× The internal search function is temporarily non-functional. The current search engine is no longer viable and we are researching alternatives.
As a stop gap measure, we are using Google's custom search engine service.
If you know of an easy to use, open source, search engine ... please contact support@midrange.com.



Hi Buck

I once had a short contract with a bank which included change control
duties. Part of the promotion process was to move the source to production
and create all production objects from the source on the production
machine. Source was stored in designated libraries.

This was intended to ensure that any production object had current and
available source and that the source matched the object; this was audited
regularly. It was also intended to ensure that the compilation and creation
process was performed in a way that maintained security.

Since they were a few releases behind I have no idea how they would handle
service programs and the like.

There were lots of other things we did, but it was a pretty involved
tedious detailed process :)

Regards
Evan Harris

Alan wrote:

>The point I was trying to make was, if the modules etc are
>NEVER migrated to the production area, there is no way to
>satisfy an audit. (Been there, done that) If you can prove
>that the modules etc were migrated to the production area, and
>that when they were required again, they had been migrated
>back or accessed from the production area, the auditors will
>be satisfied (been there done that)

There might be issues revolving around how the banking industry does
software audits, but we never ship any part of the development environment
to our production machines (customers.)  That means no source, modules,
binding directories, prototype /COPYs, binder language: nothing.  Just *PGM
and *SRVPGM objects.

We still haven't found a machine-enforced guaranteed chain of evidence that
THIS source is in THAT object, although manual signatures in binder source
help with service programs.  Although that can be forged easily enough.
Matching the source change date/times AND the *SRVPGM signatures AND the
file signatures provides a degree of security that the executable is pretty
much what you think it is, always presuming that you have a reference object
to compare against.
  --buck


As an Amazon Associate we earn from qualifying purchases.

This thread ...

Replies:

Follow On AppleNews
Return to Archive home page | Return to MIDRANGE.COM home page

This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].

Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.