Kisco Douses Security Concerns at Seagrave Fire Apparatus

by Robert Gast

Under normal circumstances, production time for a single fire truck is seven to 12 months. However, in response to New York City's urgent need following the loss of fire trucks in the Sept. 11 terrorist attacks, Seagrave welders, painters, plumbers, electrical technicians, and assemblers have cut that time to 120 days per vehicle. Life and property hang in the balance.

Warning! IT Red Lights and Sirens

Seagrave cannot afford to have problems with its ERP and financial software applications. (We can't give you the name of a company who can!) Problems caused by tampering with its Freidman Frontier applications or data could ripple through the whole manufacturing process and delay delivery.

"We don't need distractions right now," says Jim Merdan, Seagrave's information systems director. "We needed a product to protect our product, which is our data."

Merdan, an experienced AS/400 technician who joined the company in 1988, became concerned when he noticed that a few employees with access to the AS/400 Model 730 through Client Access were attempting to reach restricted information. Most violations were defined as illegal accesses to the system using Network Neighborhood from Windows 98/2000 desktops. According to Merdan's estimations, Seagrave had about 180 user sessions running on the AS/400 on any given workday.

Merdan believed that making changes to OS/400 security would not be beneficial. Users were already required to sign on to the menu-driven system with a password and user ID, and were individually limited, at the file level, to what they could access.

An Invitation for Mischief

After some research and investigation, Merdan learned that client/server programs like Client Access have created significant security challenges for midrange-system security managers. Some client/server functions can bypass traditional OS/400 security checks unless users fully implement object-level security, which can make the system difficult to use.

Seagrave's OS/400 security is set at level 30, and Merdan was not in favor of making it more difficult for authorized users to do their work. He realized, however, that without object-level security, employees could use a PC-based database tool such as Microsoft Access to easily access, update, or delete any data file on an AS/400.

At the heart of this dilemma are exit points. In OS/400, exit points are instances in which users can register and insert programs and override default application functions. Exit points can be used to call programs, to block access to programs, and to perform other functions such as capturing passwords. In early versions of OS/400, there were about 30 exit points. Now there are hundreds.

To solve the problem, Merdan wrote his own exit-point routines that successfully blocked unwelcome activity. Although his solution was satisfactory, Merdan found that maintaining these programs was time- consuming and a chore. Whenever a new operating system or application program release that included client/server functions became available, Merdan had to modify his exit-point programs.

"IBM said I could recompile my programs and they would go active," Merdan says. "But I realized that I also had to bring down the whole subsystem, which involved a lot more off-hours time. I wrote a couple CL [programs] where you could just modify a data area, but as things got busier, it got unmanageable."

A more comprehensive solution was needed.

Putting Out an IT Fire

Merdan knew of several third-party AS/400 audit/security software utilities that extended beyond the tools offered in OS/400 and detected security holes. He said he wanted a solution that would not change or affect any existing native OS/400 security settings. And, for obvious reasons, he wanted something that was easy to implement and maintain.

He did the required homework, and after reviewing the product literature and specifications of several offerings, Merdan chose to take a closer look at SafeNet/400, from Kisco Information Systems. "I decided to take a look at their product because they have developed a good name in the industry and their feature set fit my requirements," he says.

Merdan ordered the free trial offered by Kisco to assess the software's ability to close the holes created by the non-twinax desktops and open exit points. Following a smooth installation during a regularly scheduled IPL, Merdan fired up the logging-only feature of SafeNet/400.

"I ran it for a week to get a picture of who was accessing the system through network connections and what objects they were trying to gain access to," Merdan says. "There seemed to be a lot of interest in system- related files. We also took a look at what exit points were being used."

With that information in hand, he decided to lock down server functions on the AS/400 using SafeNet/400 Access Controls. At Seagrave, SafeNet/400 controls more than 40 servers, and each server can be configured in a variety of ways, including allowing no restrictions, just logging, restricted by user, restricted by user and object, or disabled. Merdan reviewed each user's access requirements and created rules for them within SafeNet/400.

Merdan says that within two weeks he realized the security problems were being correctly identified and resolved. Now, when an access violation is detected, the illegal access attempt is rejected. The user receives a message stating that the operation has been blocked, and the user profile is sent to a security officer. If an access denial was made inadvertently, the rules can be updated immediately.

Keeping Things Cool

When it comes to maintenance, Merdan says new operating systems or application-program updates will require changes to SafeNet/400. He noted an instance when a new release of Seagrave's ERP software had some client/server applications that needed access to some exit points that Merdan had blocked.

Seagrave's AS/400 is not accessible by dealers or the public. In the future, Merdan plans to implement TCP/IP to support internal Client Access sessions. According to Merdan, this modification does not worry him, because SafeNet/400 has "the capability to monitor and limit those activities."

Bob Gast is a freelance writer with several years of experience in covering information technology. He can be reached via e-mail at evantgroup@aol.com.