Re: iSeries vs IIS web site

[Joe Pluta <joepluta@xxxxxxxxxxxxxxxxx>]

On 4/17/2011 3:26 PM, John Jones wrote:
> "Be specific.  This is only for cardholder data.  The PCI doesn't say you
> can't keep a database on the DMZ, just not sensitive carholder data."
>
> True, but then PCI only addresses cardholder data.  To stay in scope that's
> all they can mention.
>
> But think about it.  What this standard is really saying is data in the DMZ
> cannot be considered secure.

Balderdash and tommyrot, I say!  :)  Seriously, it's saying nothing of 
the kind.  It's saying they require extra precautions for this class of 
information.  Consider it a belt and suspenders approach to security.

> " I've yet to hear of a single IBM i being hacked to gain access to data -
> cardholder, patient, or otherwise."
>
> Comments like this really make me shake my head.  Why are you entitled to be
> notified of every or even any breach on the i platform?  A breach has to
> meet certain criteria before public notification is required and even those
> laws have not been in existence the entire time that OS/400 has been
> around.  Pre-California SB1386 no notifications were required by anyone.
> And breaches need to be a certain size before disclosure is mandatory.  And
> that's only US state law; in other countries YMMV.

I'm not "entitled" to anything.  Just as you're not entitled to use a 
narrow regulatory policy to impute a lack of security onto an entire 
architecture, and more specifically onto the i.  If you claim that port 
80 access to an IBM i is enough to hack the database then you ought to 
be able to provide at least one case of it happening.  If you cannot, 
then your assertion is as valid as claims to yetis or alien abduction.  
Possible, but hardly plausible.

> Which means there are still security issues being addressed.  Which means
> our beloved platform's security is not perfect.  Which means we still need
> to take every reasonable precaution.

I agree.  Every reasonable precaution.  Putting the database on a 
separate machine just guard against a hypothetical security breach that 
has never happened is no more reasonable than wearing a tinfoil hat to 
guard against "government mind rays".

In my opinion.

Joe