RE: Anti-virus for i5OS

["Murphy, Mark" <MurphyM@xxxxxxxxxx>]

I would not allow a package that required QSECOFR authority to be used in production by anyone but the
security officer, and only under restricted circumstances.  Certainly not by a user.

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Buck
Sent: Tuesday, April 01, 2008 1:29 PM
To: midrange-l@xxxxxxxxxxxx
Subject: Re: Anti-virus for i5OS

Joe Pluta wrote:

> > There is no known instance of any IFS file ever executing code on i5/OS.
> And by this, I hope you know what I mean.  There is no way copying a 
> file to the IFS can magically execute code on the System i under normal 
> operation.
>
> There are of course ways around that.  Running non-secure environments 
> such as PASE, especially running "industry standard" code with known 
> exploits, can get around this.  So I suppose as you start running 
> non-native applications, there is more need for that sort of protection.

All true, but don't forget all those native packages that demand QSECOFR 
authority to install and run under.  There've been a spate of reports of 
malware being installed at the factory floor for phones, game consoles 
and the like.  It's not inconceivable that the same thing could happen 
to us, especially when we just automatically install so much stuff as 
QSECOFR as a matter of habit...