All over the world, IT auditors are demanding that iSeries managers prove that their systems are secured. Government regulations that require you to protect data on your systems seem to be multiplying like rabbits, and with the advent of Visa and MasterCard's Payment Card Industry (PCI) requirements, we see private industry jumping on the "secure your system" bandwagon. It's not just that these regulations require you to have secure systems; what's new is that they also require you to prove it! And that seemingly simple requirement has upped the ante quite a bit.

Securing your iSeries system can require anything from a major security project to a few minor tweaks. But even companies on the low end of the change requirement spectrum are finding that complying with regulations is incredibly costly and resource-intensive. The crux of the issue is that compliance requires constant attention, usually from your most expensive and overtaxed resources (you!). The secret to getting compliance right is to have automated, repeatable processes that can highlight the exceptions and vulnerabilities that warrant your attention.

Traditionally, in shops where any sort of auditing or vulnerability assessments were done, the usual practice was to run a few commands, print a couple queries, and produce spool file reports that reiterate operating system level information about how the system is set up. But this approach has some deficiencies. First, you must already have a high level of understanding of OS/400 security concepts to even know what to look for. Second, once you've extracted the data, it has to be interpreted in order to be meaningful to anyone but a true OS/400 expert. Third, you need to create a historical archive of this information in order to prove to your auditors that you are not only secure now, but have been secure all along. And there is a fourth problem: You've got your regular job to do as well.

Today, proving that you're secure usually means having to translate OS/400 system settings into business concepts that auditors, managers, and executives can understand. What iSeries shops need is an automated method of rendering critical security data into a format that speaks directly to non-iSeries audiences. PowerLock ComplianceMonitor is specifically designed to solve these very challenges.


(Click image to enlarge.)

ComplianceMonitor can collect security information from multiple AS/400 and/or iSeries i5 systems and consolidate it into a single database. This database can then be interrogated to produce any number of reports that your auditors may require. And because the information is kept in a database, it's easy to store and retrieve past audit runs. You can compare the results of audits for System 1 to those of System 2, or look at the last three audits of System 3 to see what changed. And because no two auditors seem to request the same sets of data, ComplianceMonitor also includes comprehensive sorting and filtering tools that allow you to create and save custom compliance report templates that can be run again and again.

Auditors, managers, and executives can receive color scorecards that outline your compliance with policy in easy-to-understand graphical representations. Red, yellow, and green indicators tell you what areas of your system need attention, and weighted scores help you stay in line with your corporate security policy.

You say you don't have a security policy? ComplianceMonitor includes a policy that is based on the best practices of iSeries shops like yours. Rather than forcing you to spend days in a shuttered room dreaming up a policy that is later enshrined in a three-ring binder on a shelf, ComplianceMonitor ships with an active policy that is measured automatically by the software. You can use the policy that PowerTech provides or modify it to suit your own operational requirements. In either case, your policy is embedded in the software so that your system settings can be measured against the policy every day.

If you think compliance is expensive, complicated, and burdensome, then you owe it to yourself to look at PowerLock ComplianceMonitor. New security regulations are changing the ways we do business in many ways. And though you may be running the world's most secure system, the auditors are still going to ask you to prove it.

Learn more about PowerLock ComplianceMonitor at www.powertech.com. And check out PowerTech's other offerings in the MC Showcase Buyer's Guide.

John Earl is Vice President and CTO of The PowerTech Group. He can be reached at This email address is being protected from spambots. You need JavaScript enabled to view it..