05
Sat, Oct
2 New Articles

13 Ways to Write Secure Applications and Boost IBM i Security

IBM i (OS/400, i5/OS)
Typography
  • Smaller Small Medium Big Bigger
  • Default Helvetica Segoe Georgia Times

Programmers are the linchpin when establishing secure applications.

 

Security. It surrounds every aspect of life in the new millennium, and it's never going away. Human nature is such that anytime we're told there's something we shouldn't do or somewhere we shouldn't go, someone is always going to do exactly that and go precisely there. This is especially true when there's some gain to be had by violating the rules.

 

The proof? Barely a day passes without new headlines reporting another cyber attack, policy violation, or data breach. Secretly, we breathe a sigh of relief that it happened to someone else, but most of us know that we'll all eventually feel the impact in some capacity. Maybe it'll manifest itself through increased bank fees, higher retail prices, or more hoops to jump through when we log in to our corporate firewall. And eventually it could—nay, it will—be us that it happens to.

 

So who's responsible for the security of an IBM i server and DB2 database? IBM builds the hardware and develops the operating system, application vendors and internal programmers write the business applications, and users maintain the corporate data. Who shoulders the responsibility for its integrity and its protection? After more than a decade of working as a security specialist, my answer is a resounding "EVERYONE!"

 

IBM has done their part. Power Systems servers running IBM i have garnered an envious reputation for being some of the most securable servers on the planet, with numerous world-class integrity features. Notice I said securable instead of secure. A popular annual study on IBM i security reports alarming statistics showing that most of these servers are operating with default—and largely open—security configurations. You would never assume a server running Windows is secure, and you should never assume it with one running IBM i.

 

System users, such as programmers and administrators, should be managed by a combination of their profile settings and good auditing controls. Application users should be managed by the applications. Ultimately, however, users will do whatever applications allow, not necessarily only what they're designed to do. And it's programmers who build those applications, so we have to talk about how to build a more secure application.

 

The goal of this article is to identify important development considerations that will empower programmers to enhance the security of our data rather than undermine it.

Docu-what?

Personal experience has taught me that documentation is a dirty word to many in the programming community. It hampers our simple desire to code. But documentation is also the map that guides future travelers. Without it, every enhancement and bug fix begins with a time-consuming discovery task and increases the likelihood that the application could be broken by the change. Before a single line of code is written, planning documents should identify operational requirements such as these:

  • Application libraries
  • Profile ownership
  • Authorization lists
  • Authority schemes—public and private
  • Runtime attributes

 

Documentation should also be embedded in the application programs. Comments should be clear, concise, and in plain English (or your language of choice). In other words, do not simply repeat what any programmer can read from looking at the code.

Segregate Libraries

When building an application, many programmers lump all of the objects into a single library as it seems simpler on the surface. However, programs and files typically have different security requirements, and having them cohabit can make securing them more complicated. Segregating non-data objects and data objects into different libraries permits library-level security to control access.

 

"Softcode" Library Lists

I was taught that hard-coding a library name into a program was a cardinal sin, but we've learned that search path manipulation is an easy way to wreak havoc and even circumvent security. An acceptable balance may be found by storing library names in data objects, such as data areas, so that they cannot be altered by users but can be changed without requiring modifications to the application code.

 

Own Your Objects

Every object has an owner, and if you've ever had to delete a user's profile, then you understand why ownership shouldn't be retained by the programmer. Objects should never be owned by a group profile, especially one that consolidates the application users; each member would indirectly own the objects, giving them excess privileges. Instead, create a profile that has only one purpose in life: to own the application objects. Just remember, if new objects are created during the execution of the application, the program should also establish the correct ownership and authorities. And try to avoid assigning ownership to IBM-supplied profiles because if anyone—including IBM—makes a change to the profile, it might have an unpredictable impact on the application.

