In the beginning, the AS/400 was promoted as a platform that didn’t need a database administrator. It was generally regarded as a safe platform with strong security features and robust hardware. There was this idea that you could get by with less staff and there was this notion that you could simply expect a developer or a System Administrator to manage your network’s security without any worry because the platform was designed with application security in mind.
Thirty years later, that viewpoint is not today’s reality. We’ve all plugged into the Internet, and the IBM i, originally known as AS/400, doesn't live in isolation. It connects to everything else – just like Windows and Linux. It's a server connected to the office network and the office network is connected to the Internet.
With today’s threat landscape and the increasing number of threat actors, each with advanced levels of sophistication, information security work is no longer a luxury – it’s a necessity.
But, the issue remains that some business folks, and even IBM i developers, may have outdated thinking. That's not to be disparaging. They are certainly skilled in creating applications and know precisely how these applications serve the businesses for which they're employed.
I've spoken with people who work at top-notch information security assessment firms in the country and they’ve admitted they skip over the IBM i in their security assessments.
There’s still this attitude that “We don’t need to worry about that IBM i” and that is what is dangerous. The IBM i could be the database server for a website that's being probed by an attack or that's part of a penetration test. IBM i could be running the company’s ERP system and that ERP system could be accessed via easy database queries or other tools which are not properly secured.
There’s a tremendous risk if these systems are implemented without information security thinking in mind and they can become accessible to unauthorized employees or even an outside attacker.
Outsourcing support offers you an entire team of certified security experts. Beyond establishing information security management policies and best practices, and response and recovery procedures, Briteskies focuses on prevention, and it all starts with a critical assessment. It’s a tailored and fine-tuned process that can save companies from major headaches, not to mention countless dollars.
At Briteskies we work with clients to improve their overall information security posture. Our goal is to work with clients to help safeguard systems from internal and external threats. To start, we recommend understanding more about the real threats to your system and discovering the security steps that should be taken – starting with a Briteskies Security Assessment. We have found this to be extremely beneficial for not only lowering the potential of an attack, but also for educating system administrators on how to continue best practices within their environment.
As an experienced IT and security professional with a broad range of business experience, Robert is a key player in our customer-centric team. With nearly 30 years of experience, he has championed information security as the forefront of every IT client’s needs. He believes that an effective security program is an “arms race” and good communication is a must at every level of an organization. Robert brings personal integrity and a personal toolset that includes attention to detail, a mindset for never-ending learning, and strong people skills to every project he's involved in.
No Comments Yet
Let us know what you think