IBM Security Audit

Whether Mainframe (z/OS) or IBM i (AS/400), these systems remain the beating heart of the most sensitive infrastructures - from finance to logistics. And yet, with expertise becoming increasingly scarce and the market increasingly open to the cloud, their security is often underestimated.

Renowned for their historical robustness, these platforms now require rigorous configuration and fine-tuned monitoring to counter increasingly sophisticated risks. Performing an audit means transforming these "black boxes" into pillars of trust to guarantee business continuity and control of your digital assets.

Mainframes are still at the heart of today's most critical information systems. Yet the security of these environments is often poorly understood, and expertise is in short supply. This combination creates a growing risk, even though these systems host the most sensitive corporate data and processes. Reinforcing mainframe security means ensuring the continuity, confidence and control of your digital assets.

Your challenges

You operate in highly sensitive sectors (banking, insurance, defense, healthcare) where the Z/OS mainframe is the backbone of your business. Today, you are faced with :

• A loss of technical expertise: the retirement of mainframe experts leaves a number of grey areas in security configuration.
• Strong compliance requirements: the need to meet rigorous assessments such as CSPN or Common Criteria.
• A risk to image and continuity: a compromise in this segment of the information system has a direct impact on the survival of the organization.

Our solutions

Oppida, a specialized firm with over 20 years' experience, provides concrete solutions to secure your Z/OS:

• Organizational audit : structured assessment of mainframe organizational and physical security, covering governance, operational security processes and infrastructure and asset protection measures.
• Architecture audit: technical assessment of the information system's security architecture, covering identity management, administrative access, network partitioning and logging mechanisms.
• Configuration audit: evaluation of the security configuration of the mainframe environment (z/OS, RACF and DB2) based on STIG recommendations, covering authentication, access control, traceability and system hardening mechanisms.
• Intrusion testing: identification and exploitation of mainframe attack vectors linked to exposed services, authentication mechanisms and misconfigurations of the system and its applications.
• Code audit: evaluation of the robustness of security mechanisms, resource and data access management, implementation of cryptographic mechanisms and robustness of application logic, in the different languages supported (COBOL, Java, REXX...).
• R&D expertise: our methodologies are continually enriched by the work of our in-house laboratory.
  

AS/400s, now more commonly known as IBM i or System i, are technologies widely used in many sectors, from logistics and retailing to banking and insurance. These database-driven systems offer robust, efficient administration of applications and data.

Considered the "little brothers" of mainframes, they are renowned not only for their low exposure, but also for their historical robustness, stability, performance and ease of maintenance. However, with the increasing integration of new components and services, these critical systems require fine-tuned, rigorous configuration.

Your challenges

You use IBM i for its efficient management of business applications and data, but you're facing new challenges:

• An extended attack surface: misconfigured services (FTP, Telnet, LDAP, POP3, DB2) can introduce new vulnerabilities.
• Obsolete historical configurations: accumulation of privileged accounts (SECOFR, SECADM), poor password policy or misconfigured access.
• The need for proof of security: your partners and regulators are now demanding concrete configuration audits and penetration tests.

Our solutions

Oppida offers a structured approach to assessing and hardening your IBM i systems:

• Intrusion testing: identifying and exploiting attack vectors linked to exposed services, authentication mechanisms and system misconfigurations. We simulate realistic attack scenarios such as profile hijacking, Library List Poisoning (LIBL), SQL injection and Initial Program Breakout.
• Configuration audit: evaluation of system parameters and values, review of user privileges, password policy, object protection and partitioning.
• R&D expertise: our methodologies are continually enriched by the work of our in-house laboratory.