04
Wed, Dec
6 New Articles

Why Encryption?

IBM i (OS/400, i5/OS)
Typography
  • Smaller Small Medium Big Bigger
  • Default Helvetica Segoe Georgia Times

Why should organizations—including IBM i shops—consider using encryption to protect their data? Carol describes the areas where encryption can be used and why she’s a strong believer in implementing it.

Large financial institutions used to be the only organizations that implemented encryption. Now it’s becoming more commonplace. Why? One reason is because it’s become easier to implement; you no longer need hardware encryption cards, for example. But another reason is because more organizations realize that encryption is a vital layer of defense for protecting their data—often the last layer to prevent compromise. And I fully agree with that reason. As you know, I’m a huge fan of multiple layers of defense, and encryption is one of those important layers. Let’s take a look at the various ways encryption can be implemented on IBM i.

Data in Motion

One of the ways organizations can protect their data is to encrypt data “in motion.” This means that all transmission of data is encrypted. Many organizations have been doing this for the transfer of data outside of their organization. What I want to encourage is that all transmission of data is encrypted, including data transferred within your own network. Sometimes I get pushback when I suggest organizations encrypt internal communications. They argue that it’s their own network, so why should it be encrypted? My counter is to point them to any one of the security-related newsletters that are available and show them the plethora of articles that describe how a hacker or rogue insider plants a sniffer on the network and gathers user ids and passwords to gain access to servers around the network. So all communications—not just those to and from IBM i—need to be encrypted to eliminate this exposure.

IBM has made configuring encrypted sessions on IBM i relatively easy. You can choose to create the digital certificates required on IBM i itself or request them from an internal or well-known CA and import them. Access Client Solutions (ACS) has made configuring the client-side of the transmission much easier than it was with the old Client Access client. There’s very little excuse for not encrypting internal communications and eliminating this exposure.

If you aren’t encrypting transmissions leaving your organization, you need to take a serious look at these connections. Why would you ever want to send credentials (user ids and passwords) through the Internet in cleartext, not to mention your data! Yikes! Many of these connections are to banks or trading partners and carry critical or sensitive data. If these connections are not already encrypted, run do not walk to your workstation and connect with your contact on the other end of the connection and start the work necessary to encrypt all of your external communications. The only valid reason for not encrypting external communications is if the organization being communicated refuses or cannot accommodate an encrypted session. Today, however, there should be very few of these situations remaining.

Data at Rest

When the credit-card industry started to require all cardholder data be encrypted, IBM i shops had the painful task of restructuring any file that contained encrypted data. That’s because encrypting a field in a database file usually resulted in the field becoming longer and sometimes a different type. This caused applications to have to recompile any program using the file, in addition to adding the calls to encrypt and subsequently decrypt the fields upon access. But as of V7R1, IBM i has the feature called Field Procedure. FIELDPROC, as it’s referred to, has significantly reduced the challenge of encrypting data at rest, eliminating the need for applications to recompile programs using files with encrypted data as well as eliminating the need to add calls to encryption/decryption routines. The operating system stores the encrypted data in the internal structure of the database. As a result, the length and type of the field remains the same. Also, an encryption routine is automatically called when the field is either written to or read. Because of this reduction in complexity and the elimination of the need to significantly rework applications, more organizations are choosing to encrypt data at rest. In the scheme of implementing multiple layers of defense, encrypting the data at the field level is your last layer before data becomes available. In other words, even if users have authority to the file, by using FIELDPROC you can control who will see the fully decrypted information. The reason this is so important is because most application database files contain what I call “mixed” data—that is, some fields contain general, non-confidential information, and others contain PII data. This stems from the fact that no one imagined 20 years ago that social security or social insurance numbers would be considered private information. Today, we’d never design databases that contain this type of mixed data, but since most organizations don’t have the luxury of redesigning their applications, we’re stuck working with this database design. Because of the mixed data, more users need authority to the file than should have access to the PII data contained in the file; therefore, your best line of defense for protecting the confidential or PII data is to use FIELDPROC and encrypt it, and then specify which users can see the fully decrypted data, semi-masked data, or fully masked data.

With FIELDPROC, IBM has provided the enablement of encryption, but the operating system doesn’t actually do the encryption. While you could write your own encryption/decryption routines, I don’t recommend it. These routines are only part of the encryption picture. The parts of implementing encryption that need special attention aren’t the encryption/decryption routines; it’s the key management aspect. Key management includes encryption key generation, storage, and management, including the ability to have multiple inputs to generate the master key or randomly generate it, encrypting the data encryption keys, providing the ability to change keys when they reach their end of life or someone leaves, and more. Key management is key (pun intended) to a successful data encryption scheme. Vendor products have solved this problem and provide solutions that include the encryption routines, key management, and methods for determining which users see the full data or masked data.

