Re: Package Vendor that changes IBM command Defaults.

All,

Thanks for the backup.

You've made some of the same points I plan to press. I would like to take the
ideas presented and put together a "How to rate a vendor's security approach"
guideline but it will have to wait until a couple of major conversion are done.

BTW, I don't want to outlaw a vendor using QSECOFR at all, but they should only
use it (or its equivalent) only when there is no other reasonable way to get the
needed task done. The standard mode of operation use of QSECOFR by ANYBODY other
than a dedicated security officer doing only security officer exclusive 
functions
is just plan reckless.

Roger Vicker, CCP

"MCPARTLAND, Stan" wrote:

> The following are some of the standard requirements we have for security
> when we evaluate software.  Failing to meet these requirements may not rule
> out a vendor, but definitely has an impact on our selection process.  You
> would be surprised at how easy it is to get a command entry screen with
> QSECOFR authority in some software packages.
>
> - Secure command line access and control of access to systems commands and
> menus.
> - No hidden, undocumented access to the system.
> - No switching of user profile handles.
> - Secure use of adoptive authority and user profiles on JOBD's.
> - No second level passwords and user profiles.
> - The application's security must be based on individual user profiles.
> - The application must provide field level security.
> - There must be no dependence on QSECOFR authority adoption. The application
> software must not require QSECOFR authority to install.
> - Objects must be owned by a non-IBM provided user profile.
>
>

--
*** Vicker Programming and Service *** Have bits will byte ***
Thousands of journeys have a start but no end.



+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---