Re: Preparing for a High-profile Termination

Review all programs that operate with adopted authority of powerful profiles.

Review every user profile that gets changed or created upon termination.

Absolutely do not assume backdoor access will us a profile with a recognized name! Like the Book of Hezekia in the Bible, how many of you can tell me quickly which of the following user profiles does not belong: QPEX, QNTP, QSMTP, QMSF, QIPP, QTCM?? (There is no Hezekia by the way but it will send most people looking!) If an adopted profile program lays in the right place (i.e. as a fake Trigger program or as a powerful profile's signon program) access may be re-created automatically by this program and it might not happen for weeks or even months when your vigilance is worn.

- Larry

ps: It's QSMTP, the others are legit.

Steve Martinson wrote:

Situation:

High-profile, knowledgeable staff member soon to be terminated (employment, not by
Ahh-nold); has "keys to the kingdom" for both the System i and the network;
likely knows passwords for many service and/or utility profiles on the iSeries.

Requirement:

Prior to term date, analyze system for vulnerabilities associated with a
position like the one described above and prepare a task list that will address
the situation both before and after the termination.

Areas to be reviewed include system values, network attributes (exit points
too), directory entries, SST, job descriptions, subsystem routing entries, all
user and group profile parameters and their implications, authorities to
libraries, directory (WRKLNK) authorities, etc.

Can anyone think of anything else that could be a critical hole that should be
reviewed/covered?
Best regards and TIA,
Steven W. Martinson, CISSP, CISM
Sheshunoff Management Services, LP.
Senior Consultant - Technology & Risk Management
2801 Via Fortuna, Suite 600 | Austin, TX 78746
Direct: 281.758.2429 | Mobile: 512.779.2630
e.Mail: smartinson@xxxxxxxxx