The unauthorized access, download, and manipulation of proprietary, corporate data—such as the recently reported intrusion at Microsoft in which a hacker leisurely reviewed source code for a yet-to-be-released operating system version—occurs far more often than is reported.

The risk of significant material loss is increasing exponentially as system access opens up beyond company employees to dealers, customers, and the public in general. Companies are beginning to take security issues very seriously and are reporting and assisting in the prosecution of intruder, as well as disciplining employees responsible for securing these systems. Security personnel can face severe disciplinary action, while higher-level executives with direct responsibility for systems may suffer even greater penalties in the wake of such intrusions. For example, a company can be held liable to an injured consumer if appropriate and immediate action is not taken to correct a security breach.

For most IS departments, the real threat will not be a teenager with abounding curiosity and a knack for technology. The 2000 CSI/FBI Computer Crime and Security Survey reported that 71 percent of respondents detected unauthorized access by insiders, while only 25 percent detected an attack from the outside. IS department managers report that they are most concerned with employees who have either recently had their relationship “severed” with the company or feel that termination, for one reason or another, is inevitable, if not imminent. Also, there are employees who don’t have “need to know” responsibilities but possess “want to know” curiosity.

Many experts feel that security is directly related to the education and ethics of users. The underlying message here is that it’s not the computer but the person at the keyboard. For this type of problem, there is no easily implemented firewall.

New Security Exposures

Further compounding the issue for midrange professionals is the evolution of the corporate computing environment, including the ever-evolving nature of OS/400 and networked, heterogeneous computing.

The AS/400 was once the singular, central closed server for all corporate computing. Since the AS/400 was not networked to the outside world except for dial-up and a few point-to-point connections, risk management and risk assessment were easy.

Over time, as the IBM midrange platforms proved exceptionally cost-effective and reliable for managing businesses, simple, secure, locally attached point-to-point connections gave way to open networking.

Networking requirements for interconnectivity—including intranet access, Web server support, publicly accessible extranets, direct TCP/IP access for customers and even potential competitors—increased. The introduction of support for FTP and Client Access alone has created significant security challenges for midrange network security managers. For example, some client/server functions can bypass traditional OS/400 security-checking unless users fully implement object-level security. Without object-level security, a PC- based database tool, such as Microsoft Access, can easily access, update, or delete any data file on an AS/400.

With every new release of OS/400 came the addition of several new exit points. In OS/400, exit points are instances where you register and insert your own programs, overriding default application behaviors. Exit points can be used to call programs, block access to programs, and perform other functions. Exit points are a primary concern from a security standpoint because, among other acceptable and unacceptable system practices, exit point programs can be used to capture passwords. In earlier versions of OS/400, there were only about 30 exit points; now there are hundreds.

System security is often neglected until an incident occurs. Ideally, security planning and implementation should not be a reactive process. Unfortunately, many companies don’t have the resources to implement a security plan. But in the absence of a security plan, the damage a company can sustain through electronic espionage, sabotage, or even simple tampering can be devastating. It’s unsettling to consider the fact that, unlike a hurricane or fire, security degradation can go unnoticed for an extended period of time.

Recently, I heard a story of a new IS director who was hired at a large furniture distribution company in the Midwest. His first big project was to interconnect servers in remote sales offices to a central production AS/400. On the Sunday before these offices were to go live, he dialed into the AS/400 from home to inspect the link. Out of curiosity, he checked Work with Active Jobs (WRKACTJOB) to see if anyone else was logged on. To his surprise, the person he replaced, who was no longer an employee of the company, was signed on with all-object authority. He then checked the history log and learned that this ex-employee had signed on several times since leaving. The new IS director was baffled; he had deleted all old user profiles when he started. After some investigation, he discovered that a program had been written that adopted QSECOFR authority, creating a back door into the system.

Developing a Security Plan

Implementing a cogent system, network, and application security initiative for your company begins with a computer security policy. Generally, the goal of a security policy is to manage access to a specific set of company assets, including data, software, and hardware. The policy should focus on known and probable threats.

