• Guru: Binding Directory Entries

  June 5, 2023 Bob Cozzi

  I assume you’ve heard about *BNDDIR (Binding Directory) objects introduced circa 1994 with OS/400 V3R2. The infamous QC2LE binding directory is used by a huge number of RPG applications to access C runtime and unblocked MI functions such as system cvthc, cpybytes, and matmatr. You have probably seen RPG IV source code with the BNDDIR(‘QC2LE’) keyword on the header specification.

  I was one of the first developers outside of IBM to use Binding Directories for my own code. When I go back and look at my own RPG IV code created prior to mid-2007, well over 90 percent of it …

  Read more

• Zero-Day Vulnerability in Fortra’s GoAnywhere MFT Being Actively Exploited

  February 15, 2023 Alex Woodie

  A critical security vulnerability in Fortra’s (formerly HelpSystems) managed file transfer (MFT) solution, GoAnywhere MFT, is being actively exploited to steal data from companies and possibly even to spread ransomware according to published reports. Fortra told customers to consider every managed credential in their GoAnywhere environment to be compromised, shut down cloud instances of the service, and issued an emergency patch for the zero-day security vulnerability.

  Security reporter Brian Krebs was the first to share news of the vulnerability, which is described as remote code injection flaw that requires administrative console access for successful exploitation. In a February 2 post …

  Read more

• White Hats Completely Dismantle Menu-Based Security

  February 6, 2023 Alex Woodie

  Think menu-based security can prevent cybercriminals from accessing the most important parts of your IBM i system? Think again, as the white hat hacking group Silent Signal recently demonstrated in a real-world penetration test of a bank’s IBM i system through a seemingly restricted green-screen interface.

  Life was demonstrably simpler for midrange administrators before the Internet took off. Before we had all these different protocols providing access to applications and data – ODBC, FTP, SQL, Remote Command, etc. – an administrator could feel somewhat confident that users weren’t accessing things they shouldn’t by simply configuring their menus in a restrictive …

  Read more

• IBM To Stop Unencrypted Fix Downloads In February

  November 28, 2022 Timothy Prickett Morgan

  We have caught word from the IBM business partner community that starting on February 15, 2023, Big Blue will stop allowing customers to get operating system software patches that are not encrypted.

  The notification, which you can see here, was sent to business partners on November 23, just before the Thanksgiving Day holiday in the United States. Various IBM support methods, including IBM Electronic Fix Distribution (EFD), IBM Electronic Customer Care (ECC), and IBM Fix Central are all affected by this change.

  “Many leaders of the internet industry – such as World Wide Web Consortium (W3C), Internet Engineering Task …

  Read more

• Kafka, JSON, DevOps: Future Proof Your IBM i With Secure, High Performance APIs

  October 26, 2022 Daniel Magid

  It is an exciting time to be working with an IBM i! The Rochester lab and IBM partners are rapidly pushing out new technology options that allow you to do anything with the IBM i that you can do on any other platforms. The latest in web and mobile user interfaces, the most modern languages, comprehensive security, machine learning, data visualization, internet of things, APIs – are all available to IBM i users. When combining all that technology with the unmatched reliability, ease of management and low cost of ownership of IBM i, you can be confident that your company …

  Read more

• Trinity Guard Brings Security Suite Up to Speed with IBM i 7.5

  September 21, 2022 Alex Woodie

  IBM put a major focus on improving security with the release of IBM i 7.5 earlier this year, with stronger out-of-the-box default configurations, new password controls, and improved monitoring. With the launch of TG Suite 3.0, Trinity Guard is helping its customers get the most out of those security improvements.

  IBM made a slew of security improvements with the launch of IBM i 7.5, which it unveiled in May and which shipped soon thereafter. Highlights include the elimination of security level 20, a new password level 4 that includes 512-bit encryption, the elimination of default passwords, and new table functions …

  Read more

• Guru: The Finer Points of Exit Points

  June 27, 2022 Bruce Bading

  Many years ago, we received a call from an IBM i customer stating that all exit points were gone and the QAUDJRN and receivers were missing. Then the question, “Do you think we’ve been hacked?” Truth was, the exit points weren’t gone; the associated programs had been de-registered. Conclusion, they had most likely been compromised.

  The IBM i platform is a very securable system that can be secured (Secure vs Secured – What’s the difference?, WikiDiff), if you take steps to secure it.

  On the IBM i, a limited number of functions provide an exit so that your …

  Read more

• What’s New in IBM i Services and Networking

  May 18, 2022 Alex Woodie

  As expected, IBM delivered a slew of new IBM i services with the delivery of IBM i 7.5 last week, giving IBM i professionals handle new methods for working with various components of the platform. The new releases of the operating system also brings a number of enhancements in the networking stack, which are notable for several reasons.

  The past several new releases and Technology Refreshes (TRs) have brought new IBM i services, which are SQL-based alternatives to traditional ways of accessing things on the platform like IBM i objects, system information, and other components. At this point, IBM has …

  Read more

• Top Five Failures In State of IBM i Security For 2022

  April 18, 2022 Alex Woodie

  HelpSystems last week officially unveiled its annual State of IBM i Security report, the 18th straight year for the series. Like with past reports, the 2022 version highlights some of the continuing challenges that IBM i customers face when trying to secure their systems. A few key areas stand out above the rest.

  The IBM i server is a bit of an enigma when it comes to security. While it is widely perceived to be one of the most secure computing platforms on the planet – and “virus-proof” to boot – the reality is that a good number of IBM …

  Read more

• Glimpsing Hope in the IBM i Security Situation

  April 6, 2022 Alex Woodie

  These are dark days in the security business, thanks to the boom in ransomware, the looming threat of cyberwar with Russia, and the poor security of IBM i servers. But just as it’s darkest before the dawn, there could be some preliminary indications that the IBM i community is finally starting to wake up when it comes to securing their most important applications, systems, and data.

  It’s hard to be optimistic in the face of repeated failures. When it comes to IBM i security, those failures have been well-documented in annual State of Security reports for nearly two decades by …

  Read more

Previous Articles Next Articles