RE: Separation of Duties...

Tell them that it isn't possible on the System i.

Since the DB is built into the OS, a System Admin with "root" authority, ie. QSECOFR authority, has
the same "root" type admin access to the DB.

Another way to consider it, you don't have a "system Admin", all you have is a DB admin. The DB is
the system. Unlike systems where the DB runs on top of the OS, where you have OS users to manage and
DB users to manage, there is only one set of users to manage on the System i.

Or, tell them you don't have a DBA, the normal DBA tasks like creating table spaces, balancing disks,
ect. are handled by the OS. You could even make the case that "DB Users" are authorized to the DB by
the OS when the System Admin adds users.

Lastly, perhaps you could consider the Service Tools QSECOFR ID the "system Admin" and the regular
QSECOFR ID as the "Database Admin".

HTH,
Charles

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Graap, Kenneth
Sent: Wednesday, October 31, 2007 11:17 AM
To: Midrange Systems Technical Discussion
Subject: Separation of Duties...

We are in the middle of an IS Audit and the auditor is asking
us why we don't separate the duties of DB Administrator and
System Administrator on our System i platform.

.Historically we have always combined these duties on the
System i but we are now being pressured to come up with a way
to separate them.

As anyone else had to do this and if so, how did you define
these duties and set up system security to enforce it?

or ... can anyone share a compelling argument for not
separating these duties?

Kenneth

****************************************
Kenneth E. Graap
IBM Certified Specialist
iSeries Multiple System Administrator
NW Natural (Gas Services)
keg@xxxxxxxxxxxxx
Phone: 503-226-4211 x5537
FAX: 503-721-2518
****************************************

--
This is the Midrange Systems Technical Discussion
(MIDRANGE-L) mailing list To post a message email:
MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change
list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting,
please take a moment to review the archives at
http://archive.midrange.com/midrange-l.

This e-mail transmission contains information that is intended to be confidential and privileged. If you receive this e-mail and you are not a named addressee you are hereby notified that you are not authorized to read, print, retain, copy or disseminate this communication without the consent of the sender and that doing so is prohibited and may be unlawful. Please reply to the message immediately by informing the sender that the message was misdirected. After replying, please delete and otherwise erase it and any attachments from your computer system. Your assistance in correcting this error is appreciated.