Re: PC5250 Telnet - security and setup

I prefer to use SSL and have a strong exit program with security and
special logging.

A few problems with VPNs are that they need to be (a) setup correctly and
(b) managed properly.


Here's a few examples of bad management...

The VPN provides access to the internal network and the remote user has the
opportunity to remotely hack away at other computers.

The VPN installer has complete authority from the outside network and
leaves the outside company that installed the VPN. The company may not even
know that their VPN is compromised.

A hacking attempt is detected at the AS/400 level and since the remote user
looks like a local user it is very difficult to identify the source of the
attempted break-in.

In summary, use of a VPN requires an additional set of skills and security
awareness that must be employed. My view: the more sets of different skills
that are needed, the more opportunities for exposure.

steve
mic@xxxxxxxx


> 
> message: 4
> date: Fri, 9 Dec 2005 18:42:44 -0800
> from: Tom Jedrzejewicz <tomjedrz@xxxxxxxxx>
> subject: Re: PC5250 Telnet - security and setup
> 
> On 12/8/05, Patrick Botz <botz@xxxxxxxxxx> wrote:
> > You can use SSL with the iSeries telnet server.
> 
> Thanks .. I got that already working.  I am trying to decide if I
> should open the SSL port to the internet and have my remotes use
> telnet/SSL instead of a VPN for iSeries green screen access.
> 
> Does your group have an opinion?
> 
> >
> > Patrick Botz
> > Senior Technical Staff Member
> > Rochester CTC, eServer Security Architecture & Consulting
> > iSeries Security Architect
> > (507) 253-0917, T/L 553-0917
> > CTC Fax # 507-253-2070
> > email: botz@xxxxxxxxxx
> --
> Tom Jedrzejewicz
> tomjedrz@xxxxxxxxx
> 
>