October 25, 2011 - Vol 1, Issue 2

Feature Article

Invisible IBM i Data Access - Undetectable Data Theft

By Dan Riehl

Have your sensitive database files been stolen today?    How can you tell?

Our great IBM i (iSeries and AS/400) has long been considered a security strongbox—a hacker's worst nightmare. Some even consider it to be unhackable. This perception has caused some of us to become complacent in our due diligence related to system security. But security through perceived obscurity is insufficient protection in a world of wily and well-financed cyber criminals and those malicious insiders.

According to the Open Security Foundation Year-to-Date 2011, a total of 126,749,634 people have had their personal information hacked, stolen, lost, or misplaced. Hundreds of computer-related data thefts occur every year—often one or more per day. To view those of public record, you can visit the OSF's Data Loss Database. According to their Data Loss Database's published list of compromised companies, we can tell that some of these incidents are occurring at IBM i shops, both large and small.

Read More...

In This Issue

Invisible IBM i Data Access
Featured Security Video
Security Shorts
Industry News and Calendar
Security Resources



Quick Links

SecureMyi Security Website
The 400 School Training Website
SecureMyi Newsletter Home and Archives

Send an e-mail to the Newsletter Editor



This Issue Sponsors

Platinum Sponsor
      The 400 School, Inc.

Gold Sponsor
      IT Security and Compliance Group

Newsletter Editor: Dan Riehl

IBM i Security and Audit Resources

Security Videos from Securemyi.com

Security Training from the 400 School

IBM i Security Reference - IBM i 6.1

IBM i Security Reference - IBM i 7.1

PCI SSC Data Security Standards

COBIT Framework - ISACA

HIPAA Resources

HITECH Enforcement

CISSP - Certification

IBM i Security News Bytes

Oct 14, 2011 - SkyView Partners
Skyview Partners announced version 2.3 of its Risk Assessor product for the IBM i.
In this newest version of Risk Assessor, SkyView has modified reports and added additional reports and commands in keeping with the changes and new requirements for compliance.

Oct 18, 2011 - Townsend Security
Alliance FTP Manager Now Provides Robust PGP Encryption Options with Simplified Ease of Use
Townsend Security has announced a major update to its managed file transfer software Alliance FTP Manager. Notable new features of Alliance FTP Manager 5.30, include a new set of PGP encryption options, enhanced reporting capabilities and better pattern isolation, as well as support for pre-file transfer Secure Shell sFTP and FTP scans.

Oct 25, 2011 - The 400 School, Inc. and SecureMyi.com
Live Online Security Workshop from The 400 School and SecureMyi.com
Dan Riehl presents his 4-Day Live Online Hands-on Security Workshop for the IBM i - Jan 17-20, 2012. Very limited seating. Register early to reserve your seat in the class.


IBM i Security Calendar of Events

The "EASI - COMMON" i Power Security Roadshow
Oct 25, 2011 Gent, Netherlands
Oct 27, 2011 Luxembourg

Oct 27 - Midrange Solutions and Enforcive - Webinar: Must have IBM i Security Reports

Jan 17-20 - The 400 School - Live Online Security Workshop

May 6-9 - COMMON-A User Group - Annual Conference and Expo - Anaheim, CA




Featured YouTube Video

IBM i Security - Popular Misconceptions - Authority to, and Ownership of User Profiles


Security Shorts

Quick Reporting on User Profiles

When you need to perform quick analysis on your user profiles, here are some tips.

First create a file containing information about all of your user profiles. This will be a snapshot of your current user profiles. You can create this file of users by using the following command.

DSPUSRPRF USRPRF(*ALL) 
          OUTPUT(*OUTFILE) 
          OUTFILE(LibraryName/FileName)

Where LibraryName and Filename are your selected values.

Now, using IBM i Access for Windows file transfer, you can simply download the file into Excel and slice and dice the user attributes to your heart's content.

If you want to run some quick reports, you can use the RUNQRY(Run Query) command. One nice thing about using RUNQRY is that you can perform record selection, and optionally specify that you want a printed report, or display to your screen.

Enter the following command to be prompted for record selection criteria:

RUNQRY   QRY(*NONE) 
         QRYFILE((MyLibrary/MyFile)) 
         RCDSLT(*YES)  

Here are some nice record selections you can choose

Users that have not signed on since July 1, 2011

UPPSOD            LT     '110701'

Users will *ALLOBJ Special Authority

UPSPAU            LIKE   '%ALLOBJ%'

Users with Action Auditing Values(e.g. AUDLVL(*CMD))

UPAUDL            NE     '*NONE'  

Sponsored Links

IBM i Security Services from SecureMyi

Expert Level Security Consulting
IT Security and Compliance Group, LLC

In Depth Security Assessment of IBM i
Upgrade to QSECURITY level 40 or 50
Forensic Research and Analysis
Audit Assistance and Remediation
Vendor Software Configuration
Customized Security Programming


Live Training from The 400 School

Live Online Hands-On Workshops
Special Fall/Winter Class Discounts


Control Language Workshop - Oct 31-Nov 4
Sys Administration Workshop - Nov 14-18
Sys Operations Workshops - Dec 12-16
Expanded Security Workshop - Jan 17-20


Send your IBM i Security Related News and Events!           Advertise in SecureMyi.com Security Newsletter

Copyright 2011 - SecureMyi.com, all rights reserved

SecureMyi.com | St Louis MO 63017