The first step in developing a policy is to conduct a risk analysis to identify and document potential risks. By identifying the most probable threats, you will be able to prioritize your investment of time, money, and resources. For example, a data center in Wisconsin need not plan for risks related to tidal actions, but it should prepare for risks posed by disgruntled employees, including the theft of valuable data or software.

The next step in the risk analysis is to determine what assets you need to protect and their approximate value. Topping the list is proprietary information, trade secrets, and financial and personnel data.

A review of business requirements is also an essential part of any security plan. For example, does your company connect a production AS/400 to a public network to allow

Big Risk

sales staff to view inventory levels, pricing information, and available customer credit? Your company’s business requirements may create significant security management issues.

When you have completed the reviews of risk analysis and business requirements, a computer security policy should be constructed. The policy explains the rules and acceptable practices that must be followed in order to protect the company’s data and network assets. The policy also enables the security team to implement the procedures and tools necessary to protect and manage access to your company’s resources.

The overall security plan can be perceived as having two facets: the physical environment and the system environment. The practices pertaining to the physical environment are easier to devise, and periodic security reviews of the physical environment should not take much time.

Reviewing Physical Security

Periodic security audits should review physical security practices regarding control of physical access to computer hardware and media, including production and development infrastructure as well as communications equipment. Access should be restricted for phone switches and building security systems as well. Master copies of licensed software media should be locked up where possible. Make sure there is limited access to the computer system consoles. And, as a matter of housekeeping, don’t leave any security keys in the equipment itself unless necessary for normal operator use.

The first step in restricting access to equipment is to lock the computer room door with key-card access or electronic combination locks. Key-card systems are preferable to electronic combination locks because they are easier to administer, offer more selective access options, and create audit trails. By limiting access to those who really need it, traffic in and out of the computer room will be greatly minimized. Key cards cannot be copied and information about who enters the computer room, and when, is collected. When an employee is terminated, the card can be immediately deactivated. When doing a periodic security audit, it’s important to review key-card systems as well to ensure that access lists are up-to-date.

Reviewing System Environment Security

The scope of environment security on a given system is dictated, to some extent, by what type of business is being conducted. While all companies may have a security risk posed by disgruntled employees, some businesses are more prone to hacking and corporate espionage. Businesses using online credit card authorization and transaction systems, for example, are more likely to suffer from unauthorized access than smaller manufacturers.

Although exposures and requirements differ from business to business, Figure 1 (page 31) provides a checklist of important security areas to review on a regular basis.

It is also important to review backup and recovery plans in the event that a system is either damaged inadvertently by a user or purposefully sabotaged by an intruder. Ensure that the backup and recovery processes will fully protect and fully recover the financial data, trade secret information, and human resources information your company needs to continue or resume operations.

Getting Help

IBM offers the AS/400e Security Advisor on its Web site (www.as400.ibm.com/tstudio/ secure1/advisor/secwiz.htm). If you are new to the AS/400 or to security, or if the environment in which you run your AS/400 has recently changed, this tool will generate a list of recommendations that you can use to get started. Fill out the questionnaire, which requests information pertaining to the use of your AS/400, and the site will provide you with a list of IBM’s recommended security-related system values, along with suggestions for scheduling security audit journal reports. There is no charge for this analysis. Also available is the AS/400 Security Wizard in Operations Navigator (see “Configure Your

AS/400 Security the Easy Way with the New AS/400 Security Wizard,” Shannon O’Donnell, MC, March 1999), which provides similar information.

There are many third-party AS/400 audit/security software products that extend beyond the tools offered in OS/400 and help detect security holes. Generally, these products are designed to analyze your system to find all existing security faults and block all exit points. Security audit tools also monitor activities and report violations. They can notify operators of security issues through system messages or pager messages. Many tools have object and profile monitors that analyze the use of sensitive programs and commands or produce a complete log of a specific profile’s activities. For a comprehensive list of AS/400 security audit software solutions, please refer to www.midrangecomputing. com/yellowpages.

