Author Archives: T.Rob

Inaccurate MQ auths event messages

The security maturity progression in MQ starts with access control.  First we isolate MQ Admin access, then add granular user and application access.  This class of security control is known as intrusion prevention.  After mastering that the next phase includes … Continue reading

Posted in News, Security, WMQ, WMQ Security | Tagged , , , , , , , , , | 2 Comments

CHLAUTH research updates

I’ve added a “Versions” tab to the results matrix, corrected some copy/paste errors, and uploaded new copies of the PDF and Excel versions.  Over time as new results are added or corrections made I’ll replace the existing documents so the … Continue reading

Posted in General | Leave a comment

MQ Password/CHLAUTH research – Exec Summary

As of v8.0, MQ now can natively validate user IDs by checking the password against the Operating System or LDAP.  Checking against Pluggable Authentication Module (PAM) was added in v8.0.0.4.  Prior to v8.0 it was necessary to use a channel … Continue reading

Posted in Security, WMQ, WMQ Security | Tagged , , , , , | 4 Comments

Configuration backups: the forgotten WMQ security control

Update: IBM has reconsidered and has announced that dmpmqcfg will be fixed as a defect! Subscribe if you would like a notification when the fix is announced. But please do read the post, especially if you are using amqoamd for … Continue reading

Posted in Fail, General, IIB, Security, WMQ, WMQ AMS, WMQ ESE, WMQ FTE, WMQ Security | Tagged , , , , , , , | Leave a comment

Webinar: Security Defenses that Withstand the Test of Time

Please join AJ Aronoff and me for a Prolifics webinar: IIB: Security Defenses that Withstand the Test of Time For the last 7 years my security focus has mainly been intrusion prevention.  That’s all the controls you use to keep … Continue reading

Posted in General | Leave a comment

We’re gonna need a bigger crowd

Crowdsourcing: Collaboration based on the idea that given a sufficiently large pool of talent, it is possible to create a specific deliverable of high quality and in a timely fashion, using donated excess capacity of the crowd. Some things just … Continue reading

Posted in Security | 4 Comments

Back to consulting

Got WMQ security work?  I’m happy to report I’ll soon be available for consulting engagements!  After a couple of years in WebSphere MQ Product Management, and 6 before that in IBM Software Services, I’ve given notice to IBM and will … Continue reading

Posted in Events, IOT, MQTT, News, WMQ | 5 Comments