Architecture / Data Protection

IBM i Data Encryption at Rest and in Transit

Encryption is the last line of defense: it matters most when every other control has already failed, which is exactly why it's worth getting right rather than skipping.

Last verified

Encryption at Rest: Field-Level vs. Full-Database

Field-level encryption protects specific sensitive columns, card numbers, SSNs, account numbers, leaving the rest of the row readable. It is the more common choice because it minimizes performance impact and application changes, and it maps directly onto PCI DSS and similar frameworks that scope compliance around specific sensitive fields rather than entire databases. Full-database or disk-level encryption protects everything uniformly and is simpler to reason about, but with more performance overhead and less granularity for compliance scoping.

Field-Level vs. Full-Database Encryption

Field-LevelFull-Database / Disk-Level
Performance impactLower, scoped to specific columnsHigher, applies uniformly
Application changes requiredSometimes, depending on productTypically none
Compliance scoping fit (PCI DSS, etc.)Strong, maps to specific sensitive dataBroader, less granular
Key management complexityPer-field or per-table keysSystem-wide key management

Key Management Is the Part That Gets Skipped

Encryption is only as strong as the key management behind it. Storing encryption keys on the same system as the encrypted data undermines the point of encrypting in the first place, since anyone with access to compromise the data likely has access to the keys too. Look for hardware security module (HSM) integration or, at minimum, keys stored and access-controlled separately from the database they protect, with defined key rotation procedures.

Encryption in Transit

5250 sessions, FTP, and other network access to IBM i can run in the clear unless TLS is explicitly configured. SSH access is encrypted by design, which is one of the reasons it has increasingly replaced Telnet for administrative access. Confirm TLS is enforced (not merely available) for 5250 emulation sessions and for FTP, since the default behavior on many systems still permits unencrypted fallback.

Encryption protects data from someone who has bypassed authority controls or gained unauthorized access to the storage layer. It does not substitute for authority management: a profile with legitimate *USE authority to a field reads it in plaintext regardless of the encryption underneath.

Vendors Covering This Control

Precisely (Assure Security)

Precisely's Assure Security suite is the broadest single-vendor IBM i security platform on the market, spanning multi-factor authentication, encryption, compliance monitoring, and access control in one licensing family. It is the platform we point mid-size and enterprise IBM i shops to first when they need one vendor covering the most ground.

Strengths

  • Widest single-suite coverage: MFA, encryption, exit point control, and compliance monitoring under one console
  • Strong native IBM i journal-based monitoring with real-time SIEM forwarding (Splunk, QRadar, Sentinel)
  • Assure Encryption supports field-level and full-database encryption without application changes in most cases
  • Established install base and long IBM i-specific engineering history (originated from Townsend Security and Syncsort lineage)

Limitations

  • Suite pricing and licensing complexity increases as modules are added; full-suite cost is not the cheapest entry point
  • MFA client coverage for legacy green-screen sessions requires exit-point configuration that takes real implementation time
  • Reporting UI is functional but less modern than some newer point-solution dashboards

Best fit: Mid-size to enterprise IBM i shops that want one vendor for MFA, encryption, and compliance monitoring rather than stitching together point products.