Re: Security concerns

[oliver.wenzel@xxxxxxxxxxxxxxxxxxxxxxx]

Hi,


>How realistic is this scenario? We have had many programmers and
consultants come and go. They all know our IP address of our production
Iseries. >What is to stop someone from using a profile that was in use in
the past and was never deleted? For example, I just found such a profile of
a >programmer who left here 5 years ago, still enabled. If someone harbored
a grudge, what is to stop them from FTP's into our system and deleting
>files? Or even to just shut down all the subsystems ? is there a way to
disable what one can do in an FTP session?


you mean, your Iseries is connected directly to the Internet w/o a firewall
inbetween? Telnet and Ftp ports are open all over the world?
And you don't check for user profiles with default passwords. Hopefully,
you've at least changed passwords on all standard IBM user
profiles?

Go get a knowledgable security consultant to stop all the gaps. Only reason
your system hasn't been hacked yet is that its not an
Microsoft IIS server and most of the hackers/crackers wont know what to do
with it.

Regards,

Oliver