Architecture / Data Protection

IBM i Database Security Controls

Object authority on a physical file is a blunt instrument: it's all-or-nothing per user. Db2 for i's row and column access control gives you a finer edge.

Last verified

Row and Column Access Control (RCAC)

Db2 for i's Row and Column Access Control, available since IBM i 7.2, lets you define row permissions and column masks directly at the database engine level. A row permission can restrict which rows a given user or group sees; a column mask can show a masked or null value for a sensitive column (a partial SSN, for instance) to users who don't need the full value, without maintaining separate views or duplicating application logic. RCAC enforces the same way regardless of whether the access comes through an application, ODBC, or an ad hoc SQL query, which closes a gap that view-based or application-layer restriction alone cannot.

Row PermissionsRestrict which rows a user or group can see, enforced at the engine level
Column MasksShow masked or null values for sensitive columns to unauthorized users
Enforcement ScopeApplies to application, ODBC, and ad hoc SQL access uniformly
Minimum ReleaseIBM i 7.2 and later

View-Based Restriction (The Older Pattern)

Before RCAC, the standard pattern was building SQL views or logical files that exposed only the columns and rows a given group needed, then granting authority to the view instead of the underlying physical file. This still works and is still common on systems that haven't adopted RCAC, but it requires maintaining a growing set of views as requirements evolve, and it does not protect against a user with authority to the base physical file bypassing the view entirely.

Where Database Security Meets Exit Points

Object and RCAC-level database controls apply regardless of access path, but the visibility into how data is being accessed does not. A user pulling data through ODBC generates different logging than one using an application menu, which is why database security controls need to be paired with exit-point logging (see the architecture overview and the intelligence reference on unsecured exit points) to know not just what data is protected, but how it is actually being reached.

RCAC is a database engine feature, not a bolt-on product, and it's underused mainly because it requires deliberate SQL DDL work (CREATE PERMISSION, CREATE MASK) rather than because it's hard to justify. If you're running 7.2 or later and haven't evaluated RCAC for your most sensitive tables, it's worth a scoping pass before reaching for a third-party product.

Vendors Covering This Control

Precisely (Assure Security)

Precisely's Assure Security suite is the broadest single-vendor IBM i security platform on the market, spanning multi-factor authentication, encryption, compliance monitoring, and access control in one licensing family. It is the platform we point mid-size and enterprise IBM i shops to first when they need one vendor covering the most ground.

Strengths

  • Widest single-suite coverage: MFA, encryption, exit point control, and compliance monitoring under one console
  • Strong native IBM i journal-based monitoring with real-time SIEM forwarding (Splunk, QRadar, Sentinel)
  • Assure Encryption supports field-level and full-database encryption without application changes in most cases
  • Established install base and long IBM i-specific engineering history (originated from Townsend Security and Syncsort lineage)

Limitations

  • Suite pricing and licensing complexity increases as modules are added; full-suite cost is not the cheapest entry point
  • MFA client coverage for legacy green-screen sessions requires exit-point configuration that takes real implementation time
  • Reporting UI is functional but less modern than some newer point-solution dashboards

Best fit: Mid-size to enterprise IBM i shops that want one vendor for MFA, encryption, and compliance monitoring rather than stitching together point products.

Cilasoft

Cilasoft is a France-based IBM i security vendor best known for QJRN/400 (journal-based auditing and compliance) and its anti-ransomware detection module. It has a long track record in European IBM i shops and growing presence elsewhere.

Strengths

  • QJRN/400 is a mature, well-regarded journal auditing and reporting engine
  • Anti-ransomware module specifically watches for IFS-side encryption behavior originating from network shares, a real and growing IBM i attack vector
  • Strong compliance reporting templates for European regulatory frameworks (GDPR-adjacent controls)

Limitations

  • Smaller North American market presence and partner network than Fortra, Precisely, or Raz-Lee
  • Product line is narrower (auditing and anti-ransomware) rather than a full security suite
  • English-language documentation and support resources are less extensive than French-language resources

Best fit: IBM i shops, especially in Europe, prioritizing journal-based audit reporting and IFS ransomware detection specifically.