You believe you're safe. But are you sure?

So you've read the title, and I know what you're going to say. No way; not mine. It's a natural response. After all, you take security seriously. You've equipped your client PCs with anti-virus software, and you have solid network security in place on your Power Systems server. But are you certain that's enough?

The government isn't, and that's why many pieces of regulatory legislation and corporate IT guidelines call for anti-virus on all systems and servers within a network. The risk posed by viruses and malicious code is no longer as simplistic as it once was, and the number of vectors against which you must secure has become complex. In this article, we will look at the seriousness of the risk along with the right and wrong ways to go about protecting your systems.

Home Sweet Home

You've probably heard some people say that IBM Power Systems make the perfect safe haven for viruses. But why is this the case? How does the Power Systems server differ from other systems?

First of all, there's an easy justification for stating that anti-virus is not needed on IBM Power Systems: viruses cannot execute on IBM i. You've definitely heard this, and you may believe it yourself. You would be right…at least in terms of traditional viruses. The catch-22, however, is that the fact that traditional viruses can't "run" on IBM i is the very reason that IBM Power Systems make the perfect host.

How do you know when a PC is infected with a virus? It exhibits symptoms. You see that a computer is behaving strangely, is running slowly, or has a file missing. Something is not right, so it's an easy move to scan and clean that computer.

But what happens when there are no symptoms? Because the virus doesn't run on IBM i, it can sit in the Integrated File System (IFS) and you'll never know it's there. From this safe haven, it can infect files that in turn infect client PCs when the infected files are accessed. At that point, the virus executes on the Windows PC, and you rush to clean it off. There's only one problem: you didn't clean the source. The virus is still sitting in the IFS on the Power Systems server, and the next time the infected file is accessed, the infection cycle starts all over again.

This is what makes the server a safe haven and why, to viruses, IBM Power Systems are home sweet home.

The Wrong Way to Scan IBM Power Systems

So you understand that your Power Systems server can host viruses and malicious code, but once you've decided to scan the IFS, there's a right way to do it and there's a wrong way to do it. The right way is to use a native anti-virus solution that has been designed specifically to scan IBM i. We'll get to that a bit later. First, though, let's talk about the wrong way to do it. Many users think that the IFS can be treated like any other mounted volume and scanned from a Windows PC. It seems like an easy and cost-effective solution. In reality, it's dangerous and ineffective. Let's find out why.

There are many reasons that scanning IBM Power Systems from a PC is a bad choice. Here are six key reasons:

• Risk of Infection--The scanning PC itself can infect the Power Systems server.
• Insufficient Effectiveness--PC-based scanning solutions do not understand all features of IBM i. 
• Spotty Reliability--IBM i features such as recursive links can break PC scan processes.
• Poor Performance--All data to be scanned must be transferred across the network.
• Security--Confidential data is visible on the network.
• Increased Time Requirements for SAVCHGOBJ--Every file scanned by a PC is marked as changed as a result of the scan.

Let's look more closely at each of these.

Risk of Infection

When you scan the IFS from a PC, you must log on with *ALLOBJ authority in order for the PC-based scanner to access and scan all files. This may inadvertently lead to infection of the server if the scanning PC itself is infected. It can also open a door that could allow a remote attacker to take control of the system.

Insufficient Effectiveness

The architecture of IBM i can make it impossible for PC-based scanners to detect all viruses stored in the IFS. When files are locked--a common trick used by viruses--the PC scanner cannot scan the file and therefore cannot detect the virus. Since Netserver must be running in order for the PC scanning software to mount and scan the IFS, file locks cannot be disabled. The result is that PC scanners may report infected files as clean because they could not be scanned properly. This has been shown to be the case in tests.

Spotty Reliability

When used to scan the IFS, PC scanning solutions have a big weakness in that you can render your entire scanning effort pointless. The PC-based solution performs fine when scanning its intended target (Windows), but there's something in IBM i that it just can't understand: recursive links. This is a path that loops back on itself--for example, QOpenSysQOpenSysQOpenSys. PC scanning solutions cannot understand this, so the process simply breaks. The scan will begin to loop infinitely, essentially turning off your protection.

