How to Assess IBM i Security Posture
You cannot prioritize what you haven't measured. A structured assessment tells you where the actual exposure is, rather than where intuition says it probably is.
Start With System Values, Not Opinions
The fastest, most objective starting point is pulling the current security-relevant system values: QSECURITY level, QAUDCTL and QAUDLVL (audit journal configuration), QPWDEXPITV and related password policy values, QMAXSIGN and QMAXSGNACN (sign-on attempt limits), and QALWOBJRST (object restore restrictions). These take minutes to pull and immediately tell you whether basic controls are even configured, before you invest time in a deeper review.
Baseline System Values to Check First
| System Value | What It Controls | Common Finding |
|---|---|---|
| QSECURITY | Overall system security level (10-50) | Systems still at level 30 miss protections available at 40/50 |
| QAUDCTL / QAUDLVL | Security audit journal configuration | Often disabled or set to a minimal audit level |
| QPWDEXPITV | Password expiration interval | Set to *NOMAX, meaning passwords never expire |
| QMAXSIGN / QMAXSGNACN | Sign-on attempt limit and resulting action | Set high enough to make brute-force attempts practical |
| QALWOBJRST | Restrictions on restoring objects with adopted authority or system state | Set to *ALL, allowing any restored object to run at full trust |
Run an Authority Collection
System values tell you configuration. An authority collection (STRAUTCOL) tells you actual usage: which profiles are exercising which special authorities and object authorities during real activity. This is the evidence base for tightening *PUBLIC authority or removing unused special authority grants without guessing at what will break.
Assess Each Architecture Layer
Identity & MFA
Is MFA deployed, and does it cover network exit points or only 5250 sign-on?
Privileged Access
How many profiles hold *ALLOBJ or *SECADM, and is elevation logged?
Authority
What is *PUBLIC authority set to on production libraries?
Encryption
Is sensitive data encrypted at rest, and are keys managed separately?
Database Security
Is RCAC in use on sensitive tables, on IBM i 7.2 and later?
Auditing
Is QAUDJRN configured, and is anyone actually reviewing the output?
An assessment is only useful if it produces prioritized findings, not a raw data dump. Rank findings by exposure (what could actually happen) and ease of remediation, and start with high-exposure, low-effort fixes; QPWDEXPITV set to *NOMAX is a five-minute fix with real risk reduction, while a full RCAC rollout is a project.