 

Design the Database

Take time to classify the data in order to identify how stringent the access control should be. For a simple scheme, consider public, semi-public, and private. The database should be normalized to prevent information redundancy, and I recommend encrypting fields that are classified as private. Strong encryption functions are inherent within IBM i, and third-party providers can assist if code modification isn't possible. Journaling is a popular technique that originated with application recovery and now has uses for replication and for auditing. Consider collecting before and after images of data changes in critical files and archiving that journal data according to corporate policy and compliance mandates.

 

Read the Menu

Application menus were a solid approach to security back when terminal displays were the only way to access data. However, they fall flat on their face now that other interfaces exist that can facilitate direct access to the database. There's nothing wrong with using menus to improve the user experience and to restrict user movement, but don't rely on them to police data access. When a user steps outside the constraints of a menu, other controls such as command line restrictions, object-level security, and exit programs become even more critical.

 

Good Code

While it seems obvious, write good code! My development career exposed me to some of the most horrendous applications I could imagine. Unwieldy programs with unmanageable top-down design, missing—or worse, inaccurate—comments, and redundant functions. Programs that are modular, concisely coded, and well-documented are easier to maintain and easier to review for unauthorized code modifications. ILE constructs make this easy, and you should be taking advantage of them.

 

Public and Private Authority

IBM i contains a unique concept known as *PUBLIC. This is the default level of access granted to a user who hasn't been assigned a more-specific access level. Many open configurations on servers running IBM i can be traced to the fact that IBM ships the default *PUBLIC authority level as *CHANGE, which is sufficient to read, change, and delete data in a file. Public authority is determined when the object is created from a parameter on the associated create command. By default, the command defers to a library attribute and that, in turn, defers to the QCRTAUT system value. I recommend setting the appropriate explicit value on the library as it allows different defaults to be used for each application library. The popular "deny by default" data access model calls for the public to be excluded, and the application users—or better yet, user groups—with a demonstrable need are granted private authority.

 

Authorization Lists

Granting authority to hundreds or even thousands of individual objects can be an overwhelming administrative chore. Authorization lists allow many objects to be addressed as a single entity and are a useful mechanism. A significant benefit of using lists is that authorities can be maintained while the associated objects are in use. This can be very beneficial in a 24x7 shop where obtaining object locks can be a monumental task. Just remember that *PUBLIC authority will come from the individual object unless you specify otherwise.

 

Adopted Authority and Profile Swapping

Two techniques are available to allow a program to run with different authority than the user who invoked it. Instead of granting authority to individuals or even groups, authority can be elevated temporarily while the program is running, alleviating the requirement to grant authority to the users themselves. In the case of adoption, a runtime attribute on the program object controls the inheritance. Both special and private authority is culled from the owner of the program, which is beneficial if following the recommendation of using a unique owning profile. Profile swapping allows a user to assume the identity of another and is accomplished via calls to several easy-to-use IBM-supplied APIs. Both approaches have pros and cons, and more detailed information can be found using your search engine of choice. Overall, these are two of the most useful functions in a security-conscious programmer's toolbox.

 

Cover Your Exits

IBM i contains a registry of exit points, which are almost like subroutines in the OS's functions. When a function is invoked, the OS can pass control temporarily to the assigned exit program—if one exists—to perform any ancillary task before the OS resumes control and processes the request. There are dozens of exit points in several different categories, but about 30 of them pertain to network access and should be considered critical. While object-level security remains effective during these requests, the OS can only enforce one setting across all interfaces, so a user who can change data on a green-screen can also change data through an FTP or ODBC connection. While these exit programs can be written in-house, regulatory compliance typically frowns upon self-policing, so I strongly recommend evaluating a commercial solution to selectively process and audit user requests. Preventing data leaks is a requirement shared between exit programs and object-level security.

 

Plan for High Availability

Surprising to some, system availability is often a requirement of regulatory compliance. Keeping systems running in the face of a technological disaster is a popular business initiative and one that continues to grow in popularity. When designing a new application, consider the expectation that the application may need to be replicated. A side-benefit of journaling for HA purposes is the audit and recovery trail that can be built into the application.

