Re: mod_security for Apache

Hi Mike,

The way I see it, there are two entirely separate categories of security
- system and application. Assuming it's configured correctly I think
the i5 has fabulous system security.

Application security is an entirely different issue, and that's that the
mod_security module would (hopefully) address.

If you think about normal 5250 programming, when you define a field in a
display file you don't ever have to worry about getting more data in
your program than the field allows.

Programming for other inputs (ie web) is a different animal - just
because you say a field on a web page is 30 characters doesn't mean
anything about what can come back to your program. Depending on how
your software is written you could have a real security risk for SQL
injection as an example.

I don't know enough about mod_security to evaluate if it would help with
SQL injection attacks or not. Personally I wouldn't want to rely on a
third party product to provide that security for me - I think it's best
to build that in the application for real.

Also, not to offend you but it really bothers me when people make
blanket statements like "i5/OS is secure enough." Do you think the
owners of your company are going to care if your system itself hasn't
been damaged but somebody was still able to steal all of your
proprietary corporate information? There is no magic security pill,
including the iSeries.

Cheers,
Brandon

-----Original Message-----
From: web400-bounces@xxxxxxxxxxxx [mailto:web400-bounces@xxxxxxxxxxxx]
On Behalf Of Mike
Sent: Tuesday, February 10, 2009 2:32 PM
To: Web Enabling the AS400 / iSeries
Subject: Re: [WEB400] mod_security for Apache

My question is if this is such an important module, why hasn't IBM
ported it
and included in within the installation. My guess is either isn't a
important as some lead you to think or i5/OS is secure enough that it
isn't
needed.