04
Fri, Oct
2 New Articles

Batten the Hatches: Securing Your Midrange Infrastructure

IBM i (OS/400, i5/OS)
Typography
  • Smaller Small Medium Big Bigger
  • Default Helvetica Segoe Georgia Times

The unauthorized access, download, and manipulation of proprietary, corporate data—such as the recently reported intrusion at Microsoft in which a hacker leisurely reviewed source code for a yet-to-be-released operating system version—occurs far more often than is reported.

The risk of significant material loss is increasing exponentially as system access opens up beyond company employees to dealers, customers, and the public in general. Companies are beginning to take security issues very seriously and are reporting and assisting in the prosecution of intruder, as well as disciplining employees responsible for securing these systems. Security personnel can face severe disciplinary action, while higher-level executives with direct responsibility for systems may suffer even greater penalties in the wake of such intrusions. For example, a company can be held liable to an injured consumer if appropriate and immediate action is not taken to correct a security breach.

For most IS departments, the real threat will not be a teenager with abounding curiosity and a knack for technology. The 2000 CSI/FBI Computer Crime and Security Survey reported that 71 percent of respondents detected unauthorized access by insiders, while only 25 percent detected an attack from the outside. IS department managers report that they are most concerned with employees who have either recently had their relationship “severed” with the company or feel that termination, for one reason or another, is inevitable, if not imminent. Also, there are employees who don’t have “need to know” responsibilities but possess “want to know” curiosity.

Many experts feel that security is directly related to the education and ethics of users. The underlying message here is that it’s not the computer but the person at the keyboard. For this type of problem, there is no easily implemented firewall.

 

New Security Exposures

 

Further compounding the issue for midrange professionals is the evolution of the corporate computing environment, including the ever-evolving nature of OS/400 and networked, heterogeneous computing.

The AS/400 was once the singular, central closed server for all corporate computing. Since the AS/400 was not networked to the outside world except for dial-up and a few point-to-point connections, risk management and risk assessment were easy.


Over time, as the IBM midrange platforms proved exceptionally cost-effective and reliable for managing businesses, simple, secure, locally attached point-to-point connections gave way to open networking.

Networking requirements for interconnectivity—including intranet access, Web server support, publicly accessible extranets, direct TCP/IP access for customers and even potential competitors—increased. The introduction of support for FTP and Client Access alone has created significant security challenges for midrange network security managers. For example, some client/server functions can bypass traditional OS/400 security-checking unless users fully implement object-level security. Without object-level security, a PC- based database tool, such as Microsoft Access, can easily access, update, or delete any data file on an AS/400.

With every new release of OS/400 came the addition of several new exit points. In OS/400, exit points are instances where you register and insert your own programs, overriding default application behaviors. Exit points can be used to call programs, block access to programs, and perform other functions. Exit points are a primary concern from a security standpoint because, among other acceptable and unacceptable system practices, exit point programs can be used to capture passwords. In earlier versions of OS/400, there were only about 30 exit points; now there are hundreds.

System security is often neglected until an incident occurs. Ideally, security planning and implementation should not be a reactive process. Unfortunately, many companies don’t have the resources to implement a security plan. But in the absence of a security plan, the damage a company can sustain through electronic espionage, sabotage, or even simple tampering can be devastating. It’s unsettling to consider the fact that, unlike a hurricane or fire, security degradation can go unnoticed for an extended period of time.

Recently, I heard a story of a new IS director who was hired at a large furniture distribution company in the Midwest. His first big project was to interconnect servers in remote sales offices to a central production AS/400. On the Sunday before these offices were to go live, he dialed into the AS/400 from home to inspect the link. Out of curiosity, he checked Work with Active Jobs (WRKACTJOB) to see if anyone else was logged on. To his surprise, the person he replaced, who was no longer an employee of the company, was signed on with all-object authority. He then checked the history log and learned that this ex-employee had signed on several times since leaving. The new IS director was baffled; he had deleted all old user profiles when he started. After some investigation, he discovered that a program had been written that adopted QSECOFR authority, creating a back door into the system.

 

Developing a Security Plan

 

Implementing a cogent system, network, and application security initiative for your company begins with a computer security policy. Generally, the goal of a security policy is to manage access to a specific set of company assets, including data, software, and hardware. The policy should focus on known and probable threats.

The first step in developing a policy is to conduct a risk analysis to identify and document potential risks. By identifying the most probable threats, you will be able to prioritize your investment of time, money, and resources. For example, a data center in Wisconsin need not plan for risks related to tidal actions, but it should prepare for risks posed by disgruntled employees, including the theft of valuable data or software.

