At IBM Database Magazine: Just how difficult is it to retro-fit an auditable security framework?

There is a very useful script from Jonathan Leffler available here.

I mentioned this RedBook in one of my earlier posts and wanted to have a closer look at it.

I remember that when I looked at the contents originally, I was surprised to see no mention of physical and only a limited discussion of file system security. The only discussion relating to file system security was around backups.

In my opinion, another omission was that there is no suggestion made of what sort of things you should audit with the onaudit program.

Some of the options are presented to the reader without any real emphasis as to which is a better option. For example, there is no mention that regular DES encryption (as opposed to Triple-DES or DES3) is not a very good option. Although it is mentioned that Electronic Cook Book (ECB) cipher mode is easy to crack, it's also not very well highlighted and didn't jump out at me. (It will leap out at you if you scan the PDF for the string "ecb", but if you were reading the article normally, it certainly wouldn't, as it's in a section called "Sample Settings". :-) )

IBM has recently released a new RedBook, called "Security and Compliance Solutions for IBM Informix Dynamic Server"

It looks to be a comprehensive review, covering:

Role separation;
Auditing;
SQL security;
Communication; and
Backup security

It looks well worth a read.

Security is a big issue and I don't find most people take it seriously enough. Have a look at an optimally secure system design, then look at where your environment diverges from that. Break the deficiencies into bite-sized chunks that you can address as and when you have time.

Final Version: IBM Redbook about IDS Security

A new interesting Redbook Redbook has left the draft status and has been officially published:

• Security and Compliance Solutions for IBM IDS

Download the Redbook to gain an understandig on the robust and comprehensive security technology that IDS offers. IDS is IBM's safest and most performant data server for business critical data on the Linux, Unix and Windows platforms.