iCompliant — IBM i configuration assessment platform

While iCompliant can ensure compliance with best practices from organisations like CIS or IBM, its primary goal is practical guidance for defending against all phases of the intrusion kill chain. In its base configuration, the knowledge base incorporates hands-on experience from pentest projects and research to refine recommendations and prioritisation.

Examples

• Some APIs are accessible to all users by design; iCompliant checks hardened access controls, since these APIs are commonly used in privilege-escalation exploits.
• iCompliant provides information for local and remote attack-surface reduction.

iCompliant is not a monitoring tool and isn't meant to provide real-time data. Some audit items check the state of large numbers of objects, which takes time, so items are grouped — quick checks run frequently, heavier audits run when load is low.

Examples

• A scheduled task can check system values hourly, while authorities on file objects are checked monthly.
• Selected audit items can be run on demand, e.g. after significant configuration updates.

Exit programs are important, but not silver bullets: not every interface can be protected by them, and some vulnerabilities are reachable through allowed transactions. Defense-in-depth means anticipating that some controls fail, so systems must be hardened in multiple layers.

Example

• Vulnerabilities in third-party applications generally can't be mitigated with exit programs.

Modern attacks commonly start inside the corporate perimeter, exploiting client-side vulnerabilities or abusing human trust. Given how frequently internal systems are involved in incidents, the lack of data about IBM i incidents only suggests the industry lacks the means to detect them.

Example

• The 'Kemuri Water Company' incident showed that even low-skilled groups can and do target IBM i systems.

iCompliant is meant to run on external workstations or servers and requires no extra software installed on the target IBM i systems.

Examples

• A scheduled task on a Linux server can periodically generate reports about IBM i systems.
• SOC analysts can run individual checks for human review from their Windows workstations.

Alongside standard integrations (Excel and JSON export; Jira integration), iCompliant can be extended to support arbitrary export formats and APIs.

Examples

• Custom exporters can push results via a REST API.
• Default JSON output can be transformed with standard tools for any JSON-compatible ingestor.

As a framework, iCompliant allows custom audit items and fine-tuned results to match the unique expectations and requirements of the target systems. Relevant items can be selected per security requirement.

Examples

• Custom items can verify that critical business objects are only accessible by specific users.
• Custom corporate password-policy enforcement can be added to regular compliance checks.

Customers can extend iCompliant with new audit items at no limit or extra cost, by creating configuration files in an easy-to-understand, fully documented format. If building items in-house isn't an option, custom audit-item development services are available — contact us for details.

Subscriptions cover year-long periods, during which all relevant updates and releases are delivered. Subscription licences are limited by the number of target IBM i systems. All plans include unlimited scans and cover all current and future test cases released during the subscription period. See the pricing table above.

Silent Signal performs unique research focused on IBM i to uncover previously unknown vulnerabilities of the platform and its ISVs. The EVF provides access to this research so customers can mitigate vulnerabilities even before vendor fixes are available. It is available to select Base Subscription customers at different levels:

Level 40 — 0-day detection

• Customers receive Audit Items so affected software is detected automatically by the framework; detection items produce mitigation guidance in the report when an unpatched vulnerability is found.

Level 50 — 0-day demonstration

• Includes a demonstration attempt for any vulnerability in the feed, on covered systems, performed by senior experts over a remote connection during agreed time frames.

The core IBM i and popular ISV applications are included.

Example

• If your company uses a popular Exit Point Manager, EVF Level 40 gives you information about vulnerabilities affecting it and mitigation guidance before vendor patches are available.

Basic support includes communication via e-mail, 8×5 support hours (CET/CEST), and next-business-day response to the initial report. Additional support options are available on request.

Ransomware is not an IBM i-specific problem; it primarily affects IBM i at integration points with the wider corporate infrastructure. Defending against it requires strategies across all platforms. iCompliant contributes on the IBM i side through attack-surface reduction and verification of access controls.