Poor Performance

PC-based scanning requires the transfer of all data across the network. This is one of the reasons PC-based scanning is so slow. The increased traffic negatively impacts your overall network performance, which is a deterrent to running scanning during normal hours.

Security

As managers and implementers of technology, it is our responsibility to keep private data private. In some cases, there may be federal and state laws that prohibit leaking confidential data. Yet by scanning the IFS from a PC over a network, all files are sent in the clear without encryption. The data in these files can be easily viewed by anyone on the network using network sniffer programs, which are readily available on the Internet.

Increased Time Requirements for SAVCHGOBJ

PC scanning solutions reset the file's "Last Access Time" information after the file has been scanned. As far as IBM i is concerned, this is recorded as a change to the file and therefore will be saved when using Save Changed Objects (SAVCHGOBJ). The net effect of this is that every scanned file will be saved on a SAVCHGOBJ even though the file contents have not changed. This can have save/restore implications as well as increase the amount of time to perform backups of the IFS.

The Right Way to Scan IBM Power Systems

Now that we've established that your IBM Power Systems server is a safe haven for malicious code--and why using PC-based solutions to scan is the wrong way to go about protecting it--let's look at the right way.

To sufficiently protect IBM i, you need a native solution. It is important not to confuse the term "native solution" with the term "native virus." When we talk about native solutions, we are referring to software written specifically for IBM i for the purpose of detecting viruses. We are not referring to viruses being written specifically to attack IBM i, of which there have been none to date.

So the key to adequate protection is a native solution. But why?

Just as there are reasons that using a PC-based solution is the wrong approach, there are also reasons that using a native solution is the right one. These include:

• Performance--A native solution runs on the server and does not need to transfer data.
• Security--Sensitive information remains within the secure server environment.
• Reliability--Native solutions can find malicious code wherever it may hide in the IFS.
• Monitoring--Native solutions can integrate with your IBM i-based monitoring and notification solutions.
• Constant Protection--Unlike the manual PC process, native solutions can scan "on access" throughout the day.
• Object Integrity Scanning--By using a native solution, you can also check IBM digital signatures for changes.

Beginning with i5/OS V5R3, IBM added virus scanning enablement to the operating system. To enable scanning of the Power Systems server, IBM includes two system values on IBM i that facilitate virus protection. These are QSCANFS and QSCANFSCTL. Let's take a look at how they can help you protect your system in conjunction with a native solution.

Scan File Systems (QSCANFS)

QSCANFS gives you the ability to specify the IFS in which objects will be scanned. This can be useful when scanning for viruses. QSCANFS specifies the IFSes in which objects will be scanned when exit programs are registered with any of the IFS scan-related exit points.

Scan File Systems Control (QSCANFSCTL)

QSCANFSCTL controls the IFS scanning that is enabled when exit programs are registered with any of the IFS scan-related exit points. This value works in conjunction with QSCANFS to provide granular controls on what is scanned in the IFS and how. A set of default scan options are provided, or you can select which scanning options are used, including options that control what the registered exit programs will scan and how. There are seven potential values for QSCANFSCTL to help fine-tune protection.

Native anti-virus solutions are able to tie into these IBM i system values and provide superior protection to help you ensure that your server is not a safe haven for malicious code and that your data is protected.

Additionally, there is one more reason that you need to take seriously the potential of your IBM server to host and distribute malicious code: regulations. As mentioned earlier, governments and experts have recognized the risks presented by viruses, malware, and other malicious code and have put requirements in place that call for anti-virus software. To conclude, let's look at some of these regulations.

The Regulations

At this point, the risk and the need for protection are clear. Understanding the danger academically and taking real-world action are, however, not one and the same. 

