When I say I am thankful for the features of OS/400 security, I'm serious. After all, those features have given me a career both at IBM and now in my own business. So I thought that you might appreciate a discussion of those features.

A Strong Team in Rochester

Let's give credit where credit is due: to the architects, designers, and coders of not just OS/400 security but all of OS/400, System Licensed Internal Code (SLIC), and the AS/400 and iSeries hardware. Throughout the years, they have understood that integrated security is one of the key features of this system and, almost without exception, have added new features each release. In addition, IBM regularly adds integrity features that you'll never read about in the New Release Announcement documentation to ensure the integrity of data residing on OS/400 as well as the integrity of OS/400 itself. Unlike Microsoft, which started a security initiative to educate their programmers only within the last couple of years, developers at IBM Rochester have it drilled into their heads from the time they author their first design document that designs and the subsequent implementation must follow certain standards.

I am so thankful that I don't get those pop-up balloons stating "New updates are ready for download" every time I log on to my iSeries like I do when I log on to my Windows-based PC. Have you ever compared the number of integrity PTFs IBM has put out for OS/400 with the number of security updates for Windows XP? Try counting them sometime. But you'll have to use your calculator for the plethora of Microsoft updates whereas you'll need only your fingers--and perhaps your toes in a "bad" year--for those IBM PTFs.

I am thankful for the strong team at IBM Rochester.

A Strong Core

OS/400 has some security features that make my current position much more enjoyable and much easier. These features are often overlooked, but are invaluable to a security administrator or, in my case, a security consultant.

Virus Resistance

OS/400--while not virusproof--is "virus resistant." I won't go into the gory details; you can find those in a white paper Patrick Botz and I co-authored. But I am thankful that it will most likely not be an OS/400 virus that makes the next headlines.

Security Tools

Perhaps the position of security administrator has a lot of turnover. Otherwise, I can't explain why administrators are still unaware of the security tools that were added way back in V3R2 and V3R7. Among my favorites are the tools that allow administrators to manage users by finding users with default passwords, automatically disabling profiles that are deemed to be "inactive," and printing the attributes of all users in a readable, printable report. I also appreciate the Print Private Authority (PRTPVTAUT) and Print Public Authority (PRTPUBAUT) commands.

OS/400 Commands

Among the commands for which I'm thankful are Display User Profile (DSPUSRPRF) and its numerous options as well as the commands that have been updated to include objects in the Integrated File System (IFS), such as Work with Objects Owned (WRKOBJOWN). Many administrators don't realize that DSPUSRPRF isn't just for displaying user profile attributes. My favorite options of this command allow you to see a list of objects the profile owns, a list of objects authorized (in other words, the objects to which the profile has a private authority), and the members if the profile is a group profile. DSPUSRPRF also allows you to send the information about all user profiles to an outfile. From that outfile, you can do all sorts of queries to find out interesting information about the profiles on your system. You can even download that file into an Excel spreadsheet, which I do to provide information to my clients. I am thankful for OS/400 commands that provide interesting information and allow me to be flexible on how I "harvest" the information.

Auditing

I am thankful for the integrated auditing features that OS/400 provides. It helps my clients perform investigation of security events, determining, without a doubt, what action took place and who performed the action. I find OS/400's auditing features incredibly useful when I'm debugging security issues--especially when I'm helping clients tighten their security implementations. For example, when an end-user calls in to report a problem, I can quickly determine whether the issue is security-related by scanning the audit journal for authority failure entries. I have found that, when a security project is underway, all problems encountered are security-related--at least in the minds of any end-users or programmers who may be involved. Being able to quickly prove whether that's actually the case is quite helpful. Finally, OS/400 auditing provides forensic evidence when a break-in or other security breach occurs. I am thankful for this integrated security feature.

Helpful Manuals

A wealth of information is available from the IBM iSeries Information Center to assist an administrator. My favorite manual that's available from this site is the iSeries Security Reference manual. Chapter 6 has a great table that lists the attributes of an output queue and all the actions you can take against a spooled file and shows what authorities and settings allow what type of action. Chapter 9 provides details about the types of audit journal entries that are produced with each setting of the QAUDLVL (audit level) system value. Appendix B lists all the IBM-supplied profiles and their default settings. This is very helpful when someone has altered the profiles' default settings--typically to add additional special authorities. Appendix D lists all the CL commands shipped with OS/400 and the authorities required to run each one. Appendix F lists the formats for all of the auditing outfiles. I refer to this appendix alone at least once a week. In fact, I use this manual so much that I have downloaded the .pdf to my desktop for quick reference.

Another very useful manual is Tips and Tools for Securing your iSeries (also available from the Info Center), which lists the new technologies added for a particular release and tells me what I need to be concerned about from a security perspective.

I am thankful for thorough information.

Security Organizations

I am thankful for the numerous organizations that provide general security information. NIST and ISO are organizations that provide standards to follow. Computer Security Institute provides interesting security survey results. Security Wire Digest pushes me security-relevant information twice weekly. I am thankful for these organizations that provide me with vital information so I can provide timely information to our clients.

Computer Emergency Response Team (CERT)

CERT provides a safe place to report security vulnerabilities in operating systems as well as protocols and IP applications. CERT endeavors to report vulnerabilities only after they are fixed. Imagine if every vulnerability was reported in the media and there was no organization to control the collection of issues and the disbursement of information regarding the fix. Chaos would reign. While OS/400 does not participate directly in CERT, it does post responses to CERT advisories. Check out the IBM eServer Security Planner for postings as to whether OS/400 is affected by a particular CERT advisory.

Giving Thanks for Things That Matter

Because of the robust security features of OS/400, the various contributions of the Rochester team, and the information I receive from other organizations, I enjoy a successful career as co-owner of SkyView Partners. But there is more to life than a career. And it is this time of year that drives this point home.

I encourage you to ask yourself, "What am I thankful for?" While it's OK to be thankful for your career or job, I encourage you to look outside your career to what really matters and to what is really important in your life.

As I look outside of my career, I am thankful for my parents who were an example of unconditional love--both toward me and toward each other. I am thankful for my brother and sister, who raised me after our parents died and who still think of me as their "little sister." I am thankful for faithful friends, who have helped me through difficult times. I am thankful for my neighbors, whose kids make me laugh. I am thankful for my business partner, who helps me keep my priorities straight. I am thankful for my church, which preaches truth and gives me a firm foundation upon which to build my life. I am thankful for the innocence of a child who helps me appreciate the simple things in life--a hug, a smile, a "thank you, Aunt Carol."

There are many things beyond your career for which to be thankful. I encourage you to not neglect those things and to make sure that you appreciate what's been given to you.

Carol enjoys some time with great-nieces Ava and Abby.

Carol Woodbury is co-founder of SkyView Partners, a firm specializing in security consulting and services and the recently released software, SkyView Risk Assessor for OS/400. Carol has over 13 years in the security industry, 10 of those working for IBM's Enterprise Server Group as the AS/400 Security Architect and Chief Engineering Manager of Security Technology. Look for Carol's second book, Experts' Guide to OS/400 Security, to be released later this fall. Carol can be reached at This email address is being protected from spambots. You need JavaScript enabled to view it..