The next step in the risk analysis is to determine what assets you need to protect and their approximate value. Topping the list is proprietary information, trade secrets, and financial and personnel data.

A review of business requirements is also an essential part of any security plan. For example, does your company connect a production AS/400 to a public network to allow


 

Big Risk

 

sales staff to view inventory levels, pricing information, and available customer credit? Your company’s business requirements may create significant security management issues.

When you have completed the reviews of risk analysis and business requirements, a computer security policy should be constructed. The policy explains the rules and acceptable practices that must be followed in order to protect the company’s data and network assets. The policy also enables the security team to implement the procedures and tools necessary to protect and manage access to your company’s resources.

The overall security plan can be perceived as having two facets: the physical environment and the system environment. The practices pertaining to the physical environment are easier to devise, and periodic security reviews of the physical environment should not take much time.

 

Reviewing Physical Security

 

Periodic security audits should review physical security practices regarding control of physical access to computer hardware and media, including production and development infrastructure as well as communications equipment. Access should be restricted for phone switches and building security systems as well. Master copies of licensed software media should be locked up where possible. Make sure there is limited access to the computer system consoles. And, as a matter of housekeeping, don’t leave any security keys in the equipment itself unless necessary for normal operator use.

The first step in restricting access to equipment is to lock the computer room door with key-card access or electronic combination locks. Key-card systems are preferable to electronic combination locks because they are easier to administer, offer more selective access options, and create audit trails. By limiting access to those who really need it, traffic in and out of the computer room will be greatly minimized. Key cards cannot be copied and information about who enters the computer room, and when, is collected. When an employee is terminated, the card can be immediately deactivated. When doing a periodic security audit, it’s important to review key-card systems as well to ensure that access lists are up-to-date.

 

Reviewing System Environment Security

 

The scope of environment security on a given system is dictated, to some extent, by what type of business is being conducted. While all companies may have a security risk posed by disgruntled employees, some businesses are more prone to hacking and corporate espionage. Businesses using online credit card authorization and transaction systems, for example, are more likely to suffer from unauthorized access than smaller manufacturers.

Although exposures and requirements differ from business to business, Figure 1 (page 31) provides a checklist of important security areas to review on a regular basis.

It is also important to review backup and recovery plans in the event that a system is either damaged inadvertently by a user or purposefully sabotaged by an intruder. Ensure that the backup and recovery processes will fully protect and fully recover the financial data, trade secret information, and human resources information your company needs to continue or resume operations.

 

Getting Help

 

IBM offers the AS/400e Security Advisor on its Web site (www.as400.ibm.com/tstudio/ secure1/advisor/secwiz.htm). If you are new to the AS/400 or to security, or if the environment in which you run your AS/400 has recently changed, this tool will generate a list of recommendations that you can use to get started. Fill out the questionnaire, which requests information pertaining to the use of your AS/400, and the site will provide you with a list of IBM’s recommended security-related system values, along with suggestions for scheduling security audit journal reports. There is no charge for this analysis. Also available is the AS/400 Security Wizard in Operations Navigator (see “Configure Your


AS/400 Security the Easy Way with the New AS/400 Security Wizard,” Shannon O’Donnell, MC, March 1999), which provides similar information.

There are many third-party AS/400 audit/security software products that extend beyond the tools offered in OS/400 and help detect security holes. Generally, these products are designed to analyze your system to find all existing security faults and block all exit points. Security audit tools also monitor activities and report violations. They can notify operators of security issues through system messages or pager messages. Many tools have object and profile monitors that analyze the use of sensitive programs and commands or produce a complete log of a specific profile’s activities. For a comprehensive list of AS/400 security audit software solutions, please refer to www.midrangecomputing. com/yellowpages.

Intrusion detection systems (IDSs) have become an absolute must for businesses using the Internet, as an adjunct to firewall protection. IDSs track user activity from entry to exit, guard against known types of attack, detect network policy violations, and keep tabs on normal network activity, making exceptional behavior easier to identify. Similar to virus scanners, IDSs can either be network-based (by scanning packets of incoming data) or host-based (which means the software is installed on all computers in a network). Network-based IDSs do a good job of restricting unwanted traffic from the outside, and host-based IDSs enable detection of unacceptable activity originating from within the network.

Objective, periodic security audits and reviews conducted by professional, independent organizations can help to reduce the likelihood of material loss resulting from computer misuse. Such focused expertise is invaluable to companies that regularly review procedures and physical and system environments, as well as to those that have just fallen victim to an intruder or are planning an Internet initiative. Since most companies don’t have a security specialist on board, a consultant can be a cost-effective way to button things down.

Randy Ball, an AS/400 security specialist with ComTech Group in Northbrook, Illinois, has conducted several such security audits for AS/400 shops large and small. A widely held belief about system security is that there is an inverse relationship between security and user accessibility to data. Ball feels, however, that the converse is actually true. According to Ball, “The more data you make accessible, the more important security becomes.” His approach to a client’s reviews sometimes span the course of two weeks. After discussing objectives with the client, Ball creates a statement of work. He then looks at the company’s overall security policy, both written and informal, spanning all platforms. He reviews physical security and then all points of access into the AS/400, including local devices, dedicated communication lines, Ethernet connections, and so on. He then reviews system security attributes and compares them with IBM’s recommendations.

Ball says that a lot can be determined by carefully checking user profiles. Of greatest interest to Ball are profiles with default passwords, special authorities, special classes, and all-object authority. He also checks to see if limit capability (LMTCPB(*YES)) is being used for users. Ball then generates a security review document, which includes his observations and recommendations. “It’s very specific and detailed,” says Ball.

Ball reinforces the premise that good system security is a continuous, proactive process and is a firm believer in the use of security audit journaling. “It’s a very powerful tool, which is already built into the system. It offers a great opportunity to do proactive monitoring of your system.” Security audit journaling allows you to monitor what has changed on your system, who has made the change, what programs use adopted authority, and what commands are allowed for public use, among other things.

 

Be Proactive

 

When you have established a direction, examine the physical environment to ensure that everything is properly accounted for and buttoned down, then review the system


environment. IBM offers tools, both with OS/400 and online, to help you identify possible security weak points. Third-party software solutions can provide status information on a near real-time basis, and new tools called Intrusion Detection Systems can help protect your network. If you are strapped for time or don’t have the expertise necessary, consultants can help you. They offer objectivity and have valuable experience.

Also, the importance of periodic security audits has increased exponentially due to the evolution of distributed computing and broadened general access to systems. Implementing security requires finite human resources and capital. Often, as security tightens, access to mission-critical data becomes more controlled (which to some means more difficult). It is important to be proactive in matters of system security, and a good place to start is a written security document.

User Profiles • List user profiles using Display User Profiles (DSPUSRPRF)

• Check for old, outdated profiles
• Review for last time they were used, changed, expired, or * disabled
• Note authority level, spool control, and job control capabilities

Remote Entry Points • Display Net Attributes (DSPNETATTR)

• Review options
• Check who signed on to what port
• Check *CMD to see who is connected

System Security Attributes • Display system values using Work System Value (WRKSYSVAL

SYSVAL(*SEC))
• Review password restrictions, failed sign on attempts, etc.

Network Attributes • Display Network Attributes (DSPNETA)

• Review attributes of the network, connections, local location, names, system name, etc.

Object Authority • Display objects by owner

• Display Program Adopt (DSPPGMADPT)
• Review programs that adopt authority in user libraries (Beware of programs buried in QSYS.)

Commands with Public Access • Display Command (DSPCMD) Option*Out

• Query
• Limit to user libraries

Backup and Recovery Plans • Review processes to ensure that all critical business information is regularly backed up and can be fully recovered
• Test recovery processes on a periodic basis

Figure 1: Reviewing security-related system issues on a periodic basis can minimize system misuse.


BLOG COMMENTS POWERED BY DISQUS

LATEST COMMENTS

Support MC Press Online

$

Book Reviews

Resource Center

  • SB Profound WC 5536 Have you been wondering about Node.js? Our free Node.js Webinar Series takes you from total beginner to creating a fully-functional IBM i Node.js business application. You can find Part 1 here. In Part 2 of our free Node.js Webinar Series, Brian May teaches you the different tooling options available for writing code, debugging, and using Git for version control. Brian will briefly discuss the different tools available, and demonstrate his preferred setup for Node development on IBM i or any platform. Attend this webinar to learn:

  • SB Profound WP 5539More than ever, there is a demand for IT to deliver innovation. Your IBM i has been an essential part of your business operations for years. However, your organization may struggle to maintain the current system and implement new projects. The thousands of customers we've worked with and surveyed state that expectations regarding the digital footprint and vision of the company are not aligned with the current IT environment.

  • SB HelpSystems ROBOT Generic IBM announced the E1080 servers using the latest Power10 processor in September 2021. The most powerful processor from IBM to date, Power10 is designed to handle the demands of doing business in today’s high-tech atmosphere, including running cloud applications, supporting big data, and managing AI workloads. But what does Power10 mean for your data center? In this recorded webinar, IBMers Dan Sundt and Dylan Boday join IBM Power Champion Tom Huntington for a discussion on why Power10 technology is the right strategic investment if you run IBM i, AIX, or Linux. In this action-packed hour, Tom will share trends from the IBM i and AIX user communities while Dan and Dylan dive into the tech specs for key hardware, including:

  • Magic MarkTRY the one package that solves all your document design and printing challenges on all your platforms. Produce bar code labels, electronic forms, ad hoc reports, and RFID tags – without programming! MarkMagic is the only document design and print solution that combines report writing, WYSIWYG label and forms design, and conditional printing in one integrated product. Make sure your data survives when catastrophe hits. Request your trial now!  Request Now.

