Re: Fwd: Emergency access

["Dennis Knee" <dknee@xxxxxxxxxx>]

<snip>
>  John, I agree wholehertedly. I didn't explain that very well.
> The programmer "checks out" the FireCall group profile. At that time, a
> job is scheduled to remove the authority from their profile after 24
> hours. (I also created a command so the programmer can remove the
> FireCall authority sooner.) when the authority is attaced, Security is
> notified of the fact, and when the Firecall Authority will expire.
> 
> We are looking at allowing certain specified programmers to invoke the
> authority themselves. (Since proper mpeople in security are notified).
> 
> Additionally, when the user has the FireCall group, certain monitoring
> occurs to provide audit and usage information. I could tell you more,
> but then I would have to kill you. ;) 
> 
> -- 
> Bob Larkin
> Larkin Computer Consulting
> blarkin@wt.net

A problem I see with this entire approach is that the programmer 
could easily create a program of their own that adopts the higher 
authority. - They could call that program, and do whatever they want. 
- You would need to audit, and closely monitor what is happening.

 
The opinions expressed are my own, not those of my employer.

Dennis Knee
Information Technology
Church of the Nazarene
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
* This is the Midrange System Mailing List!  To submit a new message,   *
* send your mail to "MIDRANGE-L@midrange.com".  To unsubscribe from     *
* this list send email to MAJORDOMO@midrange.com and specify            *
* 'unsubscribe MIDRANGE-L' in the body of your message.  Questions      *
* should be directed to the list owner / operator: david@midrange.com   *
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *