× The internal search function is temporarily non-functional. The current search engine is no longer viable and we are researching alternatives.
As a stop gap measure, we are using Google's custom search engine service.
If you know of an easy to use, open source, search engine ... please contact support@midrange.com.


  • Subject: Re: Package Vendor that changes IBM command Defaults.
  • From: Roger Vicker <rvicker@xxxxxxxxxx>
  • Date: Tue, 22 Jun 1999 20:31:58 -0400
  • Organization: Vicker Programming

All,

Thanks for the backup.

You've made some of the same points I plan to press. I would like to take the
ideas presented and put together a "How to rate a vendor's security approach"
guideline but it will have to wait until a couple of major conversion are done.

BTW, I don't want to outlaw a vendor using QSECOFR at all, but they should only
use it (or its equivalent) only when there is no other reasonable way to get the
needed task done. The standard mode of operation use of QSECOFR by ANYBODY other
than a dedicated security officer doing only security officer exclusive
functions
is just plan reckless.

Roger Vicker, CCP

"MCPARTLAND, Stan" wrote:

> The following are some of the standard requirements we have for security
> when we evaluate software.  Failing to meet these requirements may not rule
> out a vendor, but definitely has an impact on our selection process.  You
> would be surprised at how easy it is to get a command entry screen with
> QSECOFR authority in some software packages.
>
> - Secure command line access and control of access to systems commands and
> menus.
> - No hidden, undocumented access to the system.
> - No switching of user profile handles.
> - Secure use of adoptive authority and user profiles on JOBD's.
> - No second level passwords and user profiles.
> - The application's security must be based on individual user profiles.
> - The application must provide field level security.
> - There must be no dependence on QSECOFR authority adoption. The application
> software must not require QSECOFR authority to install.
> - Objects must be owned by a non-IBM provided user profile.
>
>

--
*** Vicker Programming and Service *** Have bits will byte ***
Thousands of journeys have a start but no end.
+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---


As an Amazon Associate we earn from qualifying purchases.

This thread ...

Replies:

Follow On AppleNews
Return to Archive home page | Return to MIDRANGE.COM home page

This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].

Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.