- IBM i is no longer isolated from threats. The increase in web-based applications and network presence as part of modernization efforts has also increased security risks.
- Modernization has also made security requirements more complex than even just five years ago. For example, the need to lockdown access has to be balanced with appropriate web access to support a modernized legacy application.
- Security best practices are often neglected due to the perception that IBM i is secure “out-of-the-box.” IBM i is capable of being a highly secure platform, but only if you leverage the available security features.
Our Advice
Critical Insight
- “Security by obscurity” doesn’t work anymore. The increase in attack surfaces as companies modernize and web-enable legacy applications means security has to be just as much a concern for this platform as for any other.
- The platform’s environment and security risks are too complex to manage effectively without the assistance of third-party tools, especially for mid-to-large enterprises. For example, third-party tools are necessary to review system logs, enforce change control, and manage user access rights.
- The security practices of the green-screen days aren’t good enough anymore. Organizations must adapt their security practices for IBM i to meet today’s increased security risks.
Impact and Result
- Address modern security risks from external Internet-based attacks to application vulnerabilities such as SQL injection and cross-site scripting.
- Implement appropriate guidelines for assigning special authority access rights.
- Establish best practices for security monitoring.