RE: Programmer DFU access

["Bale, Dan" <DBale@xxxxxxxx>]

Johnny,

The auditors are going to have an issue with *ANY* tool used to change
production data that isn't part of the normal application system.  Doesn't
matter if it's DFU, DBU, WRKDBF, or a programmer's quick-fix, one-time-only
program.  If something outside the normal application system makes changes
to the data, the auditors want a record of it - the who, what, & why.  

Just finished up at a client a few months ago where they had this same issue
with programmers changing production data using DBU.  They wrote a front-end
to DBU that required the user/programmer to enter their name, the name of
the person requesting the change, and the reason for the change.  DBU audit
was turned on, the spool file was saved to a data file that was tied to the
record entered on the DBU front end.  Don't know if this satisfied the
auditors or not.

The big problem was that this was a single box running both production and
development.  I was using DBU quite a bit in my development testing and
never, EVER, used DBU to change production data.  It was a REAL pain to have
to go through that front end every single time.  Since my manager realized
this, he let me use the direct DBU command without the front end.

hth
- Dan Bale

> -----Original Message-----
> From: Johnny Helms [SMTP:Johnny.Helms@rhtelco.com]
> Sent: Friday, June 16, 2000 7:31 AM
> To:   MIDRANGE-L@midrange.com
> Subject:      RE: Programmer DFU access
> 
> I realize this. I guess I need to re-phrase my question. How do other
> shops 
> change actual data in physical files without using DFU on the production 
> system?
> 
> Johnny Helms
> 
> At 06:47 PM 6/15/00 -0400, you wrote:
> >Um, change the DFU commands authority to exclude *public on the
> production
> >box?
> >
> >Fire the programmers for insubordination?  What part of "no" don't they
> >understand?
> >
> >- Dan Bale
> >
> > > -----Original Message-----
> > > From: Johnny Helms [SMTP:Johnny.Helms@RHTelCo.Com]
> > > Sent: Thursday, June 15, 2000 2:32 PM
> > > To:   MIDRANGE-L@midrange.com
> > > Subject:      Programmer DFU access
> > >
> > > I am looking for suggestions on how to secure a current production
> AS/400
> > > that has programmer's using DFU to change data in files. We do have a
> > > development system and I thought change management would allow this
> > > practice to be ended. However, after talking with Aldon, they have no
> > > suggestions.  The reason I am trying to end this practice is due to an
> > > Audit we recently had that we failed miserably.
> > >
> > > TIA,
> > >
> > > Johnny Helms
> > > Mid-Range Sytems Engineer
+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---