By now we’ve all heard about the Equifax Breach – the most recent high-profile cyber security disaster affecting about half of all Americans (according to USA Today). Here we take a look at how the breach occurred, and what simple steps you can take to help increase IBM i security for your systems.
How Did the Equifax Breach Happen?
According to USA Today, the Equifax breach occurred due to a vulnerability in their Apache Struts software. Many sources comment that this was likely a zero-day vulnerability, meaning that it was unknown to the software developers and clients. As such, zero-day vulnerabilities are prime opportunities for cyber attacks, as “hackers” can spot the vulnerability and exploit it or sell it to another malicious party.
That being said, it is speculated that this specific attack was due to more than just a single vulnerability, since it is unusual that just one weak web component could result in such a high number of sensitive records being leaked. Typically there are extra security measures in place so that even if unauthorized users do get in, they can only access a small segment of the company’s data. It seems that Equifax did not take all of the necessary security precautions that they should have.
What Does the Equifax Breach Tell Us?
The obvious lesson is that data security is no joke, and security threats are everywhere. This breach of Equifax’s data can put as many as 143 million Americans at risk for identity theft and financial disaster – for the rest of their lives.
That’s not to mention the recent Dropbox breach that compromised 68 million user logins, Oracle compromising login credentials for customers at hundreds of companies, or even the Yahoo breach compromising one billion users’ data.
Being a big, high-profile company can make your data more valuable to steal, but it also means that breaches could be much more difficult to pull off. Small and medium-sized business (SMBs), while running a lower profile, are not likely to be spending as much on data security measures. The means that while these companies might seem like lesser targets, their increased vulnerability could result in an equal likelihood of suffering from a breach. Meanwhile, other security issues like Ransomware don’t discriminate by company size at all.
For these reasons, we’re taking a quick look at some simple steps you can take to increase IBM i security.
3 Simple Steps to Increase IBM i Security
1. Take a two-sided approach
Companies often mistakenly believe that security breaches are done by malicious “hackers” trying to break in from the outside. The truth of the matter is that many cases of data theft are done by people inside your network, many of which are using their own access rights.
When enacting threat prevention, take a two-sided approach: focus on attacks coming from both the inside and the outside.
2. Make sure you’re customizing your security settings, and not relying on defaults (including after platform migration)
IBM i has a ton of great, customizable capabilities to secure your systems. That being said, that doesn’t mean that they’re preconfigured in a way that’s ideal for your company. This is especially true after migrations. Many companies tend to pull settings off the last system after migrating to a new one, restoring attributes and system values without reassessing whether they’re still really relevant.
3. Give users view-only rights to shared data
Sharing data is essential to the operations of every company, whether it’s access to certain systems and applications, or simply sharing an Excel spreadsheet. However, that doesn’t mean that everyone who receives shared data should be able to edit it. This might seem obvious, but is very frequently overlooked. Limit editing rights to only essential persons. This can make data harder to steal and tamper with. If someone does manage to bypass the view-only rights and tampers with the data, this can also make it easier to track who did it.
For more information on how to increase IBM i security for your systems, contact us today at 317-707-3941.