  • SB HelpSystems ROBOT GenericForms of ransomware has been around for over 30 years, and with more and more organizations suffering attacks each year, it continues to endure. What has made ransomware such a durable threat and what is the best way to combat it? In order to prevent ransomware, organizations must first understand how it works.

  • SB HelpSystems ROBOT GenericIT security is a top priority for businesses around the world, but most IBM i pros don’t know where to begin—and most cybersecurity experts don’t know IBM i. In this session, Robin Tatam explores the business impact of lax IBM i security, the top vulnerabilities putting IBM i at risk, and the steps you can take to protect your organization. If you’re looking to avoid unexpected downtime or corrupted data, you don’t want to miss this session.

  • SB HelpSystems ROBOT GenericCan you trust all of your users all of the time? A typical end user receives 16 malicious emails each month, but only 17 percent of these phishing campaigns are reported to IT. Once an attack is underway, most organizations won’t discover the breach until six months later. A staggering amount of damage can occur in that time. Despite these risks, 93 percent of organizations are leaving their IBM i systems vulnerable to cybercrime. In this on-demand webinar, IBM i security experts Robin Tatam and Sandi Moore will reveal:

  • FORTRA Disaster protection is vital to every business. Yet, it often consists of patched together procedures that are prone to error. From automatic backups to data encryption to media management, Robot automates the routine (yet often complex) tasks of iSeries backup and recovery, saving you time and money and making the process safer and more reliable. Automate your backups with the Robot Backup and Recovery Solution. Key features include:

  • FORTRAManaging messages on your IBM i can be more than a full-time job if you have to do it manually. Messages need a response and resources must be monitored—often over multiple systems and across platforms. How can you be sure you won’t miss important system events? Automate your message center with the Robot Message Management Solution. Key features include:

  • FORTRAThe thought of printing, distributing, and storing iSeries reports manually may reduce you to tears. Paper and labor costs associated with report generation can spiral out of control. Mountains of paper threaten to swamp your files. Robot automates report bursting, distribution, bundling, and archiving, and offers secure, selective online report viewing. Manage your reports with the Robot Report Management Solution. Key features include:

  • FORTRAFor over 30 years, Robot has been a leader in systems management for IBM i. With batch job creation and scheduling at its core, the Robot Job Scheduling Solution reduces the opportunity for human error and helps you maintain service levels, automating even the biggest, most complex runbooks. Manage your job schedule with the Robot Job Scheduling Solution. Key features include:

  • LANSA Business users want new applications now. Market and regulatory pressures require faster application updates and delivery into production. Your IBM i developers may be approaching retirement, and you see no sure way to fill their positions with experienced developers. In addition, you may be caught between maintaining your existing applications and the uncertainty of moving to something new.

  • LANSAWhen it comes to creating your business applications, there are hundreds of coding platforms and programming languages to choose from. These options range from very complex traditional programming languages to Low-Code platforms where sometimes no traditional coding experience is needed. Download our whitepaper, The Power of Writing Code in a Low-Code Solution, and:

  • LANSASupply Chain is becoming increasingly complex and unpredictable. From raw materials for manufacturing to food supply chains, the journey from source to production to delivery to consumers is marred with inefficiencies, manual processes, shortages, recalls, counterfeits, and scandals. In this webinar, we discuss how:

  • The MC Resource Centers bring you the widest selection of white papers, trial software, and on-demand webcasts for you to choose from. >> Review the list of White Papers, Trial Software or On-Demand Webcast at the MC Press Resource Center. >> Add the items to yru Cart and complet he checkout process and submit

  • Profound Logic Have you been wondering about Node.js? Our free Node.js Webinar Series takes you from total beginner to creating a fully-functional IBM i Node.js business application.

  • SB Profound WC 5536Join us for this hour-long webcast that will explore:

  • Fortra IT managers hoping to find new IBM i talent are discovering that the pool of experienced RPG programmers and operators or administrators with intimate knowledge of the operating system and the applications that run on it is small. This begs the question: How will you manage the platform that supports such a big part of your business? This guide offers strategies and software suggestions to help you plan IT staffing and resources and smooth the transition after your AS/400 talent retires. Read on to learn: