief Engineering Manager for iSeries Security at IBM in Rochester, MN. Since leaving IBM, she has co-founded two companies – SkyView Partners and DXR Security. Her current company - DXR Security - specializes in penetration testing for IBM i. Her practical experience together with her intimate knowledge of the system combine for a unique viewpoint and experience level that cannot be matched.

Carol is known world-wide as an author and award-winning speaker on security technology, specializing in IBM i Security topics. She has written seven books on IBM i Security. Carol has been named an IBM Champion since 2018 and holds her CISSP and CRISC security certifications.


MC Press books written by Carol Woodbury available now on the MC Press Bookstore.

IBM i Security Administration and Compliance: Third Edition IBM i Security Administration and Compliance: Third Edition
Don't miss the newest edition by the industry’s #1 IBM i security expert.
List Price $71.95

Now On Sale

IBM i Security Administration and Compliance: Second Edition IBM i Security Administration and Compliance: Second Edition
Get the must-have guide by the industry’s #1 security authority.
List Price $71.95

Now On Sale

IBM i Security Administration and Compliance IBM i Security Administration and Compliance
For beginners to veterans, this is the definitive security resource.
List Price $69.95

Now On Sale



Support MC Press Online

$0.00 Raised:

Book Reviews

Resource Center

  • SB Profound WC 5536 Have you been wondering about Node.js? Our free Node.js Webinar Series takes you from total beginner to creating a fully-functional IBM i Node.js business application. You can find Part 1 here. In Part 2 of our free Node.js Webinar Series, Brian May teaches you the different tooling options available for writing code, debugging, and using Git for version control. Brian will briefly discuss the different tools available, and demonstrate his preferred setup for Node development on IBM i or any platform. Attend this webinar to learn:

  • SB Profound WP 5539More than ever, there is a demand for IT to deliver innovation. Your IBM i has been an essential part of your business operations for years. However, your organization may struggle to maintain the current system and implement new projects. The thousands of customers we've worked with and surveyed state that expectations regarding the digital footprint and vision of the company are not aligned with the current IT environment.

  • SB HelpSystems ROBOT Generic IBM announced the E1080 servers using the latest Power10 processor in September 2021. The most powerful processor from IBM to date, Power10 is designed to handle the demands of doing business in today’s high-tech atmosphere, including running cloud applications, supporting big data, and managing AI workloads. But what does Power10 mean for your data center? In this recorded webinar, IBMers Dan Sundt and Dylan Boday join IBM Power Champion Tom Huntington for a discussion on why Power10 technology is the right strategic investment if you run IBM i, AIX, or Linux. In this action-packed hour, Tom will share trends from the IBM i and AIX user communities while Dan and Dylan dive into the tech specs for key hardware, including:

  • Magic MarkTRY the one package that solves all your document design and printing challenges on all your platforms. Produce bar code labels, electronic forms, ad hoc reports, and RFID tags – without programming! MarkMagic is the only document design and print solution that combines report writing, WYSIWYG label and forms design, and conditional printing in one integrated product. Make sure your data survives when catastrophe hits. Request your trial now!  Request Now.

  • SB HelpSystems ROBOT GenericForms of ransomware has been around for over 30 years, and with more and more organizations suffering attacks each year, it continues to endure. What has made ransomware such a durable threat and what is the best way to combat it? In order to prevent ransomware, organizations must first understand how it works.

  • SB HelpSystems ROBOT GenericIT security is a top priority for businesses around the world, but most IBM i pros don’t know where to begin—and most cybersecurity experts don’t know IBM i. In this session, Robin Tatam explores the business impact of lax IBM i security, the top vulnerabilities putting IBM i at risk, and the steps you can take to protect your organization. If you’re looking to avoid unexpected downtime or corrupted data, you don’t want to miss this session.

  • SB HelpSystems ROBOT GenericCan you trust all of your users all of the time? A typical end user receives 16 malicious emails each month, but only 17 percent of these phishing campaigns are reported to IT. Once an attack is underway, most organizations won’t discover the breach until six months later. A staggering amount of damage can occur in that time. Despite these risks, 93 percent of organizations are leaving their IBM i systems vulnerable to cybercrime. In this on-demand webinar, IBM i security experts Robin Tatam and Sandi Moore will reveal:

  • FORTRA Disaster protection is vital to every business. Yet, it often consists of patched together procedures that are prone to error. From automatic backups to data encryption to media management, Robot automates the routine (yet often complex) tasks of iSeries backup and recovery, saving you time and money and making the process safer and more reliable. Automate your backups with the Robot Backup and Recovery Solution. Key features include:

  • FORTRAManaging messages on your IBM i can be more than a full-time job if you have to do it manually. Messages need a response and resources must be monitored—often over multiple systems and across platforms. How can you be sure you won’t miss important system events? Automate your message center with the Robot Message Management Solution. Key features include:

  • FORTRAThe thought of printing, distributing, and storing iSeries reports manually may reduce you to tears. Paper and labor costs associated with report generation can spiral out of control. Mountains of paper threaten to swamp your files. Robot automates report bursting, distribution, bundling, and archiving, and offers secure, selective online report viewing. Manage your reports with the Robot Report Management Solution. Key features include:

  • FORTRAFor over 30 years, Robot has been a leader in systems management for IBM i. With batch job creation and scheduling at its core, the Robot Job Scheduling Solution reduces the opportunity for human error and helps you maintain service levels, automating even the biggest, most complex runbooks. Manage your job schedule with the Robot Job Scheduling Solution. Key features include:

  • LANSA Business users want new applications now. Market and regulatory pressures require faster application updates and delivery into production. Your IBM i developers may be approaching retirement, and you see no sure way to fill their positions with experienced developers. In addition, you may be caught between maintaining your existing applications and the uncertainty of moving to something new.

  • LANSAWhen it comes to creating your business applications, there are hundreds of coding platforms and programming languages to choose from. These options range from very complex traditional programming languages to Low-Code platforms where sometimes no traditional coding experience is needed. Download our whitepaper, The Power of Writing Code in a Low-Code Solution, and:

  • LANSASupply Chain is becoming increasingly complex and unpredictable. From raw materials for manufacturing to food supply chains, the journey from source to production to delivery to consumers is marred with inefficiencies, manual processes, shortages, recalls, counterfeits, and scandals. In this webinar, we discuss how:

  • The MC Resource Centers bring you the widest selection of white papers, trial software, and on-demand webcasts for you to choose from. >> Review the list of White Papers, Trial Software or On-Demand Webcast at the MC Press Resource Center. >> Add the items to yru Cart and complet he checkout process and submit

  • Profound Logic Have you been wondering about Node.js? Our free Node.js Webinar Series takes you from total beginner to creating a fully-functional IBM i Node.js business application.

  • SB Profound WC 5536Join us for this hour-long webcast that will explore:

  • Fortra IT managers hoping to find new IBM i talent are discovering that the pool of experienced RPG programmers and operators or administrators with intimate knowledge of the operating system and the applications that run on it is small. This begs the question: How will you manage the platform that supports such a big part of your business? This guide offers strategies and software suggestions to help you plan IT staffing and resources and smooth the transition after your AS/400 talent retires. Read on to learn: