Free IBM i Security Tool

IBM i Security Exposure Check

Answer twelve questions about the controls running on your IBM i. You will get an instant readiness reading, a visual breakdown of the weak areas, and the three fixes worth doing first.

No email No account Nothing leaves this browser tab
Last verified
Instant reading

The 12-Question IBM i Exposure Reading

Choose the answer you can prove today. If you are not sure, choose the uncertain answer. That uncertainty is useful because it tells you which evidence to collect first.

Questions answered 0 of 12
Foundation
1 What QSECURITY level is the production system using?

Use DSPSYSVAL QSECURITY if the answer is not already documented.

2 When were default passwords, dormant profiles, and powerful shared profiles last reviewed?

A policy is not proof. The useful answer comes from a current user-profile report.

Authority
3 Can you name every profile with *ALLOBJ or *SECADM and explain why it still needs that authority?

Count service profiles and group-profile inheritance, not only named administrators.

4 Has *PUBLIC authority been tested on production libraries, files, and IFS shares?

Check the authority people receive without a specific private or group grant.

Network access
5 Are FTP, ODBC, JDBC, DDM, and remote command protected by tested exit-point rules?

A restricted menu does not control these network services.

6 Is encrypted transport enforced for every active IBM i service?

Available TLS is not enough. The plain connection must be refused.

Detection
7 Is QAUDJRN enabled with QAUDCTL and QAUDLVL values chosen for the events you need?

Having the journal object is not the same as collecting useful events.

8 Does a named person review security events on a defined schedule?

A journal left on the IBM i is evidence after the fact, not active detection.

Data protection
9 Are sensitive DB2 fields and IFS data encrypted with keys kept apart from the data?

Cover the real copies, including extracts and staging directories, not only the primary table.

10 Are backups and save files encrypted, and has key recovery been tested?

An unreadable backup is not a recovery control.

Identity and recovery
11 Does MFA cover both 5250 sign-on and network services?

MFA on one screen does not automatically protect FTP, ODBC, JDBC, or remote command.

12 Can the team restore clean data from a copy that attackers cannot alter from the production system?

The useful proof is a completed restore, not a successful backup job message.

Your answers are scored in this browser. They are not sent or saved.

What the Reading Measures

The result measures whether the main IBM i security layers are present, enforced, and backed by evidence. It gives uncertain answers real weight because an unverified control cannot be trusted during an incident.

The six control areas in the reading

Control areaWhat a strong answer provesUseful evidence
FoundationThe operating-system baseline and user-profile inventory are currentQSECURITY plus a dated profile report
AuthorityPowerful and default access are limited by designSpecial-authority and object-authority reports
Network accessServices cannot bypass sign-on controls or use plain transportExit-point rules and client-side connection tests
DetectionUseful events are collected and reach a named reviewerQAUD values, sample events, alerts, and review records
Data protectionSensitive live data and recovery copies are encrypted with recoverable keysData map, key records, and a restore result
Identity and recoveryStrong identity reaches the real entry routes and a clean recovery remains possibleMFA coverage map and isolated restore proof

Use the Answer Without Turning It Into Shelfware

  1. Verify the first finding

    Collect the evidence named in the result. Replace assumptions with current system output before changing production.

  2. Test the control

    Prove the proposed change against real application and network traffic in a safe environment.

  3. Make one owner responsible

    Give the fix a person, a completion date, and a clear test for done.

  4. Run the reading again

    Use the same answers after remediation so the improvement is visible and the next weak area moves up.

A high reading does not prove the absence of a vulnerability. It proves that the broad control layers in this tool are better covered by the answers and evidence you supplied. Use the security assessment and audit process for deeper verification.