Four Hundred Monitor, June 24

Four Hundred Monitor, June 24

June 24, 2020 Jenny Thomas

This will be our last Monitor until after the Fourth of July break, which marks the halfway point in the year for us, and this seems like a good time to look back at what 2020 has been for computing. Thanks to the global pandemic (which we are not happy about), we have seen entire workforces move to a remote format and conferences got virtual practically overnight. Sure there have been bumps in the road, but by and large, our ecosystem has been able to overcome and survive. It will be interesting to see how many people go back to offices versus staying virtual. It will likely be 2021 before we can really tell where everyone will land, but personally I am hopeful we will one day get back to face-to-face interactions.

Top Stories From Outside The Jungle

(Yahoo! News) IBM and SAP are partnering to help companies create path to a data-driven intelligent enterprise.

(The Economic Times) IBM is planning to reduce its office space in India by half in favor of going with a work from home model.

(ITProPortal) IBM had some trouble with its cloud last week, which was the result of BGP hacking.

(CNBC) IBM’s global head of Cognitive Process Re-engineering, Jonathan Wright, discusses what businesses must do to survive the COVID-19 crisis and keep their supply chain thriving.

(CIODive) Keeping businesses up and running during the pandemic has increased the demand for automation.

Redbooks, White Papers, Blogs, and Other Resources

(Mainline Information Systems) This blog dives into IBM’s recently announced Power Systems Private Cloud Solution with Dynamic Capacity, which will be generally available on June 30.

(AdoptOpenJDK) AdoptOpenJDK has a new home with the Eclipse Foundation and a new name. All the details are available in their blog.

(Opemipo’s Thoughts) This 14-year-old developer has started his own YouTube channel where he does coding tutorials, presentations, and Tech Talks on different technologies like Python, AI, and JavaScript.

(Kevin’s Ramblings) This self-described “open source dude” has some thoughts about open source that he shares in his blog.

(Raz-Lee Security) This free eBook, “Ensuring your IBM i is compliant with government and industry regulations,” offers an overview of major government and industry regulations, penalties, and the security and monitoring measures that need to be implemented to comply.

Chats, Webinars, Seminars, Shows, and Other Happenings

Happening Now – Virtual Conference – Log in, learn, and have fun at this year’s Michigan IBM Power Systems Technical Education Conference (MITEC). View more than 70 sessions from world class presenters, visit virtual booths, and connect with students and educators. Access all sessions for 30 days for only $125!

June 25 – Webinar – If Db2 on i is your primary database, but you run business applications on other platforms or the cloud, let New Generation Software and ProData show you an affordable, easy way to access it all from IBM i during this free webinar.

June 25 – Webinar – IBM Champions with expertise in security, mainframe, Power systems, and data security will come together in this webinar to discuss security best practices, answer questions, explain how they keep up to date, and more.

June 25 – Webinar – Are you paying for middleware? In this webinar, OpenLogic Chief Architect Justin Reock will present the top technologies your team can use to save thousands with middleware.

July 22-24 – Virtual Conference – OCEAN TechCon20 is three days of inspiration and innovation featuring such many expert speakers including Liam Allan, Patrick Behr, Rob Bestgen, Jim Buck, Erwin Earley, Charles Guarino, Mark Irish, Scott Klement, Doug Mack, Aaron Magid, Dan Magid, Eamon Musallam, Mike Pavlak, Steve Pitcher, Alan Seiden, and Carol Woodbury!

POSTPONED – August 31-September 3 – Tampa, Florida – POWERUp 2020 will offer between 350-400 sessions presented by more than 100 IT professionals, and features the largest exposition of its kind. This conference structured to give you the pure education and professional connections needed to best enhance your career.

May 3-5, 2021 – Framingham, Massachusetts – Plan now for the 2021 Northeast User Group (NEUGC) Conference. NEUGC is the largest technical conference in New England for IBM i.
Share this:
Reddit
Facebook
LinkedIn
Twitter
Email
Tags: Tags: FHM, Four Hundred Monitor, IBM i, Monitor
Sponsored by
Kisco Information Systems
The Case For Implementing Exit Points

By Rich Loeber

Someone recently asked me if there was someplace on the Internet where they could see a case made for implementing exit points on their IBM i system. I was at a loss for a comprehensive source and this got me thinking that it might be a good idea to just create one here.

Security exit points on the IBM i (and its predecessor OS/400) have been in existence since the mid-1990s. When the system was opened up to network access, the need for additional security over and above the standard IBM i OS security was apparent. IBM’s solution was to let their customers solve the issues on their own by giving them access to specific decision points in the various network server functions that were being rolled out. Server functions were being added to the IBM i OS to support network access to the system like FTP, ODBC, SQL, mapped drives in the IFS, file upload and download, remote command calls and a lot more. Since that time, even more network functions have been added along with related new exit points.

To be fair and above board, I must also disclose here that my company, Kisco Information Systems, jumped on the exit point bandwagon right away when the exit points were initially rolled out. Since 1996 we have been selling a comprehensive general use exit point solution called SafeNet/i, now in its 11th release.

The question I was asked was “Why does my shop need to implement exit point controls?” That is what I want to address here. I will do so by describing several cases where additional security is needed over and above the already excellent security features that are built into the IBM i OS.

Case #1: The classic case for exit point implementation comes from the 5250 terminal application days. If you have a Payroll Application that runs on your IBM i and is maintained by one or more clerks, OS security has to give access to the payroll files for those clerks, but the application and terminal menu system can easily be used to restrict what operations they can do on the payroll master files. That access will probably grant then *USE access so they can update files and generate payroll checks and reports.

The above scenario is secure from an application perspective, but you would never want your payroll clerk to be able to download the payroll master files and take them home on a USB drive, would you? An exit point implementation can prevent this access. The exit point process runs on top of the IBM i OS and can be used to restrict server functions by user profile, source IP address and even by objects accessed. This leaves the IBM i OS security intact for the 5250 terminal application and also prevents unauthorized access via the network connection.

Case #2: Many IBM i shops have one or more “regular users” defined with *ALLOBJ access in their user profile. This can happen for lots of reasons and in many cases, it would take a very long time to correct. I never recommend granting *ALLOBJ access to regular users, but if your system has evolved with this issue, it cannot be fixed overnight. In many cases, the application itself is providing the security. The issue, however, is that these users literally have access to ALL OBJECTS on your system. With network access to your system, one of these users could easily download sensitive data from your system, including credit card information and customer identity information, and hide it on a USB drive and walk out the front door and nobody would be the wiser.

An exit point implementation can address this issue. Using exit points, you can restrict object access by user profile even though the user is set up with *ALLOBJ. In fact, object access can even be restricted for the QSECOFR security user profile. This can help to protect your system from abuse by a user profile that has been granted more access rights than they really need.

Case #3: Since the TCP/IP communications utility FTP was added to the IBM i OS, a very easy to use network application lets users interact with the IBM i system without using a 5250 interface. The FTP user can browse objects on your system and upload or download them. A talented FTP user and even execute IBM i commands through FTP. For some shops, you want a user to have these capabilities, but you wouldn’t want them granted on a broad basis.

Exit points can help with this, too. First, you can easily restrict which user profiles are allowed to use FTP. Then, you can further restrict which FTP commands they are allowed to use letting them do a PUT, for example, but disallowing a GET. Then, you can even give the user contextual access rights by only allowing an FTP connection from a known and trusted IP address, such as an internal IP address. Then, if the user’s credentials are compromised, the FTP connection will still have to be established from a trusted source.

To sum up: These are just a few examples of why IBM i shops should consider exit point implementation for additional security on your IBM i system. There are literally dozens of additional scenarios that can be described, but these should get you started on making a case for exit points. It is my belief that every IBM i shop should have some form of exit point controls in place in order to be secure. If you are interested, I can heartily recommend Kisco’s SafeNet/i software if you want to jump in and get started.

If you have questions about details of this tip, feel free to contact me directly by email, download our FREE utilities, or visit our website for more information.
Share this:
Reddit
Facebook
LinkedIn
Twitter
Email
IBM i PTF Guide, Volume 22, Number 25 An Investment In APIs For IBM i From Remain Software

Leave a Reply Cancel reply

This Issue Sponsored By

Table of Contents

Content archive

Recent Posts

Subscribe

Pages

Search

Four Hundred Monitor, June 24

Top Stories From Outside The Jungle

Redbooks, White Papers, Blogs, and Other Resources

Chats, Webinars, Seminars, Shows, and Other Happenings

Share this:

Share this:

Leave a Reply Cancel reply

This Issue Sponsored By

Table of Contents

Content archive

Recent Posts

Subscribe

Pages

Search