AS/400 configuration audit

The security audit of an AS / 400 (also known by different names: IBM i, iSeries, System i) is both an intrusion test and a configuration audit, the objective being to:
- Check the robustness of the system in the face of real attacks
- Check the implementation of good security practices
For this we rely on our R&D as well as the hardening guides from IBM. Here are some examples of checks dones by our auditors :
- Network
- Listening services
- Communication protocols
- Interconnection with transverse environments
- Man in the middle
- Users
- Default accounts
- List of users
- Bruteforce attacks
- Analysis of the complexity of passwords after cracking
- Escape from default apps
- Authorizations
- Attempt to elevate privileges
- Rights on privileged profiles (SECOFR, etc.)
- Profiles' special rights (ALLOBJ, SECADM, etc.)
- Library rights
- Security policy
- Password policy
- Administration services
- Logging
- Management and storage of session variables
- Various
- File shares
- Unsecured administration protocols
- Analysis of heavy clients present on workstations
- Analysis of sensitive data exfiltration methods