March 28, 2012 - Vol 2, Issue 7 Security Workshop
SEA On Demand Learning

A Tale of Leaky Data - Spooled Files

By Dan Riehl

A "data leak" is defined in Wikipedia as "the intentional or unintentional release of secure information to an untrusted environment." It can also be called a "data spill" or "data breach."

We are often deeply concerned about data leaking from our production database to the outside world. We often focus a great deal of effort on securing these precious data jewels we call files. But what about protecting the end result of these jewels—our printed reports? Our production reports consist of our precious data jewels, coordinated, manipulated, and cajoled into what becomes meaningful information in the form of a production report.

If we consider our database files to be sensitive, then our printed reports, which present that file data in a readable, organized format, must be protected with as much or, dare I say, more due diligence.

If your shop is like most, all, or almost all, output queues are left unsecured. For some strange reason, we assign *JOBCTL special authority to our end users. The result of this *JOBCTL assignment is that they can view and manipulate the reports generated by others. This is usually the root of the problem of data leakage via printed reports. A user with *JOBCTL special authority can, with few exceptions, view and control any printed report on the system.

Perhaps to avoid the potential of a data leak through a printed report, we configure the user accounts with the command line restriction LMTCPB(*YES). As a further step, we don't present a menu option that allows them to view the spooled files of others. That's a nice solution, but there still can be alternative methods to view and leak the data in our sensitive reports. One such method is through the IBM i Navigator for Windows (a.k.a. Operations Navigator) Basic Operations tab.

Read More

In This Issue

Tale of Leaking Data

Featured Video- 1982 Security Scheme?

Security Shorts- Where is your Data?

Industry News and Calendar

Security Resources

Security Quick Links

SecureMyi Website

Security Training from The 400 School

SecureMyi Newsletter Home/Archives

@CarolWoodbury on Security - Twitter

Need Access to an IBM i?   Visit RZKH

Please Visit Our Sponsors

Platinum Sponsor
      The 400 School, Inc

Gold Sponsor
      Software Engineering of America

      Cilasoft Security Solutions

      Skyview Partners, Inc

IBM i Security and Audit Resources

IBM i Security Videos from

SecureMyi Newsletter Home and Archives

IBM i Security Reference - IBM i 6.1

IBM i Security Reference - IBM i 7.1

QAUDJRN Audit Types By AUDLVL 6.1

QAUDJRN Entry Type Record Layout 6.1

RedBook - Security Guide for IBM i 6.1

PCI SSC Data Security Standards

COBIT Framework - ISACA

HIPAA Resources

HITECH Enforcement

CISSP - Certification

Follow securemyi on Twitter

Follow securemyi on YouTube

Is Your JD EDWARDS Database Secure? See how SKYVIEW PARTNERS can help!

SEA On Demand Learning

Featured YouTube Educational Video

IBM i Security

The Pitfalls of Relying on a 1982 Security Scheme in 2012

Featured Video - The Pitfalls of Relying on a 1982 Security Scheme in 2012

Cannot Access YouTube from your office? Download the video in wmv format.   Click to Download the wmv file

IBM i Security News Bytes

Great New Book Arrives - IBM i Security Administration and Compliance
By Carol Woodbury
Pre-Orders being taken at with Free 2-Day Shipping
More Information and order from Amazon

IBM Introduces Quick Security Check for IBM i
The new software tool assists the Security Administrator by collecting over 500 pieces of statistical information relative to IBM i security.
See the related article in IBM Systems Magazine
For more information contact: Terry Ford at IBM's STG

ProData Computer Services Inc, Releases RDR 4.0, Retrieve Deleted Records.
For Additional Information

Do More With Less: CCSS Issues a Cheat Sheet for IBM i Managers
Download a free copy of the CCSS (How to) Do More With Less Cheat Sheet

IBM i Security Calendar of Events

Live Security Related Webcasts and Training for IBM i

Webinar - Password Self-Service Reset tool for IBM i
Sponsored by SafeStone
Wednesday March 28 10:00 AM PDT
More Information and Register to Attend

Live 4-Day Expanded Security Workshop for IBM i
April 10-13 9:00am - 4:30pm Central Time
Dan Riehl presents his 4-Day Live Online Hands-on Security Workshop for the IBM i. More Information and Register to Attend

Jump-Start Your IBM i Security Policy
Featuring Powertech's Compliance Assessment Software - Sponsored by Powertech
Wednesday April 11 1:00 PM Central Time
More Information and Register to Attend

Security Related Seminars and Conferences for IBM i

April 2-4 - The Power of i - Annual Northeast IBM i User Groups Conference
The largest technical conference in New England for IBM i (AS/400, iSeries, Power Systems). Over 75 sessions in five categories, including Security.
Location: Framingham, MA
More Information and Register to Attend

April 16-19 - 2012 IBM Power Systems Technical Symposium
4-Day Conference - Sponsored by IBM
Includes technical sessions, covering Power Systems, AIX, IBM i, Storage and Linux. The conference is held at the Hilton San Fransisco
More Information and Register to Attend

May 6-9 - COMMON User Group - Annual Conference and Expo - Anaheim, CA

Cilasoft Security Solutions - Intelligently Engineered Security Solutions

SEA - On Demand Learning

Security Shorts

Protecting Sensitive Data – But - Where is it?

By Dan Riehl

When we discuss the security and protection of sensitive data like credit card numbers, Bank Account Numbers and Social security Numbers we tend to focus solely on our storage of this information in our DB2 database. We perhaps use field level encryption, and set the library and file level security to allow only sanctioned users to view or change this data as it is stored in our production files. But, the database file is NOT the only place where this sensitive information can be compromised.

Here's a short list of other places where sensitive data might be compromised. I'm sure you can add some instances to my list.

Test versions of Files

Yes, we all have versions of the production files in our test, development and QA environment libraries. Unless we are using scrubber software for creating these "Test" versions, all sensitive data is available to anyone with access to these files, and copies of these files. Sadly, very few of us use any such scrubber tools.

Test data must be sanitized to make sure that all sensitive fields are changed to hide the actual sensitive data. I have not heard of any commercial data scrubbers available specifically for DB2 on i. If you know of any, please let me know.

Backup Files

Often backup files are created using command like CPYF CRTDUPOBJ CPYLIB. These versions, if created, must be protected as diligently as the production data it was copied from. In most commercial High Availability solutions, we typically have an exact duplicate of production files on our backup system. But, often we have less strict controls over user access on the backup system. Data on the backup Systems must be protected.

Backup Media

Our backup tapes and save files contain all production data. If a backup tape can be restored on to a different system, all files may be compromised. A save file containing production data may be moved to a different system using FTP or any file transfer facility. We must control the ability to save database files to save files, and to transfer data between systems. We also need to exercise strict control over our backup media.

Reports in Output queues

Printed reports often contain sensitive data. While we strive to protect the database, we often overlook the exposure of listing that same sensitive data within spooled file reports. The sensitive data is exposed to users that can view spooled file reports.

Just recently, I was working with a customer to secure their sensitive data, and we found it was painfully easy for users to view the payroll register reports while these reports were sitting on an unprotected output queue. The Name, Social Security Number, Pay Amount, Deductions, etc were listed in plain sight for any user to view.

IFS spreadsheets, PDF and text files

We often store spreadsheets and pdf reports in the Integrated File System. Don't forget to secure the sensitive data that resides there.

Data in transit, FTP, File Transfer, DRDA, DDM, ODBC, etc

Users who are authorized to their application data, and powerful IT users can usually transfer files using tools like FTP and IBM I Access for Windows File Transfer Facility. These types of transfers must be controlled, and audited and reported. Network Exit Point programs for FTP, DDM and ODBC are required in order to have visibility and control over these file transfer events.

Sponsored Links

IBM i, iSeries and AS/400
Security Services from SecureMyi

Expert Level Security Consulting
IT Security and Compliance Group, LLC

In Depth Security Assessment of IBM i
Upgrade to QSECURITY level 40
Forensic Research and Analysis
Audit Assistance and Remediation
Security Training for IT and Audit Staff
Security Tool Selection & Configuration
Customized Security Programming

SEA On Demand Learning

Live Training from The 400 School

Expanded Security Workshop Apr 10-13

Control Language Workshop Apr 16-20

RPG IV Programming Apr 30-May 4

System Administration June 25-29

System Operations July 16-19

Send your IBM i Security Related News and Events!           Sponsor the Security Newsletter

© Copyright 2012 -, all rights reserved | St Louis MO 63017