RE: Fw: Rewarding challenge AS/400...

I like the mother's maiden name idea, although it's maybe not as secure as
it sounds as it could easily be researched. Maybe asking the employee to
provide a one time default password of their own would be a step better,
until they forget it that is.

What I have done in the past is to have a reset procedure to which only the
help desk has authority to set the status to *ENABLED, the password = user
ID, and password expired = *YES. The procedure also checked the user's group
profile against a hard-coded list and would only operate for certain ones.
When we wanted to keep a profile disabled we assigned it a special group
profile so that the help desk could not re-enable it.

In addition I drew up a manual procedure for the help desk to follow that
involved them positively identifying the caller, either by voice, or by
calling them or their manager using the number in the company phone book,
not the number given by the requestor of course. When the auditors were
around I got them to review the procedure and they approved it.

I don't think there's generally a problem with people knowing the password
before it can be changed. The password must be changed on first sign on
after a profile is created or reset, so the user would immediately know
something was wrong.

One of the problems I never managed to resolve was when users began to make
a game of deliberately disabling other users' passwords. It was only a minor
nuisance, but it did make statistics of over-frequent resets rather
meaningless.

Dave Kahn
Johnson & Johnson International (Ethicon) France
Phone : +33 1 55 00 3180
Email :  dkahn1@jnjfr.jnj.com (work)
           dkahn@cix.co.uk      (home)


-----Message d'origine-----
De: Chuck Lewis [mailto:clewis@iquest.net]
Date: 16 September 1999 14:18
À: MIDRANGE-L@midrange.com
Objet: Re: Fw: Rewarding challenge AS/400...


I did something similar, RESETUP. Again only certain people (help desk,
etc.) could use it and it could not reset Q* profiles OR mine and several
other high level folks. We required that any new user provide us with
Mother's Maiden Name (or whatever they wanted to make up for it) and we had
a file
that contained that info. The command retrieves that info and resets the
profile to that. THAT no one knows the password. This came up when some
users (union shop) were concerned with a supervisor knowing there password
before they could change it. Also and added level of security since no one
can
assume that password is signon name. AND the command logs who, where, what
date and time for whom the reset is executed. AND it "narcs"/reports/notifys
and "too many" reset attempts and also reset attempts on "sensitive"
profiles...
+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---