RE: Programmer Authorities

[Mark Welte <MWelte@xxxxxxxx>]

I (speaking as a programmer) don't need authority to change production 
data. We don't give programmers (with their user id) authority to 
change data. We can use data for any system except HR/payroll/time and 
attendance. If we need to change production data, then we ask the 
Security Officer to "sign us on" as QSECOFR. We are trusted at that 
time with the sign on but aren't given the password. No one stands 
over us at that time. We can basically do what we want while signed on 
as QSECOFR, but are trusted to not do things other than what we asked 
for the sign on for.

In regards to system functions, we have *JOBCTL, *IOSYSCFG, and 
*SAVSYS authorites and our user class is *PGMR.

This setup works fairly well. There are times when the Security 
Officer isn't around and we have to wait for him to come back from a 
meeting. But, his supervisor (who is our supervisor) usually knows the 
QSECOFR password so we can get him to help us. The best thing about it 
is that when we are testing, we know that we won't mess up any 
production data. This allows some comfort when doing some testing and 
the test blows up.

Mark Welte
Denso Manufacturing Tennessee, Inc.


----------
From:  Weatherly, Howard[SMTP:hweatherly@dlsc.dla.mil]
Sent:  Tuesday, September 16, 1997 9:13 AM
To:  'Midrange-L'
Subject:  RE: Programmer Authorities


If you dont trust your programmers and give them some sense of  your
confidence
in them,  they will soon be working for your competitors.
 ----------
From: midrange-l-owner
To: MIDRANGE-L
Subject: Programmer Authorities
Date: Tuesday, September 16, 1997 11:31AM

Hi!

How do other sites restrict their programming staff? Do you allow 
them
*JOBCTL or (shock horror) *ALLOBJ authority? Do they have access to 
live
programs and data or is there some form of change control? etc...

All comments welcome,

Tim Shepherd



+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to 
"MIDRANGE-L@midrange.com".
| To unsubscribe from this list send email to MAJORDOMO@midrange.com
|    and specify 'unsubscribe MIDRANGE-L' in the body of your 
message.
| Questions should be directed to the list owner/operator:
david@midrange.com
+---
+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to 
"MIDRANGE-L@midrange.com".
| To unsubscribe from this list send email to MAJORDOMO@midrange.com
|    and specify 'unsubscribe MIDRANGE-L' in the body of your 
message.
| Questions should be directed to the list owner/operator: 
david@midrange.com
+---

application/ms-tnef