21
Thu, Nov
1 New Articles

Implementing Compensating Controls When IBM i Security Best Practices Aren’t Possible

IBM i (OS/400, i5/OS)
Typography
  • Smaller Small Medium Big Bigger
  • Default Helvetica Segoe Georgia Times

 

What can organizations do when using “best practices” settings cause something to break? This article discusses your options.

Of course, implementing what is recommended as a “best practice” is what you should strive to do. However, I’ve found that there are instances when implementing a best practice setting in its most literal sense will cause issues. What should you do? Ignore that aspect of security and move on? No. You’ll want to find an alternative solution that meets the spirit of the best practice recommendation but fulfills it differently. In the security and audit world, that’s called a “compensating control.” Let’s look at some examples.

Inactive Session Time-Out

In addition to being required by several laws and regulations, this best practice just makes common sense. The best practice recommendation is to time-out a device after no more than 15 minutes of activity. You don’t want a device that’s been signed on left in a state where it can be used by someone else. For an IBM i shop, that would imply that the QINACTITV system value be set to 15. However, I’ve encountered numerous organizations for which this would cause issues—either in their application directly or with their user community. The compensating control? Time-out the entire workstation using a group policy at the network level. This avoids timing out the IBM i session when the user is doing something else on their PC. I like this compensating control because it protects more than just the IBM i session; it protects all of the information and restricts the tasks that are enabled on the workstation. If the time-out is reached on the workstation, when the user returns, they have to re-enter their network password. Another compensating control that some organizations use—but in my opinion is far from effective—is to have a written policy that users should lock their workstation when leaving their work area. It’s a good policy to have, but, to me, it’s not a compensating control because it depends on the appropriate behavior of an individual rather than technology that doesn’t forget to take an action when it’s late for a meeting!

All Passwords Must Be Changed Every 90 Days

While this best practice requirement may not be an issue to implement for profiles used for signon, what about those profiles used as service accounts—that is, those profiles used to make connections using ODBC and FTP? Obviously, having these profiles expire has the potential to cause processes to fail if you forget to change the password ahead of the expiration. And changing these passwords often requires careful coordination between two or more servers. Therefore, in most organizations, service accounts are configured with a non-expiring password. That is, PWDEXPITV(*NOMAX).

But with a non-expiring password and the fact that service account passwords are often known by multiple people, you’ll want a compensating control that limits how the profile can be used. First, when you configure the profile, set the Initial program (INLPGM) to *NONE, Initial menu (INLMNU) to *SIGNOFF, Attention program (ATNPGM) to *NONE, and Limited capability (LMTCPB) to *YES. This ensures the profile can’t be used at a signon screen.

But what about a service account used by a WebSphere application? It needs to make a JDBC connection but should not be used for DDM or FTP. In this case, the best solution is to limit what the profile can be used for via an exit program. If you have an exit point solution such as the Powertech Network Security product, you can put rules in place that will allow you to very tightly configure what connections service accounts are allowed to make. If you don’t have an exit point solution, you can use the Application Administration or Function usage feature of IBM i to disallow connections for ODBC/JDBC, DDM/DRDA, and FTP. For example, if you want to prevent the service account making that JDBC connection from using FTP or DDM, you’d go into the Host Applications tab of Application Administration and customize the access by running either of the following commands (either method accomplishes the same thing).

            CHGFCNUSG FCNID(QIBM_QTMF_CLIENT_REQ_0) USER(SRV_ACCT1) USAGE(*DENIED)

      CHGFCNUSG FCNID(QIBM_DB_DDMDRDA) USER(SRV_ACCT1) USAGE(*DENIED)

           

While not as complete a compensating control as using an exit program, using Application Administration to limit service accounts is better than doing nothing when service accounts are required to have a non-expiring password.

Audit All Actions

While some organizations have excess storage capacity, many do not. Therefore, turning on all of the IBM i auditing options may cause serious storage issues and/or you may be tempted to not save the audit journal receivers and just delete them from the system as soon as a new one is generated and attached. Or you may choose to not enable auditing at all. None of these options comes close to being a substitute for “Audit all actions.” What you can do in this situation is make an educated decision about what is appropriate to audit in your organization. When you make this educated decision, be sure to document your reasoning should an auditor ever ask why more features aren’t enabled.

The answer to “What should be audited?” is not a one-size-fits-all answer. The answer depends on the details of your organization. As you determine what to audit, remember that one of your goals should be to have enough information retained such that you could conduct a thorough forensic investigation if required. Another consideration are any laws or regulations with which your organization must comply. Finally, consider the information that would be helpful for system administrators in their daily work.

Here are some guidelines that should help in your decision-making process:

  • My recommendation for the most basic auditing requirements is the following: QAUDLVL set to *AUTFAIL, *CREATE, *DELETE, *PTFOPR (V7R2 and above), *SAVRST, *SECCFG, *SECRUN, *SERVICE.
  • Beyond that, you may choose to enable many of the other types of auditing, all of which provide good and useful information. However, some have the potential of creating a lot of entries. These include *JOBDTA, *SPLFDTA, and *PGMADP. Whether you enable these will depend on the value of the information to your organization. For example, if you have a lot of users with *JOBCTL special authority, you may want to add *JOBDTA or *JOBBAS (a subset of *JOBDTA) to QAUDLVL in the event you need to debug how a job was ended or held.
  • Consider turning on additional auditing at the user level rather than the system value level. For example, if you want to know when certain profiles such as QSECOFR are being used but don’t want to enable *JOBDTA for the entire system, you can enable *JOBDTA at the individual level using the Change User Auditing (CHGUSRAUD) command.

Another audit best practice requirement is to audit all users who have command-line access. This means enabling *CMD auditing for all profiles whose limited capability setting is either *NO or *PARTIAL. This shouldn’t be an issue if you have your user profile settings under control. But for those organizations that haven’t made sure all non-administrative profiles are limited capability *YES, this could be an overwhelming amount of audit entries. If enabling auditing on all profiles that are LMTCPB *NO or *PARTIAL is out of the question, then at least enable *CMD auditing on all profiles with *ALLOBJ special authority that can be used for signon.

While neither resolution fully addresses the best practice auditing requirements, determining how to best implement auditing within the restrictions of your environment is key to coming as close to security best practices as possible.

Some Best Practices Have No Compensating Controls

While some best practice settings have a good alternative, some do not.

Running at QSECURITY Level 40 or 50

You can guarantee neither operating system nor data integrity at 30 or below. Users can easily run as a profile with higher authorities, and some auditing may be bypassed at lower security levels. The only option to meet this requirement is to run the system at QSECURITY level 40 or 50.

Default Passwords

I have recently heard two justifications for default passwords, neither of which justify (are compensating controls for) the use of default passwords:

  1. The password is set to *EXPIRED. The justification is that the person signing on will have to set it to a different password. How is that protection for inappropriate use of a profile? The person exploiting the profile changes the password, signs on, and does whatever deed they’re trying to accomplish. The damage is done; an expired password doesn’t prevent that.
  2. The profile has been set to INLPGM(*NONE) and INLMNU(*SIGNOFF), meaning that the profile can’t be used to sign on to a 5250 emulation session. While that’s true, as I discussed in the previous section, this reasoning totally ignores the potential of the default password being used to make an ODBC connection, download a file via FTP or submit a remote command!

Summary

While implementing best practices may be an all-or-nothing in some cases, in many instances it’s not. Rather than ignore the best practice and do nothing, I encourage you to find a way to implement a compensating control to fulfill the intent of the requirement.

 

Carol Woodbury

 

Carol Woodbury is IBM i Security SME and Senior Advisor to Kisco Systems, a firm focused on providing IBM i security solutions. Carol has over 30 years’ experience with IBM i security, starting her career as Security Team Leader and Chief Engineering Manager for iSeries Security at IBM in Rochester, MN. Since leaving IBM, she has co-founded two companies: SkyView Partners and DXR Security. Her practical experience and her intimate knowledge of the system combine for a unique viewpoint and experience level that cannot be matched.

Carol is known worldwide as an author and award-winning speaker on security technology, specializing in IBM i security topics. She has written seven books on IBM i security, including her two current books, IBM i Security Administration and Compliance, 3rd Edition and Mastering IBM i Security, A Modern, Step-by-Step Approach. Carol has been named an IBM Champion since 2018 and holds her CISSP and CRISC security certifications.


MC Press books written by Carol Woodbury available now on the MC Press Bookstore.

IBM i Security Administration and Compliance: Third Edition
Don't miss the newest edition by the industry’s #1 IBM i security expert.
List Price $71.95

Now On Sale

Mastering IBM i Security Mastering IBM i Security
Get the must-have guide by the industry’s #1 security authority.
List Price $49.95

Now On Sale

BLOG COMMENTS POWERED BY DISQUS

LATEST COMMENTS

Support MC Press Online

$

Book Reviews

Resource Center

  • SB Profound WC 5536 Have you been wondering about Node.js? Our free Node.js Webinar Series takes you from total beginner to creating a fully-functional IBM i Node.js business application. You can find Part 1 here. In Part 2 of our free Node.js Webinar Series, Brian May teaches you the different tooling options available for writing code, debugging, and using Git for version control. Brian will briefly discuss the different tools available, and demonstrate his preferred setup for Node development on IBM i or any platform. Attend this webinar to learn:

  • SB Profound WP 5539More than ever, there is a demand for IT to deliver innovation. Your IBM i has been an essential part of your business operations for years. However, your organization may struggle to maintain the current system and implement new projects. The thousands of customers we've worked with and surveyed state that expectations regarding the digital footprint and vision of the company are not aligned with the current IT environment.

  • SB HelpSystems ROBOT Generic IBM announced the E1080 servers using the latest Power10 processor in September 2021. The most powerful processor from IBM to date, Power10 is designed to handle the demands of doing business in today’s high-tech atmosphere, including running cloud applications, supporting big data, and managing AI workloads. But what does Power10 mean for your data center? In this recorded webinar, IBMers Dan Sundt and Dylan Boday join IBM Power Champion Tom Huntington for a discussion on why Power10 technology is the right strategic investment if you run IBM i, AIX, or Linux. In this action-packed hour, Tom will share trends from the IBM i and AIX user communities while Dan and Dylan dive into the tech specs for key hardware, including:

  • Magic MarkTRY the one package that solves all your document design and printing challenges on all your platforms. Produce bar code labels, electronic forms, ad hoc reports, and RFID tags – without programming! MarkMagic is the only document design and print solution that combines report writing, WYSIWYG label and forms design, and conditional printing in one integrated product. Make sure your data survives when catastrophe hits. Request your trial now!  Request Now.

  • SB HelpSystems ROBOT GenericForms of ransomware has been around for over 30 years, and with more and more organizations suffering attacks each year, it continues to endure. What has made ransomware such a durable threat and what is the best way to combat it? In order to prevent ransomware, organizations must first understand how it works.

  • SB HelpSystems ROBOT GenericIT security is a top priority for businesses around the world, but most IBM i pros don’t know where to begin—and most cybersecurity experts don’t know IBM i. In this session, Robin Tatam explores the business impact of lax IBM i security, the top vulnerabilities putting IBM i at risk, and the steps you can take to protect your organization. If you’re looking to avoid unexpected downtime or corrupted data, you don’t want to miss this session.

  • SB HelpSystems ROBOT GenericCan you trust all of your users all of the time? A typical end user receives 16 malicious emails each month, but only 17 percent of these phishing campaigns are reported to IT. Once an attack is underway, most organizations won’t discover the breach until six months later. A staggering amount of damage can occur in that time. Despite these risks, 93 percent of organizations are leaving their IBM i systems vulnerable to cybercrime. In this on-demand webinar, IBM i security experts Robin Tatam and Sandi Moore will reveal:

  • FORTRA Disaster protection is vital to every business. Yet, it often consists of patched together procedures that are prone to error. From automatic backups to data encryption to media management, Robot automates the routine (yet often complex) tasks of iSeries backup and recovery, saving you time and money and making the process safer and more reliable. Automate your backups with the Robot Backup and Recovery Solution. Key features include:

  • FORTRAManaging messages on your IBM i can be more than a full-time job if you have to do it manually. Messages need a response and resources must be monitored—often over multiple systems and across platforms. How can you be sure you won’t miss important system events? Automate your message center with the Robot Message Management Solution. Key features include:

  • FORTRAThe thought of printing, distributing, and storing iSeries reports manually may reduce you to tears. Paper and labor costs associated with report generation can spiral out of control. Mountains of paper threaten to swamp your files. Robot automates report bursting, distribution, bundling, and archiving, and offers secure, selective online report viewing. Manage your reports with the Robot Report Management Solution. Key features include:

  • FORTRAFor over 30 years, Robot has been a leader in systems management for IBM i. With batch job creation and scheduling at its core, the Robot Job Scheduling Solution reduces the opportunity for human error and helps you maintain service levels, automating even the biggest, most complex runbooks. Manage your job schedule with the Robot Job Scheduling Solution. Key features include:

  • LANSA Business users want new applications now. Market and regulatory pressures require faster application updates and delivery into production. Your IBM i developers may be approaching retirement, and you see no sure way to fill their positions with experienced developers. In addition, you may be caught between maintaining your existing applications and the uncertainty of moving to something new.

  • LANSAWhen it comes to creating your business applications, there are hundreds of coding platforms and programming languages to choose from. These options range from very complex traditional programming languages to Low-Code platforms where sometimes no traditional coding experience is needed. Download our whitepaper, The Power of Writing Code in a Low-Code Solution, and:

  • LANSASupply Chain is becoming increasingly complex and unpredictable. From raw materials for manufacturing to food supply chains, the journey from source to production to delivery to consumers is marred with inefficiencies, manual processes, shortages, recalls, counterfeits, and scandals. In this webinar, we discuss how:

  • The MC Resource Centers bring you the widest selection of white papers, trial software, and on-demand webcasts for you to choose from. >> Review the list of White Papers, Trial Software or On-Demand Webcast at the MC Press Resource Center. >> Add the items to yru Cart and complet he checkout process and submit

  • Profound Logic Have you been wondering about Node.js? Our free Node.js Webinar Series takes you from total beginner to creating a fully-functional IBM i Node.js business application.

  • SB Profound WC 5536Join us for this hour-long webcast that will explore:

  • Fortra IT managers hoping to find new IBM i talent are discovering that the pool of experienced RPG programmers and operators or administrators with intimate knowledge of the operating system and the applications that run on it is small. This begs the question: How will you manage the platform that supports such a big part of your business? This guide offers strategies and software suggestions to help you plan IT staffing and resources and smooth the transition after your AS/400 talent retires. Read on to learn: