RE: AS400 Automatic Sending of New Password?

At work, our automated process needs the last four of my SS# and a

correctly answered challenge question.

That doesn't sound "automatic" to me. The user has to manually verify
their identity to perform the reset. This would appear to be an example
of "a commercial application that takes the risk and guesswork out of
the process." I'm not trying to split hairs here, the person I was
referring to was intending to monitor for the CPF1394 message and
automatically re-enable the profile with no other intervention.

You may also find that passing an audit next year may be harder than
passing the same audit was last year.

Regards,

Scott Ingvaldson
Senior IBM Support Specialist
Midwest Region Data Center
Fiserv.


-----Original Message-----
From: Charles Wilt [mailto:charles.wilt@xxxxxxxxx]
Sent: Wednesday, June 17, 2009 1:58 PM
To: Midrange Systems Technical Discussion
Subject: Re: AS400 Automatic Sending of New Password?

On Wed, Jun 17, 2009 at 2:32 PM, Ingvaldson, Scott <
scott.ingvaldson@xxxxxxxxxx> wrote:

I did have another admin ask me once if I could help him write
something that would automatically reset profiles before the users had

to call the help desk. I think I talked him out of the idea.

PCI requirement 8.5.2 is: Verify user identity before performing
password resets. That pretty much makes automatic password resets
verboten.

Nonsense....

We do it, my bank does it, my student loan processor, my insurance
company....

All of which ask questions to verify my identity before they allow me to
reset my password.

At work, our automated process needs the last four of my SS# and a
correctly answered challenge question. Then it sets the new password I
specify.

The process has passed both SOX and PCI.

Charles