 

Query and Other Tools

When designing a security infrastructure, consider how the application data will be accessed. Programs can use adoption to temporarily access secured files, but other tools may not have that luxury. Placing the invocation command for a native tool (e.g., WRKQRY) inside a CL "wrapper" can allow it to take advantage of the same technique. Consider authorizing some generic profiles to the authorization list to allow users to access data in a limited capacity. For example, grant *USE access to a profile named READONLY and then swap to that profile if a user needs to use ODBC or Query to view the data. If data is encrypted, native reports may have to be authored if plain-text viewing or reporting is required.

 

Summary

In my capacity as an auditor, I discover vulnerabilities on hundreds of servers every year. In the vast majority of cases, these servers are poorly configured and are running applications that rely heavily on legacy security mechanisms or have no security considerations at all. Ironically, many of those same organizations blame IBM for allowing users to extract data, instead of taking responsibility and investing in the design of a secure application.

 

Programmers are the linchpin when establishing secure applications. Regardless of whether they're developing internal solutions or commercial products, acknowledge the risk posed by not having their cooperation, train them in security functions, and work to obtain their buy-in regarding the fact that securing an app is one of the most critical aspects of securing data and maintaining compliance.

Robin Tatam

Robin Tatam is the Director of Security Technologies for PowerTech, a leading provider of security solutions for the System i. As a frequent speaker on security topics, he was also co-author of the Redbook IBM System i Security: Protecting i5/OS Data with Encryption. Robin can be reached at 952.563.2768 or This email address is being protected from spambots. You need JavaScript enabled to view it..

BLOG COMMENTS POWERED BY DISQUS

LATEST COMMENTS

Support MC Press Online

$

Book Reviews

Resource Center

  • SB Profound WC 5536 Have you been wondering about Node.js? Our free Node.js Webinar Series takes you from total beginner to creating a fully-functional IBM i Node.js business application. You can find Part 1 here. In Part 2 of our free Node.js Webinar Series, Brian May teaches you the different tooling options available for writing code, debugging, and using Git for version control. Brian will briefly discuss the different tools available, and demonstrate his preferred setup for Node development on IBM i or any platform. Attend this webinar to learn:

  • SB Profound WP 5539More than ever, there is a demand for IT to deliver innovation. Your IBM i has been an essential part of your business operations for years. However, your organization may struggle to maintain the current system and implement new projects. The thousands of customers we've worked with and surveyed state that expectations regarding the digital footprint and vision of the company are not aligned with the current IT environment.

  • SB HelpSystems ROBOT Generic IBM announced the E1080 servers using the latest Power10 processor in September 2021. The most powerful processor from IBM to date, Power10 is designed to handle the demands of doing business in today’s high-tech atmosphere, including running cloud applications, supporting big data, and managing AI workloads. But what does Power10 mean for your data center? In this recorded webinar, IBMers Dan Sundt and Dylan Boday join IBM Power Champion Tom Huntington for a discussion on why Power10 technology is the right strategic investment if you run IBM i, AIX, or Linux. In this action-packed hour, Tom will share trends from the IBM i and AIX user communities while Dan and Dylan dive into the tech specs for key hardware, including:

  • Magic MarkTRY the one package that solves all your document design and printing challenges on all your platforms. Produce bar code labels, electronic forms, ad hoc reports, and RFID tags – without programming! MarkMagic is the only document design and print solution that combines report writing, WYSIWYG label and forms design, and conditional printing in one integrated product. Make sure your data survives when catastrophe hits. Request your trial now!  Request Now.

  • SB HelpSystems ROBOT GenericForms of ransomware has been around for over 30 years, and with more and more organizations suffering attacks each year, it continues to endure. What has made ransomware such a durable threat and what is the best way to combat it? In order to prevent ransomware, organizations must first understand how it works.