Intrusion detection systems (IDSs) have become an absolute must for businesses using the Internet, as an adjunct to firewall protection. IDSs track user activity from entry to exit, guard against known types of attack, detect network policy violations, and keep tabs on normal network activity, making exceptional behavior easier to identify. Similar to virus scanners, IDSs can either be network-based (by scanning packets of incoming data) or host-based (which means the software is installed on all computers in a network). Network-based IDSs do a good job of restricting unwanted traffic from the outside, and host-based IDSs enable detection of unacceptable activity originating from within the network.

Objective, periodic security audits and reviews conducted by professional, independent organizations can help to reduce the likelihood of material loss resulting from computer misuse. Such focused expertise is invaluable to companies that regularly review procedures and physical and system environments, as well as to those that have just fallen victim to an intruder or are planning an Internet initiative. Since most companies don’t have a security specialist on board, a consultant can be a cost-effective way to button things down.

Randy Ball, an AS/400 security specialist with ComTech Group in Northbrook, Illinois, has conducted several such security audits for AS/400 shops large and small. A widely held belief about system security is that there is an inverse relationship between security and user accessibility to data. Ball feels, however, that the converse is actually true. According to Ball, “The more data you make accessible, the more important security becomes.” His approach to a client’s reviews sometimes span the course of two weeks. After discussing objectives with the client, Ball creates a statement of work. He then looks at the company’s overall security policy, both written and informal, spanning all platforms. He reviews physical security and then all points of access into the AS/400, including local devices, dedicated communication lines, Ethernet connections, and so on. He then reviews system security attributes and compares them with IBM’s recommendations.

Ball says that a lot can be determined by carefully checking user profiles. Of greatest interest to Ball are profiles with default passwords, special authorities, special classes, and all-object authority. He also checks to see if limit capability (LMTCPB(*YES)) is being used for users. Ball then generates a security review document, which includes his observations and recommendations. “It’s very specific and detailed,” says Ball.

Ball reinforces the premise that good system security is a continuous, proactive process and is a firm believer in the use of security audit journaling. “It’s a very powerful tool, which is already built into the system. It offers a great opportunity to do proactive monitoring of your system.” Security audit journaling allows you to monitor what has changed on your system, who has made the change, what programs use adopted authority, and what commands are allowed for public use, among other things.

Be Proactive

When you have established a direction, examine the physical environment to ensure that everything is properly accounted for and buttoned down, then review the system

environment. IBM offers tools, both with OS/400 and online, to help you identify possible security weak points. Third-party software solutions can provide status information on a near real-time basis, and new tools called Intrusion Detection Systems can help protect your network. If you are strapped for time or don’t have the expertise necessary, consultants can help you. They offer objectivity and have valuable experience.

Also, the importance of periodic security audits has increased exponentially due to the evolution of distributed computing and broadened general access to systems. Implementing security requires finite human resources and capital. Often, as security tightens, access to mission-critical data becomes more controlled (which to some means more difficult). It is important to be proactive in matters of system security, and a good place to start is a written security document.

User Profiles • List user profiles using Display User Profiles (DSPUSRPRF)

• Check for old, outdated profiles
• Review for last time they were used, changed, expired, or * disabled
• Note authority level, spool control, and job control capabilities

Remote Entry Points • Display Net Attributes (DSPNETATTR)

• Review options
• Check who signed on to what port
• Check *CMD to see who is connected

System Security Attributes • Display system values using Work System Value (WRKSYSVAL

SYSVAL(*SEC))
• Review password restrictions, failed sign on attempts, etc.

Network Attributes • Display Network Attributes (DSPNETA)

• Review attributes of the network, connections, local location, names, system name, etc.

Object Authority • Display objects by owner

• Display Program Adopt (DSPPGMADPT)
• Review programs that adopt authority in user libraries (Beware of programs buried in QSYS.)

Commands with Public Access • Display Command (DSPCMD) Option*Out

• Query
• Limit to user libraries

Backup and Recovery Plans • Review processes to ensure that all critical business information is regularly backed up and can be fully recovered
• Test recovery processes on a periodic basis

Figure 1: Reviewing security-related system issues on a periodic basis can minimize system misuse.