How Exit Programs Make the Greatest Impact on IBM i Security

What do exit points have to do with cybersecurity? How do exit programs work? Robin Tatam provides a clear explanation in the video below!

Today, we're talking about a concept in IBM i security called exit points. Exit points are not really a term in security—they're actually more of an application design. But the operating system has a number of these exit points that pertain specifically to securing the server from connections coming from PCs.

Here we see a nice Power Systems servers and we have a user accessing the server from a laptop. Using a number of different protocols, they have access into the database in addition to the more traditional green screen environment that many of you perhaps are still using.

Now, in a green screen environment, we have the ability to put a menu in front of the user. We have application security that also corrals and controls what the user can do when they’re on the system.

But what when the user uses a protocol like FTP or ODBC, they’re not actually going through the application layer. So, the menu security and the application security are not effective.

Starting at version three of the operating system, IBM added a function called an exit point that allows us to register an exit program. There seems to be a lot of confusion around exit point security and exit programs do for us.

What it comes down to is the fact that all of these connections are coming into the server. The exit point is a break in the center of that. It will pause the transaction and question whether there’s an exit program present.

If there is not, then the transaction continues to the server. But if there is an exit program, then the exit program is called. It’s given information about who the user is, where they’re coming from, and what they’re asking to do. That exit program can do basically anything the programmer desires.

Ultimately, we want it to do two things. First, we want it to create a log of that activity so we can report on it. Second, we also want that exit program to have the ability to determine whether that user shouldn’t be performing that type of transaction.

If that’s the case, when the exit program is called, it has the ability to discard that transaction and prevent it from happening—even if the user has a permission like All Object special authority or has access to the database behind the scenes.

So, the power of an exit program when registered to an exit point is that it has that total control and authority much like a firewall.

There are about 30 different exit points within IBM i specific to network access transaction like FTP, ODBC, JDBC, SQL, and remote command. You have to have exit programs registered to each of them in order to perform that task. When you do, you gain a significant advantage over those who are reliant on menu security in that your security mechanism is now all-encompassing and can handle the connections coming from more modern interfaces in addition to the traditional green screen.

Take advantage of exit points and add exit programs. You’ll add probably the greatest value to your IBM i security posture of any of the controls available.