  • SB HelpSystems ROBOT GenericIT security is a top priority for businesses around the world, but most IBM i pros don’t know where to begin—and most cybersecurity experts don’t know IBM i. In this session, Robin Tatam explores the business impact of lax IBM i security, the top vulnerabilities putting IBM i at risk, and the steps you can take to protect your organization. If you’re looking to avoid unexpected downtime or corrupted data, you don’t want to miss this session.

  • SB HelpSystems ROBOT GenericCan you trust all of your users all of the time? A typical end user receives 16 malicious emails each month, but only 17 percent of these phishing campaigns are reported to IT. Once an attack is underway, most organizations won’t discover the breach until six months later. A staggering amount of damage can occur in that time. Despite these risks, 93 percent of organizations are leaving their IBM i systems vulnerable to cybercrime. In this on-demand webinar, IBM i security experts Robin Tatam and Sandi Moore will reveal:

  • FORTRA Disaster protection is vital to every business. Yet, it often consists of patched together procedures that are prone to error. From automatic backups to data encryption to media management, Robot automates the routine (yet often complex) tasks of iSeries backup and recovery, saving you time and money and making the process safer and more reliable. Automate your backups with the Robot Backup and Recovery Solution. Key features include:

  • FORTRAManaging messages on your IBM i can be more than a full-time job if you have to do it manually. Messages need a response and resources must be monitored—often over multiple systems and across platforms. How can you be sure you won’t miss important system events? Automate your message center with the Robot Message Management Solution. Key features include:

  • FORTRAThe thought of printing, distributing, and storing iSeries reports manually may reduce you to tears. Paper and labor costs associated with report generation can spiral out of control. Mountains of paper threaten to swamp your files. Robot automates report bursting, distribution, bundling, and archiving, and offers secure, selective online report viewing. Manage your reports with the Robot Report Management Solution. Key features include:

  • FORTRAFor over 30 years, Robot has been a leader in systems management for IBM i. With batch job creation and scheduling at its core, the Robot Job Scheduling Solution reduces the opportunity for human error and helps you maintain service levels, automating even the biggest, most complex runbooks. Manage your job schedule with the Robot Job Scheduling Solution. Key features include:

  • LANSA Business users want new applications now. Market and regulatory pressures require faster application updates and delivery into production. Your IBM i developers may be approaching retirement, and you see no sure way to fill their positions with experienced developers. In addition, you may be caught between maintaining your existing applications and the uncertainty of moving to something new.

  • LANSAWhen it comes to creating your business applications, there are hundreds of coding platforms and programming languages to choose from. These options range from very complex traditional programming languages to Low-Code platforms where sometimes no traditional coding experience is needed. Download our whitepaper, The Power of Writing Code in a Low-Code Solution, and:

  • LANSASupply Chain is becoming increasingly complex and unpredictable. From raw materials for manufacturing to food supply chains, the journey from source to production to delivery to consumers is marred with inefficiencies, manual processes, shortages, recalls, counterfeits, and scandals. In this webinar, we discuss how:

  • The MC Resource Centers bring you the widest selection of white papers, trial software, and on-demand webcasts for you to choose from. >> Review the list of White Papers, Trial Software or On-Demand Webcast at the MC Press Resource Center. >> Add the items to yru Cart and complet he checkout process and submit

  • Profound Logic Have you been wondering about Node.js? Our free Node.js Webinar Series takes you from total beginner to creating a fully-functional IBM i Node.js business application.

  • SB Profound WC 5536Join us for this hour-long webcast that will explore:

  • Fortra IT managers hoping to find new IBM i talent are discovering that the pool of experienced RPG programmers and operators or administrators with intimate knowledge of the operating system and the applications that run on it is small. This begs the question: How will you manage the platform that supports such a big part of your business? This guide offers strategies and software suggestions to help you plan IT staffing and resources and smooth the transition after your AS/400 talent retires. Read on to learn: