Security: More Stuff...

Good General Security Resources

• SANS organization dedicated to security education. Hosts conferences around the globe, publishes papers, and runs the Internet Storm Center
• CERT Affiliated with Carnegie Melon University. Researches Internet vulnerability and incident response issues, publishes vulnerabilities, sponsors research and seminars. Responsible for the Octave vulnerability analysis methodology
• National Institute of Standards and Technology (NIST) Computer Security Resource Center (CSRC)

AS/400 (iSeries) Security

Vendors

• PowerTech - Security management and assessment applications. Also provides security consulting.
• PalaceGuard - Security audit and management products
• Raz-Lee Security - Standalone applications for managing iSeries security, as well as system performance and application development
• AS/400 Security World - The AS/400 security toolkit, and the DetectIT line of security products

Books

• Experts' Guide to OS/400 & i5/OS Security (Paperback) Quoting the review: "This comprehensive Guide to OS/400 and i5/0S security is your one-stop resource for securing the information assets of your business. Written by two of the industry's most knowledgeable security experts, Carol Woodbury and IBM's Patrick Botz, this book is your ticket to a secure enterprise. " Carol worked a long time in IBM's Rochester facility on AS/400 security. She is likely more familiar with how it works than anyone else
• Hacking iSeries Quote: "The best way to secure your iSeries - AS400 server environment is to see how it can be hacked by an unfriendly party. This book will guide you through the steps a hacker would take in order to take over your AS400 and steal your data." Interesting this book was published in 2006 - indicates there is still some interest here.

Published Papers, Evaluations, Etc.

• Archives of the midrange.com security400 mailing list
• The NSA's Final Evaluation Report for V4R1 (1998) - The Common Criteria evaluation of a more current version is "in process".
• Computer Crime And Abuse,A Review Of The IBM AS/400 - A thesis from Saint Mary's University. Formerly the entire work was available, now only the abstract is online
• Guide to best practices from SANS
• Blackhat presentation on hacking the AS/400 "AS/400 for pentesters" at Black Hat, Europe 2006. Presented by Shalom Carmel http://www.venera.com
• Dubious Achievement: iSeries Gets Some Attention From Hackers Write-up of a presentation on the iSeries at the 2004 HOPE hacker con