Acknowledging that viruses and malicious code pose a real and present danger to corporate stability--and realizing that organizations may be slow to respond--regulators have placed importance on virus protection as a key component of legislation. Such calls to action can be found either directly or indirectly in Sarbanes-Oxley (SOX), Control Objectives for Information and related Technology (COBIT), the Payment Card Industry Data Security Standard (PCI), the International Convergence of Capital Measurement and Capital Standards (BASEL II), the Health Insurance Portability and Accountability Act (HIPAA), the Gramm-Leach-Bliley Act (GLBA), and documents from the National Institute of Standards and Technology (NIST).

Specific references that you may find useful in preparing or enhancing your security plan include these:

Sarbanes-Oxley (SOX)

A common approach to preparing compliance plans for SOX is to use the Control Objectives for Information and related Technology, or COBIT for short. Within COBIT, there are several directives for anti-virus:

DS5.19: Malicious Software Prevention, Detection, and Correction

This objective states that, regarding malicious software, such as computer viruses or Trojan horses, management should establish a framework of adequate preventative, detective, corrective control measures, and occurrence response and reporting. Business and IT management should ensure that procedures are established across the organization to protect information systems and technology from computer viruses. Procedures should incorporate virus protection, detection, occurrence response, and reporting.

DS9.5: Unauthorized Software

This objective specifies that clear policies restricting the use of personal and unlicensed software should be developed and enforced. The organization should use virus-detection-and-remedy software. Business and IT management should periodically check the organization's personal computers for unauthorized software. Compliance with the requirements of software and hardware license agreements should be reviewed on a periodic basis.

Payment Card Industry Data Security Standard (PCI)

PCI is a comprehensive set of worldwide security standards designed to ensure that all merchants and service providers that deal with the storage, transmission, or processing of cardholder data from any major card service are taking adequate steps to protect this information. The writers of PCI clearly laid out their intentions. In a section titled "Detailed Requirements and Security Assessment Procedures," the requirements for anti-virus protection are outlined:

Requirement 5: Use and Regularly Update Anti-Virus Software or Programs

Malicious software, commonly referred to as "malware"--including viruses, worms, and Trojans--enters the network during many business-approved activities, including employees' use of the Internet, email, mobile computers, and storage devices, resulting in the exploitation of system vulnerabilities. Anti-virus software must be used on all systems commonly affected by malware to protect systems from current and evolving malicious software threats.

Health Insurance Portability and Accountability Act (HIPAA)

Passed in 1996, HIPAA establishes federal regulations that force doctors, hospitals, and healthcare providers to adhere to baseline standards when handling Electronic Protected Health Information (ePHI), such as the medical records and accounts of patients.

HIPAA §164.308 (5)(ii)(B)

This portion of HIPAA states that organizations should establish "procedures for guarding

against, detecting, and reporting malicious software."

Gramm-Leach-Bliley Act (GLBA)

Designed to facilitate reform of the financial services industry, GLBA establishes a framework that gives authority to eight federal agencies and the states to administer and enforce the Financial Privacy Rule and the Safeguards Rule.

16 C.F.R. Part 314

This section of the Standards for Insuring the Security, Confidentiality, Integrity and Protection of Customer Records and Information document (page 7, paragraph (b) ) requires each financial institution to ''identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information, and assess the sufficiency of any safeguards in place to control these risks.'' Further, it directs institutions to establish measures for "detecting, preventing, and responding to attacks, intrusions, or other systems failures."

National Institute of Standards and Technology (NIST)

In addition to the above regulations, documents from NIST also call for anti-virus protection. An excerpt from NIST document 800-61 "Computer Security Incident Handling Guide" (page 5-4, 5.2.2) states that "antivirus software is a necessity to combat the threat of malicious code and limit damage. The software should be running on all hosts throughout the organization."

Take Protective Steps Today

If the evolution of malicious code and our understanding of how it can impact IBM Power Systems has done one thing, it is to make it clear that native anti-virus is a critical component of a modern security plan. I encourage you to take protective steps today to secure your IBM Power Systems server. Your network and your organization will be the better for it.

Also Read

IBM i Security Essentials: 4 Components for an Effective Strategy

New IBM i Security Features and a Farewell

Securing IBM i: A Dual Responsibility