Read time: 5 min
Having worked with IBM i customers for over 30 years, we have seen several trends that has impacted the security of the IBM i environment:
Given the fact that the IBM i typically houses critical corporate applications and data, this general lack of attention paid by many organizations to IBM i security is a critical exposure for the organizations that rely on this platform and its applications for their existence. Hence, here are some key tips that every IBM i customer organization should consider.
1. Log and monitor audit journal activity: The IBM i operating system provides audit journals that allow the logging of key system activity. Unfortunately, not all organizations have these audit journals enabled, and if they do, many do not monitor or report/alert on suspicious activity taking place. The sheer size and cryptic nature of these journals can make getting useful security information from this a challenge. Use 3rd party tools to provide this extra usability. Also, consider sending key IBM i log data to your corporate SIEM solution (if you have one), for a more complete view of organizational security related events.
2. Implement exit programs to audit network-based activity: In the last 10-15 years, the use of TCP/IP based services (such as ODBC and FTP) to access data housed in the IBM i has grown exponentially. Traditional access to the AS400 has been through direct attached terminals and managed through menu access controls. OS400 (now called the IBM i operating system) provides exit points to allow this “external” access but does not adequately audit access through these services. 3rd party exit point solutions are a requirement to collect the necessary level of information to satisfy most auditor requirements.
3. Clean up inactive user profiles: Inactive user profiles are defined as profiles that have not been used in the last 30 to 60 days. A surprising number of IBM i shops have a large number of inactive profiles and these can pose a significant security exposure. Regular cleaning of inactive profiles should be a priority and there are tools available to help with the ease the administrative effort of this task and even provide some automated assistance.
4. Don’t confuse compliance with security: Your auditor might have told you that you have met compliance with your internal policies or regulatory policies, but this does not mean you are secure. Security is an ongoing process and mindset that does not end with a positive result on an audit. Understand where your key assets are, what poses the greatest business exposure to your organization, and be proactive in addressing these risks on an ongoing basis.
5. Audit power user profiles: Every organization has trusted power user profiles that have higher levels of access and control over your critical systems. However, it is exactly these user profiles that pose the greatest risk should they be compromised. Minimize the number of user profiles with these high authorization levels, and make sure you are auditing all activity on these profiles. These are the profiles that hackers love to get their hands on. Also, consider using elevated authority techniques to temporarily extend user profile authority for specific tasks, fully audited, rather than assigning excessive authority on a permanent basis.
6. Implement and enforce strong password policies: Ensure that your password policies include frequent expiration of passwords, and the use of a reasonably strong password structure. Ensure you check for the use of default passwords because the IBM i operating system and many applications ship with standard defaults. Hackers love default passwords, so make sure you change them. Consider implementing Multi-Factor Authentication as an additional layer of security for specific users or tasks that might be especially sensitive.
7. Use a layered approach to IBM i security: Security of any kind, is all about layering. If one layer gets compromised, the next layer should stop (or at least slow down) the attacker. Make it difficult for the hacker – they love “easy targets”. A single security approach is not enough, even within the IBM i platform. You wouldn’t secure your corporate network with just a firewall, would you? Your IBM i should at least have strongly implemented object security, auditing of all activity, and even look at encryption for your highly sensitive data. Look at integrated solutions as a way of easing the administrative burden of managing all of these layers.
8. Automate security and compliance checking where possible: If security becomes onerous and difficult to manage, for most organizations, things begin to fall between the cracks, or get pushed off to be done “when you have time”. Automate your security practices where possible, or use tools to help ease the administrative burden. Run automated compliance checks for key security policies on a regular basis to ensure that you are still OK. Or if you are not, so you can correct the situation in a timely fashion. Again, 3rd party solutions are available to help you with this automation.
9. (Bonus Tip) – Secure your IFS to minimize risk from malware and Ransomware attacks: The IBM i can be compromised through malicious activity targeting the IFS. Do not provide excessive authority to the IFS, especially at the root level, as key IBM i libraries reside in the IFS root. Also, consider an anti-virus solution for the IFS so it cannot house malware that might infect your other systems.
Director of IBM Power Server - AI and Security Solutions
✓ Managed IT
✓ Managed M365
✓ Managed Backup
✓ Professional Service
✓ Managed Endpoint
After supporting Waterloo Biofilter with an office move, they quickly switched fromtheir current Managed Services Provider to Quadbridge. We now manage their entireIT environment and support their end-to-end IT needs.
• Quadbridge worked with the client to implement our Elite IT service thatprovides ongoing IT monitoring and management, responsive help desk,proactive service, and vCIO consulting
• We’ve become a fully trusted partner and have proactively led a number ofinitiatives to improve performance and advance their IT, including thefollowing services:
• Managed Cloud Backup: we optimized their backup strategy with anaccessible, cost-efficient cloud-based backup solution that our teamcontinuously monitors and assists with restore requests.
• Infrastructure Architecture: we upgraded their server infrastructure toimprove redundancy and performance – especially for employees workingremotely.
• Ad Hoc Requests: as the clients’ IT support, our team uses our range ofexpertise and onsite support capabilities to deliver on a range of simple andcomplex IT projects. These have included upgrading their conference roomsystems and completing a functional and aesthetic clean up of their cabling
Find out why getting an IT Environment Assessment is a good practice to keep your business running - especially now as IT has been quick to adapt to the pandemic, opening new vulnerabilities and unexpected issues.
In this 30-minute workshop with Quadbridge's president, Nelson Pacheco, you will discover how simple the process is and why this is the future of remote onboarding.