RE: Security questions

Oliver,


> >I'd be inclined to have
> >*PUBLIC *EXCLUDE to all production data, then use your menu approach.
> This
> 
> >is better, still not bulletproof.
> 
> How do you handle query access, then?
> 
> We have lots of user queries and CAX-downloads and all that stuff. How
> complicated
> does setting up and maintaining these security tools get?

A well written exit program can provide selected access to data without
letting all of your users download everything whenever they want to.
You can use our exit programs to control what a user can download,
prevent them from uploading completely, and then audit everything that
they do so that you can  tell where the data has gone - an audit trail
that OS/400 doesn't provide.

If you have given your end users only *USER authority, then you are in
better shape than most - most applications provide for *CHANGE authority
- some even provide *ALL authority - but your are still at risk of data
theft.  At a minimum I would want to be able to track who downloads
certain sensitive files so that you can see who has access 9and is using
that access) to the important data.

jte

--
John Earl | Chief Technology Officer
The PowerTech Group
19426 68th Ave. S
Seattle, WA 98032
(253) 872-7788 ext. 302
john.earl@xxxxxxxxxxxxxxxxxx
www.powertech.com 
 

--
 

> Vern,
> 
> >I'd be inclined to have
> >*PUBLIC *EXCLUDE to all production data, then use your menu approach.
> This
> 
> >is better, still not bulletproof.
> 
> How do you handle query access, then?
> 
> We have lots of user queries and CAX-downloads and all that stuff. How
> complicated
> does setting up and maintaining these security tools get?
> 
> So, without exit-point programming or buying some security product, I
> cannot fix these
> loopholes? Thanks a lot, IBM..
> 
> Thanks,
> 
> Oliver
> 
> _______________________________________________
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.