Home  >  Security audits   >  Configuration audit   > AS/400

AS/400 configuration audit

The security audit of an AS / 400 (also known by different names: IBM i, iSeries, System i) is both an intrusion test and a configuration audit, the objective being to:

  • Check the robustness of the system in the face of real attacks
  • Check the implementation of good security practices

For this we rely on our R&D as well as the hardening guides from IBM. Here are some examples of checks dones by our auditors :

  • Network
    • Listening services
    • Communication protocols
    • Interconnection with transverse environments
    • Man in the middle
  • Users
    • Default accounts
    • List of users
    • Bruteforce attacks
    • Analysis of the complexity of passwords after cracking
    • Escape from default apps
  • Authorizations
    • Attempt to elevate privileges
    • Rights on privileged profiles (SECOFR, etc.)
    • Profiles' special rights (ALLOBJ, SECADM, etc.)
    • Library rights
  • Security policy
    • Password policy
    • Administration services
    • Logging
    • Management and storage of session variables
  • Various
    • File shares
    • Unsecured administration protocols
    • Analysis of heavy clients present on workstations
    • Analysis of sensitive data exfiltration methods