When exposing an AS/400 (or any other system, for that matter) to the Internet, you need to pay special attention to security. Proper use of the entire array of AS/400 security tools supplied with OS/400 is required (see “Focus on Security,” MC, May 1998). Set the system security level to 40, change default passwords, turn off autoconfiguration of physical and virtual devices, implement strong passwords and frequent password changes, and disable well-known profiles supplied by IBM (like QSECOFR, QSYSOPR, QPGMR, QSRV, and QSRVBAS). The IBM manual AS/400 Tips and Tools for Securing Your AS/400 V4R4 provides a wealth of information about securing your AS/400.

Also note that a great many Internet security products do not run natively on the AS/400. Rather, these products run on platforms such as the AS/400’s Integrated Netfinity Server (INS) card, outboard PCs, or UNIX servers and provide security services to the AS/400 and other networked systems.

Key Security Services

The National Institute for Standards and Technology (NIST) defines five key security services:

• Authentication is the assurance that the entity at the other end of a connection is what it claims to be. In e-commerce, authentication is a critical service. It is the difference between shipping merchandise to a legitimate customer and sending it to a criminal using a stolen credit card.

• Access control is the assurance that the entity requesting access to a resource (data or a service) is authorized to access that resource. Access control ensures that your customer cannot access a for-fee information service without paying for it first.

• Integrity is the assurance that information is not altered during transmission. Integrity confirms that a hacker has not modified the delivery address in a shipment or altered the price.

• Confidentiality is the assurance that no party other than the intended recipient can intercept information (intentionally or accidentally). Confidentiality services (generally encryption) make the use of credit cards and other forms of payment possible.

• Nonrepudiation (or accountability) is the assurance that a transaction can be proven to have taken place. Nonrepudiation services keep customers from reneging on payment for a stock trade or material order by claiming that they never placed the order.

Your e-commerce security plan should incorporate all five of these services.

E-commerce Network Design

Good e-commerce security starts with good network design. Designing Internet connectivity into your private network generally has multiple—often conflicting—goals, such as the following:
• Allowing users inside your organization’s network to access various Internet resources
• Permitting the exchange of email
• Allowing Internet users access to certain (public or semipublic) resources located within your organization’s network
• Preventing unauthorized access to your private resources by Internet users Even though these are extremely complex goals, you’ll still want the network to be easy to maintain, troubleshoot, configure, and protect. Figure 1 shows a network that is designed with these goals in mind. First, private resources are usually protected behind a firewall. Firewalls are a key component of Internet security. Firewalls filter data flowing between your private network and the Internet. Resources that are intended for public use may be located either inside or outside the firewall. The portion of a network located outside the firewall is called the perimeter network.

In Figure 1, a single server is located in the perimeter network. This server receives inbound Internet requests for Web pages using HTTP or SSL-encrypted HTTP (called HTTPS). This server communicates to the corporate network through the firewall (just like any other Internet-located system) and cannot, of itself, initiate contact with any private resources behind the firewall. Instead, systems behind the firewall may access the public server and initiate requests, or data can be exchanged manually, perhaps by tape transfer.

The resources in the perimeter network are exposed to the Internet and respond to requests from Internet-based users. In this design, Internet users are never allowed to communicate directly with systems located in the private portion of the network. This design affords a high degree of security for those resources located behind the firewall but exposes the public server to a higher degree of risk. You should run only those services (HTTP and HTTPS, for example) that are absolutely required on the public server. Additional measures, such as limiting the number of user profiles, setting complex password rules, and shutting off IP forwarding, can help make your public server much more secure.

Using this type of network design allows the use of restrictive security at the firewall. No Internet users are allowed to initiate contact with systems behind the firewall. The downside to this approach is that e-commerce systems often require immediate access to production data and services, such as current inventory, pricing, or other online information stored in the private network. This design works well, however, when the information located on the public server is relatively static or when daily updates are acceptable.

An alternative is to locate the public server behind the firewall. This configuration creates some exposure for the private network because Internet traffic is allowed to pass in through the firewall. It also places an additional burden on the firewall system because the firewall must now filter all Internet traffic bound for the public server. As you might have guessed, firewall administration is somewhat more complex in this environment. On the plus side, placing the public server behind the firewall and strictly limiting the type of requests allowed through the firewall can reduce the security risks of connecting the public server to production machines where a direct connection is required.