What doesn’t protect your data? Disk encryption. I’ve heard some organizations assert that they are already encrypting their data on IBM i using full disk encryption and therefore don’t need to implement FIELDPROC. That absolutely isn’t the case. The only scenario where disk encryption protects your data is when you swap out a disk. Otherwise, data is automatically decrypted whenever it’s accessed when full disk encryption has been implemented. Full disk encryption offers no options for specifying who can see fully decrypted data; data is always decrypted on access. Please do not fool yourself (or your management) into believing full disk encryption is a viable layer of defense against inappropriate access of your organization’s data.

Like object-level security, FIELDPROC provides protection regardless of how the information is accessed—via an application menu, FTP, ODBC, remote command, command line, etc. This is why I feel there’s a strong case for using FIELDPROC as a layer of defense to protect your data. In addition, if data is stolen and the person inappropriately accessing the data doesn’t have authority to the fully decrypted data, you may eliminate some of the breach-reporting requirements that are in effect in countries around the world.

Encrypted Backup

If you haven’t considered encrypted backups, you should. This technology isn’t for all organizations, but should the media containing your backup be lost or stolen and if that backup contains PII, most of the breach-notification laws around the world either exempt the organization from reporting or, in the case of GDPR, while loss of data will have to be reported, you won’t have to notify the individuals and fines are reduced or eliminated. Talk to any organization that has had to notify individuals that their data was lost and had to provide credit-monitoring services because backup media wasn’t encrypted; they’ll tell you they wish they had invested in encrypted backups. Now this, like encrypting data at rest, takes planning. Once again, key management is key. But also, you must think through your disaster recovery plans to make sure that the hardware or software used to encrypt the media is available at your alternate data center or hot site should you have to go into disaster recovery mode.

Summary

Yes, encryption takes planning. Yes, it’s easier to not encrypt sessions, data, and backups. But in many instances, it is the final line of defense to protect your data from inappropriate access and significant business disruption that follows the loss or theft of data. I encourage you to discuss this important feature with management. Help them understand the options available so they can determine whether this is a layer of defense they want implemented to help reduce risk to your data and systems.

Carol Woodbury

 

Carol Woodbury is IBM i Security SME and Senior Advisor to Kisco Systems, a firm focused on providing IBM i security solutions. Carol has over 30 years’ experience with IBM i security, starting her career as Security Team Leader and Chief Engineering Manager for iSeries Security at IBM in Rochester, MN. Since leaving IBM, she has co-founded two companies: SkyView Partners and DXR Security. Her practical experience and her intimate knowledge of the system combine for a unique viewpoint and experience level that cannot be matched.

Carol is known worldwide as an author and award-winning speaker on security technology, specializing in IBM i security topics. She has written seven books on IBM i security, including her two current books, IBM i Security Administration and Compliance, 3rd Edition and Mastering IBM i Security, A Modern, Step-by-Step Approach. Carol has been named an IBM Champion since 2018 and holds her CISSP and CRISC security certifications.


MC Press books written by Carol Woodbury available now on the MC Press Bookstore.

IBM i Security Administration and Compliance: Third Edition
Don't miss the newest edition by the industry’s #1 IBM i security expert.
List Price $71.95

Now On Sale

Mastering IBM i Security Mastering IBM i Security
Get the must-have guide by the industry’s #1 security authority.
List Price $49.95

Now On Sale

BLOG COMMENTS POWERED BY DISQUS

LATEST COMMENTS

Support MC Press Online

$

Book Reviews

Resource Center

  • SB Profound WC 5536 Have you been wondering about Node.js? Our free Node.js Webinar Series takes you from total beginner to creating a fully-functional IBM i Node.js business application. You can find Part 1 here. In Part 2 of our free Node.js Webinar Series, Brian May teaches you the different tooling options available for writing code, debugging, and using Git for version control. Brian will briefly discuss the different tools available, and demonstrate his preferred setup for Node development on IBM i or any platform. Attend this webinar to learn:

  • SB Profound WP 5539More than ever, there is a demand for IT to deliver innovation. Your IBM i has been an essential part of your business operations for years. However, your organization may struggle to maintain the current system and implement new projects. The thousands of customers we've worked with and surveyed state that expectations regarding the digital footprint and vision of the company are not aligned with the current IT environment.

  • SB HelpSystems ROBOT Generic IBM announced the E1080 servers using the latest Power10 processor in September 2021. The most powerful processor from IBM to date, Power10 is designed to handle the demands of doing business in today’s high-tech atmosphere, including running cloud applications, supporting big data, and managing AI workloads. But what does Power10 mean for your data center? In this recorded webinar, IBMers Dan Sundt and Dylan Boday join IBM Power Champion Tom Huntington for a discussion on why Power10 technology is the right strategic investment if you run IBM i, AIX, or Linux. In this action-packed hour, Tom will share trends from the IBM i and AIX user communities while Dan and Dylan dive into the tech specs for key hardware, including:

  • Magic MarkTRY the one package that solves all your document design and printing challenges on all your platforms. Produce bar code labels, electronic forms, ad hoc reports, and RFID tags – without programming! MarkMagic is the only document design and print solution that combines report writing, WYSIWYG label and forms design, and conditional printing in one integrated product. Make sure your data survives when catastrophe hits. Request your trial now!  Request Now.

  • SB HelpSystems ROBOT GenericForms of ransomware has been around for over 30 years, and with more and more organizations suffering attacks each year, it continues to endure. What has made ransomware such a durable threat and what is the best way to combat it? In order to prevent ransomware, organizations must first understand how it works.

  • SB HelpSystems ROBOT GenericIT security is a top priority for businesses around the world, but most IBM i pros don’t know where to begin—and most cybersecurity experts don’t know IBM i. In this session, Robin Tatam explores the business impact of lax IBM i security, the top vulnerabilities putting IBM i at risk, and the steps you can take to protect your organization. If you’re looking to avoid unexpected downtime or corrupted data, you don’t want to miss this session.

  • SB HelpSystems ROBOT GenericCan you trust all of your users all of the time? A typical end user receives 16 malicious emails each month, but only 17 percent of these phishing campaigns are reported to IT. Once an attack is underway, most organizations won’t discover the breach until six months later. A staggering amount of damage can occur in that time. Despite these risks, 93 percent of organizations are leaving their IBM i systems vulnerable to cybercrime. In this on-demand webinar, IBM i security experts Robin Tatam and Sandi Moore will reveal:

  • FORTRA Disaster protection is vital to every business. Yet, it often consists of patched together procedures that are prone to error. From automatic backups to data encryption to media management, Robot automates the routine (yet often complex) tasks of iSeries backup and recovery, saving you time and money and making the process safer and more reliable. Automate your backups with the Robot Backup and Recovery Solution. Key features include:

  • FORTRAManaging messages on your IBM i can be more than a full-time job if you have to do it manually. Messages need a response and resources must be monitored—often over multiple systems and across platforms. How can you be sure you won’t miss important system events? Automate your message center with the Robot Message Management Solution. Key features include:

  • FORTRAThe thought of printing, distributing, and storing iSeries reports manually may reduce you to tears. Paper and labor costs associated with report generation can spiral out of control. Mountains of paper threaten to swamp your files. Robot automates report bursting, distribution, bundling, and archiving, and offers secure, selective online report viewing. Manage your reports with the Robot Report Management Solution. Key features include:

  • FORTRAFor over 30 years, Robot has been a leader in systems management for IBM i. With batch job creation and scheduling at its core, the Robot Job Scheduling Solution reduces the opportunity for human error and helps you maintain service levels, automating even the biggest, most complex runbooks. Manage your job schedule with the Robot Job Scheduling Solution. Key features include:

  • LANSA Business users want new applications now. Market and regulatory pressures require faster application updates and delivery into production. Your IBM i developers may be approaching retirement, and you see no sure way to fill their positions with experienced developers. In addition, you may be caught between maintaining your existing applications and the uncertainty of moving to something new.

  • LANSAWhen it comes to creating your business applications, there are hundreds of coding platforms and programming languages to choose from. These options range from very complex traditional programming languages to Low-Code platforms where sometimes no traditional coding experience is needed. Download our whitepaper, The Power of Writing Code in a Low-Code Solution, and:

  • LANSASupply Chain is becoming increasingly complex and unpredictable. From raw materials for manufacturing to food supply chains, the journey from source to production to delivery to consumers is marred with inefficiencies, manual processes, shortages, recalls, counterfeits, and scandals. In this webinar, we discuss how:

  • The MC Resource Centers bring you the widest selection of white papers, trial software, and on-demand webcasts for you to choose from. >> Review the list of White Papers, Trial Software or On-Demand Webcast at the MC Press Resource Center. >> Add the items to yru Cart and complet he checkout process and submit

  • Profound Logic Have you been wondering about Node.js? Our free Node.js Webinar Series takes you from total beginner to creating a fully-functional IBM i Node.js business application.

  • SB Profound WC 5536Join us for this hour-long webcast that will explore:

  • Fortra IT managers hoping to find new IBM i talent are discovering that the pool of experienced RPG programmers and operators or administrators with intimate knowledge of the operating system and the applications that run on it is small. This begs the question: How will you manage the platform that supports such a big part of your business? This guide offers strategies and software suggestions to help you plan IT staffing and resources and smooth the transition after your AS/400 talent retires. Read on to learn: