Re: iSeries public WEB access, PCI security issues

Yes.

The RPG & DB2 Summit registration web site (http://www.systemideveloper.com) is completely IBM i based. System is a mix of PHP, RPG, DB2 stored procedures, etc. with Ajax on the front end.

There is a CISCO firewall between the system and the universe that blocks all except HTTP and HTTPs ports. We use VPN access for all our own work.

We do not store Credit card numbers, other than in a transitory sense, so our PCI requirements are a little lower than yours. The PCI compliance testing (which is done quarterly) has gotten a lot stricter lately and we had to shut down a couple of links on our web site. They were being flagged as potential targets for cross-site scripting attacks etc. They were not really a threat but the testing is at the "blunt instrument" level and if it flags it ... well let's just say it takes way more effort to convince them that it isn't a problem than it does just to fix the site.

Happy to answer any other questions off line.


On 2013-08-28, at 10:50 AM, "Steinmetz, Paul" <PSteinmetz@xxxxxxxxxx> wrote:

Is anyone running an app that requires public WEB access to the iSeries?
If so, how is it configured/secured?

We have a new app that needs public WEB access.
Because we store credit card info, etc. on our iSeries, PCI rules may not allow this.
We were thinking of a separate partition, or a new Power 710, then using DDM to access the data.

Thank You
_____
Paul Steinmetz
IBM i Systems Administrator

Pencor Services, Inc.
471 Delaware Ave
Palmerton Pa 18071

610-826-9117 work
610-826-9188 fax
610-349-0913 cell
610-377-6012 home

psteinmetz@xxxxxxxxxx
http://www.pencor.com/

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.

Jon Paris

www.partner400.com
www.SystemiDeveloper.com