Re: Who deleted our source file ??

[John Earl <johnearl@xxxxxxxxxxx>]

Dan Rasch wrote:

> We had someone (or maybe some program) delete our main source file at my
> current site.  Luckily we had a very recent backup and only lost what was
> not in personal libaries for about a day and a half.
>
> We have no journalling on, or any promotion/change management software -
> and wonder where and how much information we can gather regarding what
> happened - without a formal witch-hunt.

Dan,

As others have mentioned, object auditing is your best tool to find this, but if
you don't have it on already it's a little late.

No that you're whole again you'll surely want to make changes.  In addition to
turning on Object Auditing, you'll want to secure the file against deletion.
Depending on your security policy, there are a couple of different ways to 
secure
source files.

If programmers move source members directly into the production source file, 
they
need *CHANGE authority + *OBJMGT object rights.  This allows them to clear an
existing member and replace it with a new member.

If programmers make changes directly to the production source code, they only
need *CHANGE authority.  This will allow them to key directly into the source
file.

If you have a "Production Manager" job function, then only the production 
manager
needs *CHANGE authority + *OBJMGT object rights.  Programmers then need only 
*USE
rights (read only).  This will allow them to view and copy code, but not 
directly
change it.

In any case, you've seen first hand why noone should have *ALL authority to a
source file.

hth,

jte

--
John Earl                                       johnearl@toolnet.com
PowerTech Toolworks                  206-575-0711
PowerLock Network Security       www.toolnet.com
The 400 School                             www.400school.com
--




+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---