RE: How Secure is Windows, Really?

An interesting point was brought up a while ago that certain architectures
(such as poorly designed SQL applications and unmonitored PHP) may in fact
introduce a vector of vulnerability that was heretofore not present on the
machine.

But in general, a solid JSP Model II application on the iSeries has ZERO
known vulnerabilities of the Remote Execution or Privilege Escalation
variety (the closest thing I can recall is the old JOBD exploit, or back in
the day, when it was discovered that IBM stored the user's password in the
PAG in the clear (big oops on that one!)).  Of course, you can get Denial of
Service attacks of the most blatant kind by simply flooding the IP address
with packets, but none of the typical overruns that bring down the server
are available, either.

In short, there simply is no comparison.

As to iSeries anti-virus software, in my opinion that's one of the bigger
misrepresentations in our marketplace.  You can only put a virus on an
iSeries by copying a file into the IFS from an infected non-iSeries machine.
The virus cannot affect the iSeries, and so really isn't an iSeries virus in
a traditional sense, any more than a virus on a CD is a "CD" virus.  They
are typically just Windows viruses that are stored on an iSeries.  So the
place where you need to run your anti-virus software is the machine that is
putting the bad files onto your iSeries in the first place.

(Don't get me wrong: there is a niche market for anti-virus products for
those companies who use their iSeries as their primary file server, not just
their business logic server.  I won't argue the pros or cons of that; it's a
business decision based on cost of disk vs. security and ease of backup.)

Joe

From: albartell

So, to do a comparative analysis where are the iSeries links that would
show
similar stats/info?  The only place I would consider the iSeries to be at
risk (outside of having a Windows partition card) is the IFS, but even
then
we have similar user/object level control over that.  Could someone
release
a *nix style virus in Qshell successfully if the IFS is tied down
appropriately?

I was speaking with some security vendor at a recent conference (COMMON
Miami I think) and they said iSeries security software sells because IT
higher ups are used to, and need, to feel "safe" by having virus/security
software installed on all their machines.