As an iSeries™ owner
exploring options for connecting your systems to the Internet, one of the
first questions you will typically ask is, "How do I begin to use the Internet
for business purposes?" The second question is, "What should I know about
security and the Internet?" The focus of this material is to help you to
answer this second question.
The answer to the question, "What should I know about security
and the Internet?" is that it depends on how you want to use the Internet.
Security issues related to the Internet are significant. Which issues you
need to discuss are based on how you plan to use the Internet. Your first
venture into the Internet might be to provide your internal network users
with access to the web and Internet e-mail. You may also want the ability
to transfer sensitive information from one site to another. Eventually, you
may plan to use the Internet for e-commerce or to create an extranet between
your company and your business partners and suppliers.
Before you get involved with the Internet, you should think through what you want to do and how you want to do it. Making decisions about both Internet usage and Internet security can be complex. You may find it helpful to review the page, Scenario: JKL Toy Company e-business plans, as you develop your own Internet usage plan. (Note: If you are unfamiliar with security and Internet-related terms, you can review common Security terminology as you work through this material.)
Once you understand how you want to use the Internet for e-business, as well as the security issues and the available security tools, functions, and offerings, you can develop a security policy and objectives. A number of factors will affect the choices that you make in developing your security policy. When you extend your organization onto the Internet, your security policy is the critical cornerstone for ensuring that your systems and resources are secure.
iSeries server system security characteristics
In addition to a number
of specific security offerings for protecting your system on the Internet,
the iSeries server
has very strong system security characteristics, such as the following:
- Integrated security which is extremely difficult to circumvent compared to add-on security software packages offered on other systems.
- Object-based architecture which makes it technically difficult to create and spread a virus. On an iSeries server, a file cannot pretend to be a program, nor can a program change another program. iSeries integrity features require you to use system-provided interfaces to access objects. You cannot access an object directly by its address in the system. You cannot take an offset and turn it into, or "manufacture," a pointer. Pointer manipulation is a popular technique for hackers on other system architectures.
- Flexibility which lets you set up your system security to meet your specific
requirements. You can use the
Security Planner
to
help you determine which security recommendations fit your security needs.
iSeries advanced security offerings
iSeries also offers several specific security offerings that you can use to enhance your system security when you connect to the Internet. Depending on how you use the Internet, you may want to take advantage of one or more of these offerings:
- Virtual Private Networks (VPNs) are an extension of an enterprise's private intranet across a public network, such as the Internet. You can use a VPN to create a secure private connection, essentially by creating a private "tunnel" over a public network. VPN is an integrated feature of i5/OS™ available from the iSeries Navigator interface.
- Packet rules is an integrated feature of i5/OS available from iSeries Navigator. This feature allows you to configure IP packet filter and network address translation (NAT) rules to control the flow of TCP/IP traffic into and out of your iSeries server.
- Secure Sockets Layer (SSL) application communications security allows you to configure applications to use SSL to establish secure connections between server applications and their clients. SSL was originally developed for secure web browser and server applications, but other applications can be enabled to use it. Many iSeries server applications are now enabled for SSL, including the IBM® HTTP Server for iSeries, iSeries Access Express, File Transfer Protocol (FTP), Telnet, and many others.
Once you understand how you want to use the Internet, as well as the security issues and the available security tools, functions, and offerings, you are ready to develop a security policy and objectives. A number of factors will affect the choices that you make in developing your security policy. When you extend your organization onto the Internet, a security policy provides a critical cornerstone for making your system secure.
To find more detailed information about how to begin using the
Internet for business purposes, review these online IBM Systems Software Information Center topics and IBM redbooks: - Connecting to the Internet
- AS/400® Internet Security: Protecting Your AS/400 from
HARM on the Internet (SG24-4929).
