Re: IBM i data and object authorities

I don't believe Robin intended for his model to be applied to IBM objects.

With few exceptions, I leave IBM object authorities alone.

The exceptions are always providing more access than IBM does by default.

I don't believe I've ever removed access, ie. *PUBLIC exclude to an IBM
object.

Charles

On Wed, Jun 1, 2016 at 5:40 PM, Nathan Andelin <nandelin@xxxxxxxxx> wrote:

I was just reviewing a presentation which was provided by Robin Tatum of
PowerTech. It included a simple model for securing applications and data;
beginning with excluding *public authority to application objects and data
- then granting more granular object and data authorities to specific user
profiles, user groups, and authorization lists according to needs.

I then reviewed authorities to objects and data in IBM i "Q" libraries to
get a feel for how IBM configures *public authorities, which varied from
object to object. IBM authority defaults appear to be quite specific.

It seems to me that a security administrator could muck up a system if they
were to change IBM's default authorities for IBM's objects and data. Does
anyone have an alternate view?

Nathan.
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.