IBM i Security – The Top Issues and Concerns in 2023

IBM i shops are busy with the day-to-day (and who would blame them):

• System administration
• Responding to user and management requirements
• Maintaining, supporting and developing the applications that run (and drive) their business.

But, there’s one thing that we find is not looked at regularly enough is the protocols and procedures they’ve set up have been in place for years – and despite a moving cyber security landscape – have not been touched since.

And that is a huge concern.

Indeed, this is backed by the latest IBM i Market Survey as compiled by FORTRA.

For the seventh year running cyber security continues to be THE top concern within the IBM i enterprise.

But why?

The IBM i is a safe platform, right?

And, despite the viruses and other malware threats, the IBM i is impervious?

Well, while the architecture of the IBM i makes it less likely that a virus could be written for it than more mainstream platforms, unfortunately, there are always security fault lines in every business and flaws that can be exploited in every architecture.

There are many risks to address but to start, the following top five issues and concerns will give you a good start in addressing your IBM i security requirements.

Access Privileges 

Too many IBM i enterprises offer too many users too much authority. This means that there could be employees in your organisation that have access to all your database files and objects – they can access, share and even wipe pretty much everything on your server.

Now is the time to review and evaluate your users profiles and privileges. Standardise role based authorities and keep track of who has access to what and adjust these privileges based upon necessity.

Unsupported OS

Time is always ticking on supported versions of operating systems and while IBM does a better job than most for extending support for older versions of OS, it is inevitable that it will become unsupported.

Having an outdated version of the OS allows for system vulnerability as upgrades and security patches are no longer released. Indeed, if you do run into trouble, help and support for older operating systems may no longer be available. It is therefore imperative that you stay on a supported OS and apply patches as they become available.

Multi-Factor Authentication

As remote working becomes more prevalent and with the vulnerabilities high-privileged administration access can bring, it is more important than ever to introduce Multi-Factor Authentication (MFA) to the enterprise.

This extra layer of security ensures that only the people who have access to the system, have access to the system – even should their credentials be leaked or compromised.

IBM i security is a ‘Broad Church’

The cyber security landscape continues to change and threats are multifaceted.

While traditional protections provide a protective blanket, more is needed to make your IBM i truly secure. In addition to Firewalls and anti-virus protections, the modern IBM i enterprise should also look at exit point management, profile management, multi-factor authentication and, as an added contingency, high availability and attack recovery procedures.

Thankfully, when it comes to IBM i security, there are lots of options.

However, when looking for solutions in this area, do make sure they’re IBM i specific and the provider has the relevant IBM i expertise to advise and implement the best security solution for your business.

The Key Is: Be Prepared

Should the worst happen, you need to have a response plan in place.

This differs from your disaster recovery plan in that there’s a need to understand the threat you’re facing, how to stop it and implement the best strategy to restore the compromised elements in a timely and safe manner.

For example, cyber theft of personal data would have a different response and levels of communication to that of a denial-of-service attack.

Plan a process for each scenario including levels of communication and requirements/actions for each stakeholder.