IBM i / AS400 Security 

It’s time to take IBM i security seriously. A proactive plan will help you stay one step ahead of every storm.

Are you following IBM i / AS400 security best practices?

Establish A Failsafe Security Solution

You know you should be doing more for your AS/400 security, but where do you start? Whether you're addressing internal needs or meeting minimum compliance requirements, every small step counts. Start by asking yourself the questions below:

Security Policies and Practices

Plans and Procedures

  • Are response and recovery plans in place and managed?
  • Are your cyber supply chain risk management processes identified?
  • Is a vulnerability management plan developed and implemented?

Individual Profiles

  • Do all employees use a unique user profile?
  • Do employees change passwords at least twice a year?
  • Do you have a minimum password complexity policy?


Authorities and Roles

  • Have user roles been defined via groups or authorization lists?
  • Who can create, maintain, and delete user profiles?
  • How and where is adopted authority used?

IBM i Server

  • Is the IBM i running at a security level of 40 or above?
  • Is the System i running an OS that is supported for at least the next two years?
  • Are old versions of Java, WebSphere, or PHP running on the server?

System and Data

  • Do you have a formal offsite data backup rotation?
  • Do you test backup media regularly?
  • Have you implemented encryption and key storage?
  • Is your IBM i included in your SIEM application?

Is Your Organization's Security Up To Current Standards?


Take our security assessment and see where your vulnerabilities lay and what steps you can take to increase your information security management system policy. 

Why undergo a security assessment?

  • Gain an understanding of your current security standing
  • Identify risks and compliance issues
  • Attain foundational information for creating Disaster Recovery Plans
  • Assist with Security Remediation after a cyberattack

See If Your System Is At Risk


“An unfortunate reality of doing business today is that system security is everyone’s responsibility, not just the IT department's. And what even small companies fail to realize is that they may be a target as a path to a larger organization. Fortunately, even small steps can greatly improve your security.

Rob Nettgen -
IBM i Security Specialist, Briteskies

Rebuilding after a security breach doesn't have to be painful 

Information Security management is a constant process. Whether your system has been compromised or you're looking to improve your current threat remediation Briteskies is here to help. 

asphalt road in Tuscany Italy

Creating a Post Breach Roadmap

After an e-commerce breach, Briteskies worked with this client to formulate a next step plan to ensure there site could run safely and securely. 

  • Determined the necessary measures on how to avoid a reoccurrence
  • Advised executive personnel about traits and skills necessary to monitor and identify risks within the system
  • Outlined guidelines and goals for the role and tips on necessary capabilities 
Conceptual digital image of mother board with lock

Securing an Existing System

While most systems have sort of security in place, there's always room to improve. Our client came to us with the desire to improve their relatively insecure system. Based on their security patterns we advised: 

  • Adopt a more formalized information security policy
  • Recommended specific technical changes to their infrastructure to improve posture including
    • Greater depth in backup
    • Offsite backup media rotation
    • Periodic backup testing
  • Conducted best practices guidelines for company-wide security awareness training
business documents on office table with smart phone and laptop computer and graph financial with social network diagram and three colleagues discussing data in the background

Taking the First Steps Towards Security

With some older AS400 systems, security is inexistent or dangerously outdated. We worked together with this client to create a security plan that worked for them. Our list of to-do list for them included: 

  • Hardware upgrades
  • CIS Control adoption
  • Two-factor authentication for remote workers 
  • Firmware installations
  • Updates to the vulnerable software design

As this client was keen to keep costs low, we worked what they had in place and advised on how to improve while staying in budget. 

How are you managing the security risks of your IBM i System?

First 3 Steps to IBM i Security Square (3)

Information security management starts with the user. By identifying and correcting vulnerabilities you can decrease your IT security risks and increase your threat remediation abilities. 

Learn why "Security through Obscurity" is no longer enough →

Contact Us to Get Started



ALLOut's TRACE is a Control Solution specifically designed for IBM i to track and monitor suspicious activity. 

Watch the webinar for a better understanding of the importance of security and a product demo of the TRACE tool.


Take advantage of a Security Scan to see if your system is at risk

HelpSystems Security Scan
In just 10 minutes, a free HelpSystems Security Scan will provide you with an initial overview of identified IBM i system vulnerabilities that can put your organization at risk. Using this information, a knowledgeable security advisor will work with you to assess and highlight the potential risks which exist for your IBM i and will provide insights on how you can improve your security plan and data protection. Get more information about the Free Security Scan

ALLOut TRACE Monitoring and Auditing Tool
TRACE is a monitoring and auditing system exclusively for IBM i that enables you to prove and verify that you have strong internal controls over your database management systems.

TRACE will track and  verify all internal user activity and keep an audit trail of all programs accessed. Serving as a second set of eyes and a book of records, TRACE assists you in catching and reviewing any suspicious activity and can be used as a threat remediation tool.

Contact us to get started


A compliance plan vs. a fail safe security strategy for IBM i / AS400 

A compliance plan alone is not enough to safeguard your system, it’s just a component of an overall security policy. Maintaining SOX, J-SOX, HIPAA, GDPR, and PCI compliance is of utmost importance for your organization, but it's not the total picture.

Don't fall victim to believing that because you have a compliance plan in place, you're covered. You need a full security strategy as well, since compliance mandates typically set only minimum requirements.