Ring of Fire

The network design that we just discussed relies on a firewall to filter network traffic between the private network and the Internet. Firewalls provide a single point from which to control access between the private network and the Internet. Many firewalls are on the market. Most run on dedicated platforms, UNIX variants, or Windows NT and can contain both software and hardware elements. The IBM Firewall for AS/400 runs on a dedicated INS (formerly known as the IPCS and the FSIOP) that runs a special trimmed-down version of OS/2. The IBM manual Getting Started with IBM Firewall for AS/400 V4R4 has an excellent overview of firewalls and how they work (even if you don’t intend to use the product).

The IBM Firewall for AS/400 has a significant drawback (at least when compared to dedicated firewalls): When the AS/400 goes down or the QSYSWRK subsystem is ended, the firewall shuts down and no traffic can pass between the private and public networks. This is a significant drawback if you plan to run the IBM Firewall for AS/400 on a production box that is taken down regularly for backups and IPLs. In this environment, a dedicated firewall might be a better answer. Popular firewall products—like Network Associates’ Gauntlet, Check Point Software Technologies’ FireWall-1, AXENT Technologies’ Raptor Firewall, and Secure Computing’s Sidewinder Security Server—that run primarily on UNIX variants or NT might prove a better fit in many environments.

Most firewalls hide information about your network, such as IP addresses and operating systems, from Internet users and block certain types of transmissions from entering or leaving your network. Some firewalls log information about various types of inbound and outbound activity, encrypt and decrypt information to keep it secret, and authenticate Internet users allowed past the firewall.

Firewalls use several techniques to hide information about your network from Internet users. In an IP transmission, every packet of data contains a source and destination address. If an Internet user has the address of one of your Internet-connected private systems, that user can attempt to start various services directly on that system. In order to prevent this from happening, the firewall uses either a proxy application or a network address translation (NAT) to convert IP addresses in your private system to the address of the firewall itself or to one of a pool of special addresses reserved for translation purposes.

Figure 2 illustrates NAT. A client (10.1.1.1) in the private portion of the network initiates a request to an Internet-based host system (207.46.130.14). NAT at the firewall causes the address of a firewall-assigned address (204.146.81.99) to be sent as the originating address. As a result, Internet hosts never see the actual IP addresses of systems located within the private network—they see only the address of the firewall. This keeps details of private network structure a secret from Internet users. An additional benefit of NAT is that systems located on the private side of the firewall do not need Internet-routable IP addresses. It can be difficult (and expensive) to obtain large blocks of Internet addresses, so this scheme provides multiple benefits for larger organizations. As of V4R4, OS/400 provides native support for certain firewall-like functions, including NAT and IP filtering.

Don’t Be So Insecure

In order to protect the information your customers send to you over the Internet, you need to implement some sort of encryption technology. Currently, Secure Sockets Layer (SSL) is the most popular form of encryption in use on the Web. SSL (see “Technology Spotlight: An Anatomy of SSL,” MC, August 1998, for details) allows two systems to establish a secure, encrypted session that makes eavesdropping difficult, if not impossible. SSL comes in three basic strengths: 40-bit SSL, which uses a 40-bit encryption key; 56-bit SSL; and 128-bit SSL. Specialized decryption systems can decode 40-bit SSL in less than three hours. Far more secure is 128-bit SSL. When using SSL, specialized encryption hardware is sometimes used to offload the encryption/decryption chore. (In August, IBM announced the 4758 Cryptographic Coprocessor for the AS/400 for just this reason.)

SSL support is built into the IBM HTTP Server for AS/400 (formerly Internet Connection Server). Many other platforms provide SSL support, including Internet Information Server (IIS) on Windows NT, as do popular Web browsers (including Microsoft and Netscape browsers). Significant improvements to SSL support were introduced in OS/400 V4R4, including support for SSL encryption of Telnet sessions and most Client Access Express functions.

Encryption alone, however, is not enough. In addition to establishing secure communications with your customer, you need to verify that it is, indeed, your customer at the other end of the line. Your customer, on the other hand, needs to be sure that she is really sending her credit card information to you and not to some Internet impostor. Finally, you need some way to prove that the order was really placed by that specific customer for the number and price ordered.

Do You Have Some Identification?

Remember our NIST security services: authentication, access control, integrity, confidentiality, and nonrepudiation. You have already seen how firewalls (plus operating system features like passwords and object authority) provide access control and some measure of authentication. Encryption techniques like SSL provide confidentiality and a higher degree of data integrity. Certificate Authorities (CAs), digital certificates, and digital signatures provide enhanced authentication and integrity, plus nonrepudiation.

Digital certificates are the Internet equivalent of passports or other forms of positive identification. Digital signatures, as the name states, provide the digital equivalent of a signature. CAs are trusted entities (governments, financial institutions, or other entities) that verify the identity of Internet users and issue digital certificates. You can even become a CA yourself. (Many organizations do, at least for the purpose of issuing internal digital certificates to employees and customers.) Digital certificates and digital signatures rely upon public key infrastructure (PKI) encryption techniques. You would generally apply to a third-party CA like VeriSign (www.verisign.com) for a digital certificate for your e- commerce server. Users connecting to your server could verify the certificate with the CA and then be able to rest assured that they are really communicating with your organization. Your customer would apply to a CA (either a third party or you) and, after providing satisfactory identification, receive a digital certificate with a corresponding public and private key. The public key is used to encrypt information that is sent to the customer. The customer’s private key is the only way to decrypt a transmission encrypted with the public key.

A digital signature is “signed” by the holder of a certificate using the private key. The signature is sent to the other party, and the public key is used to decrypt the signature and verify that it actually came from the indicated sender.

In order to use SSL and digital certificates, you need to install TCP/IP Connectivity Utilities for AS/400 and the IBM HTTP Server for AS/400. You must also install one of the cryptographic access provider licensed programs (5769-AC1, 5769-AC2, or 5769- AC3) to create certificate keys. These products determine the maximum key length permitted for cryptographic algorithms.

In order to issue and track issued digital certificates, you will need to install IBM Digital Certificate Manager for AS/400 or a third-party solution, like Entrust/PKI (Windows 95/98/NT, Solaris, AIX, and HP-UX).

Email Security and Viruses

E-commerce inevitably means increased inbound and outbound Internet email. Two big email security concerns need to be addressed: computer viruses (inbound and outbound) and confidentiality.

Good, automated virus checking of inbound email is essential. Inbound mail gateways should be protected by server-resident virus protection software. User

workstations should have virus protection software in place. All virus protection software should be updated with new virus signatures on a regular basis. Viruses can be used to compromise network security and to wreak general havoc within your network.

Symantec’s Norton AntiVirus product line includes products for Windows clients and servers, Macintosh, Lotus Notes, Microsoft Exchange, OS/2, NetWare, DOS, firewalls, and Internet email gateways. Regular virus updates are available for download from the Symantec Web site (cafe.symantec.com).

The vast majority of Internet email is sent unencrypted. Email often traverses a number of systems before arriving at its final destination. Business email is likely to include information of a confidential nature: passwords, account numbers, prices, salaries, and personnel information. Email snooping is a popular pastime with some network administrators and Internet Service Providers (ISPs).

A simple solution is email encryption. A number of inexpensive (or free) email encryption solutions solve the problem of email snooping. Microsoft Outlook offers native encryption after you sign up for a digital certificate with a public provider. Network Associates offers Pretty Good Privacy (PGP) in both freeware and supported product implementation. In spite of the name, PGP is secure and widely used. Email encryption uses the same sort of public key cryptography used in SSL. The sender encrypts to the other recipient’s public key. The recipient decrypts using the private key. PGP works with a number of popular email clients.

Be Afraid, Be Very Afraid

Once all of your defenses are in place and your e-commerce system goes live, detection of potential penetration attempts and other security events becomes a significant concern. OS/400 provides a number of excellent tools for monitoring security-related events, including security audit journaling. Firewalls may also provide monitoring capabilities.

Network scanning and activity-monitoring software is designed specifically to help you identify potential threats and to determine exactly what happened in the event of a security breach. Atlanta-based Internet Security Systems (www. iss.net) develops network scanning and intrusion detection software for just this purpose. Network-scanning software allows you to probe your own network for the same sort of vulnerabilities that hackers look for. Intrusion detection software attempts to detect security breaches and provides notification and automated response.

The Internet can be a scary place. Put strong security in place and stick to a rigid security policy. Operate under the assumption that your defenses will be tested—odds are that they will. Be prepared to detect intrusion attempts and deal with them.

Public server Perimeter network Firewall Router

Internet

Figure 1: Here's how to connect a private network to the Internet.

Internet host

207.46.130.14

sees requests as coming from
204.146.81.99

User's PC

Production AS/400

Production NT server

HTTP Request

Internet user

Private
network

Production AS/400

Private network

Firewall

Internet

User's PC
10.1.1.1

Figure 2: Check out this diagram of how NAT works.

Router

Firewall assigns address 204.146.81.99 to 10.1.1.1 for this session

Perimeter network