Conducting an AS/400 audit involves a systematic review of security controls, user permissions, system values, and operational logs to ensure compliance, data integrity, and protection against unauthorized access within IBM i environments.
Navigating the architecture of an IBM Power Systems environment running IBM i (historically known as the AS/400, iSeries, or System i) requires a specialized auditing methodology. Unlike standard distributed operating systems such as Windows Server or Linux, the AS/400 features a unique object-based security model and an integrated database structure. Because these legacy-turned-modern systems often house an organization's most critical core transactional data—such as financial ledgers, enterprise resource planning (ERP) systems, and supply chain records—they are prime targets for internal compliance reviews and external regulatory mandates like SOX, HIPAA, PCI-DSS, and GDPR.
A successful AS/400 audit bridges the gap between traditional mainframe security concepts and modern cybersecurity frameworks. It requires looking deep beneath the green-screen interface to evaluate system values, user profiles, object authorities, network services, and journaling configurations. By executing a structured, twelve-step procedure, security professionals, internal auditors, and systems administrators can comprehensively evaluate risk, remediate vulnerabilities, and establish a repeatable compliance framework.
1. Define the Audit Scope and Regulatory Objectives
Every effective audit begins with a clearly defined boundary. Before running system commands or reviewing user authorities, you must determine what the audit is meant to achieve. Is the objective to satisfy Sarbanes-Oxley (SOX) Section 404 controls over financial reporting? Are you verifying compliance with the Payment Card Industry Data Security Standard (PCI-DSS) because the system stores cardholder data? Or is the focus an internal operational health check to identify accumulated security technical debt?
Establishing the scope involves mapping all logical partitions (LPARs) that require examination, identifying applications that process sensitive data, and determining which user populations fall under review. Documenting these parameters upfront ensures that the audit team focuses on high-risk areas—such as financial ledgers, inventory control systems, and payroll files—rather than spending disproportionate time on low-risk administrative partitions.
2. Review and Harden System Values (QSYSVAL)
System values on the AS/400 govern global operating system behavior, security enforcement, password complexity, and resource limits. Reviewing these settings is one of the fastest ways to identify systemic weaknesses. Auditors must examine the current settings against IBM security reference recommendations and internal corporate policies.
Key system values requiring scrutiny include:
- QSECURITY: This value controls the system security level. Environments processing sensitive data should generally run at security level 40 or 50, which enforces object-level security and prevents unauthorized execution of sensitive APIs.
- QPWDVLMT and QPWDLMT: These control password complexity rules and the frequency with which users can reuse old passwords.
- QAUTOVRT: Controls the automatic creation of virtual devices, which can be exploited if left unchecked.
- QREMOTEMAP: Dictates how remote connection requests are mapped to user profiles.
| System Value | Recommended Setting | Security Rationale |
|---|---|---|
| QSECURITY | 40 or 50 | Enforces strict object-level authority and cryptographic password storage. |
| QPWDLMT | 10 to 24 | Prevents users from cycling through a small group of easily guessable passwords. |
| QAUTOVRT | 0 | Stops automatic device creation, mitigating unauthorized virtual session injection. |
| QALWOBJAWI | REJECT | Blocks the execution of commands from unauthorized remote applications. |
3. Analyze User Profiles and Administrative Accounts
The principle of least privilege is frequently violated in legacy IBM i environments due to decades of personnel turnover and administrative expediency. Auditors must review all active user profiles, focusing heavily on profiles with elevated capabilities.
Begin by listing all profiles possessing the *ALLOBJ (All Object) special authority, which grants unrestricted access to every object on the system. Similarly, check for profiles with *SECADM (Security Administrator), *IOSYSCFG (Input/Output System Configuration), and *JOBCTL (Job Control) authorities. Every administrative account must be tied to a specific, identifiable individual rather than a shared generic profile. Generic administrative accounts make accountability impossible and violate virtually every major compliance standard. Furthermore, verify that vendor accounts used for remote support are disabled when not actively in use.
4. Evaluate User Password Management and Expiration Policies
Weak authentication mechanisms remain a primary vector for unauthorized system access. An AS/400 audit must verify that password policies are actively enforced across all user categories, including production, development, and operational accounts.
Inspect user profiles for default passwords, blank passwords, and profiles set to never expire unless explicitly justified by functional constraints (such as automated batch-processing jobs). Verify that the system automatically locks user profiles after a specified number of consecutive invalid sign-on attempts, governed by the QMAXSGNATT system value. Additionally, confirm that user passwords are saved using modern cryptographic hashes rather than legacy encryption schemes.
5. Audit Object-Level Security and Public Authorities
Unlike file-system-based operating systems where security is often applied only at the folder level, the AS/400 uses an object-based architecture. Every library, file, program, command, and data area is an object that can have explicit access controls assigned to it.
Auditors must check the public authority (AUT) of sensitive libraries and files. A public authority of *ALL or *CHANGE on financial data files represents a severe risk, as any user on the system can read, modify, or delete core business records. Best practices dictate that public authority for sensitive production libraries should be set to *EXCLUDE, with access granted explicitly to authorized user groups or application profiles.
6. Inspect Special Authorities and Group Profiles
Group profiles simplify user administration by allowing administrators to assign authorities to a group rather than individual users. However, if managed poorly, group profiles can inadvertently grant sweeping privileges to unintended users.
Examine the relationships between primary profiles and their associated group profiles. Check whether users inherit special authorities from secondary group profiles or if private authorities are being bypassed. Auditors should run reports identifying all users who possess special authorities either directly or through group membership, ensuring that the aggregation of privileges does not violate segregation of duties (SoD) principles.
7. Review Network Security and Communication Servers
Modern AS/400 environments rarely operate in total isolation; they connect to corporate local area networks, web applications, and external APIs via various host servers (such as database, file, remote command, and data queue servers).
Securing these entry points requires evaluating the configuration of network server exit programs. IBM i provides exit point registration facilities that allow third-party security software—or custom exit programs—to intercept incoming requests from clients running Client Access, ODBC, JDBC, or FTP. Auditors must verify that exit programs are active to log, inspect, and block unauthorized data access attempts originating from the network. Additionally, confirm that insecure legacy protocols like Telnet and FTP are restricted or replaced with secure alternatives such as SSH and SFTP where applicable.
8. Validate System Logging and Audit Journaling
You cannot audit what you do not record. The security auditing journal (QAUDJRN) is the core mechanism for tracking security-relevant events on the AS/400.
Auditors must verify that the security auditing value (QAUDCTL) is enabled and configured to capture relevant actions. Key journaling values to inspect include:
- AWAUDLVL: Specifies the system-wide auditing level, tracking actions such as object accesses, authority failures, security-value modifications, and profile changes.
- QAUDENDL: Determines how the system reacts if the audit journal reaches capacity, ensuring that operations halt or alert administrators rather than dropping security events.
Review how audit journal receivers are managed, backed up, and archived. Ensure that audit logs are protected from tampering by administrators who might attempt to hide unauthorized activities.
9. Examine Program Authorization and Adopted Authority
One of the most powerful and potentially dangerous features of the AS/400 is adopted authority. When a program is compiled with USEADPAUT(*YES), it runs with the authorities of its owner rather than—or in combination with—the authorities of the user executing it. While this allows restricted users to run specific batch jobs or update specific tables safely, it can also create security backdoors if poorly designed.
Auditors must identify all programs utilizing adopted authority, particularly those owned by security officers or high-privilege profiles. Check whether these programs contain security vulnerabilities, such as command injection flaws, that could allow a malicious user to hijack the adopted authority and execute arbitrary system commands.
10. Review Job Scheduler, Batch Processing, and Operations
Automated jobs, scheduled tasks via the job scheduler (WRKJOBSCDE), and subsystem descriptions dictate how background processing occurs. An AS/400 audit must evaluate whether batch jobs run under appropriate user profiles.
If high-privilege batch jobs run under generic or overly permissive profiles without adequate logging, rogue processes could execute undetected. Review job logs for recurring errors, abnormal terminations, and unauthorized job submissions. Ensure that operator consoles and system operator message queues (QSYSOPR) are actively monitored for critical warning messages.
11. Test Disaster Recovery, Backup, and Media Controls
Technical security controls are incomplete without operational resilience. An AS/400 audit must evaluate the organization's ability to recover from hardware failures, ransomware attacks, or catastrophic site disasters.
Examine recent backup logs generated via standard save commands (SAVSYS, SAVLIB, SAVCHGOBJ) to ensure that complete system backups are occurring on a regular, verified schedule. Verify that backup media is encrypted both in transit and at rest. Crucially, review the results of periodic disaster recovery restoration tests to confirm that the business can successfully rebuild the partition from bare metal within acceptable Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO).
12. Compile Findings, Remediate Risks, and Establish Continuous Monitoring
The final step of the audit process transforms raw findings into actionable business improvements. Compile all identified vulnerabilities, control deficiencies, and policy violations into a formal AS/400 audit report.
Prioritize remediation efforts based on risk severity. Immediate high-priority actions typically include disabling inactive profiles with *ALLOBJ authority, correcting wide-open public file authorities, and enabling security journaling. Finally, transition from periodic point-in-time audits to a continuous monitoring framework by deploying automated security monitoring tools that track system value modifications, privilege escalations, and failed sign-on attempts in real time.
Frequently Asked Questions
What is an AS/400 audit?
An AS/400 audit is a systematic evaluation of security settings, user permissions, system values, and operational logs on IBM Power Systems running the IBM i operating system to ensure data protection, operational integrity, and compliance with regulatory standards.
Why is object-level security important in an AS/400 audit?
Unlike file systems that rely solely on folder permissions, the AS/400 architecture assigns security controls directly to individual system objects. Auditing object-level security ensures that users only have access to the specific programs, files, and commands required for their job roles.
How do system values impact AS/400 security?
System values control global operating system parameters, including password complexity rules, security levels, remote mapping, and sign-on attempt limits. Reviewing these values ensures the system enforces robust baseline security policies.
What is the purpose of the security auditing journal (QAUDJRN)?
The security auditing journal records security-relevant events such as authority failures, user profile creations, system value changes, and object accesses. It provides an immutable audit trail required for forensic analysis and compliance verification.
How often should an AS/400 security audit be performed?
Comprehensive AS/400 audits should generally be conducted at least annually, while critical security logs, privileged user accounts, and system value changes should be monitored continuously or reviewed on a monthly basis.
