IBM i Security Issues

25 years ago, I started working with IBM i systems. I used to be a Service
Engineer for a not so long time at an IBM Alliance Company in Central
America.

I learned the AS/400 system series of boxes technology. I installed a few
boxes, and used to provide maintenance in hardware and OS support.

Since then, I learned that the security of this system, if not the best, is
one of the best. The technology behind the design of the whole box has
been of advanced minds, and the most attractive part for me was always that
the operating system was an object-oriented one, a subject that I have
always had a lot of effort to learn and master.

Only a while later was that I dedicated myself to learn to program in this
system, and with the knowledge of the architecture of the hardware and the
operating system, it was quite easy for me to adapt.

In all these years that I have known people in charge of the management and
administration of the system but who are not programmers, I have listened
insistently to the concept that it is a good practice not to allow access
to the IBM i without there being exaggerated protection measures in
security matter.

I always hear excuses that a core of applications must be super secured,
and the methods they approve and allow to interact with the IBM i must be
overly monitored. It causes me great regret that the security of IBM i is
given a poor quality, and thus justify investing in additional servers to
put them in the middle.

I would like to hear some comments about what your experiences have been
that both the benefits and power of the IBM i security are limited, by
putting so many fences around, when this security has all the elements that
are required for these boxes to be absolutely safe. .

For example, I love the idea of developing web service interfaces with the
tools that IBM i naturally brings, but I find myself with limited thoughts
that these options pose a security risk. In such a way that administrators
and decision makers say NO to these possibilities.

There are also the possibilities of developing programs in Java and running
on the IBM i, and even in these things I have found opposition. Until very
recently I could see a yes to access a solution of the latter type.

What do you think? I would like to hear opinions and experiences about
whether the security power of IBM is worth overboard and spend more on
other technologies around it, in the name of good security practices when
it comes to interacting with IBM i.

Thanks in advance.