Re: Programmer DFU access

["alan shore" <SHOREA@xxxxxxxx>]

We have Emergency Manager profiles (individually audited) with *ALLOBJ 
security. This has to be signed out, with a reason for use. This is then used 
for whatever the emergency is , and our data security guys then change the 
password, whether you have finished with it or not. If it involves using DFU to 
change production data, a member from auditing HAS to be present at the time. 
Involved - yes., but this method has been used twice in 6 years. If this is a 
constant situation, you have a problem with your application. 

>>> Johnny Helms <Johnny.Helms@rhtelco.com> 06/16 7:29 AM >>>
The auditor was concerned with both. The main problem I have is that the 
data DOES need to be changed, so just securing the files will not help. How 
do other shops change actual data in files without using DFU on the 
production box?

Johnny Helms

At 12:36 AM 6/16/00 +0000, you wrote:
>Was the auditor's concern that the data could be changed with DFU, or was
>their concern that the data could be changed without a record of the
>change's time, user, or data?
>
>_______________________
>Booth Martin
>Booth@MartinVT.com 
>http://www.MartinVT.com 
>_______________________
>
>
>
>
>Johnny Helms <Johnny.Helms@RHTelCo.Com>
>Sent by: owner-midrange-l@midrange.com 
>06/15/2000 02:32 PM
>Please respond to MIDRANGE-L
>
>
>         To:     MIDRANGE-L@midrange.com 
>         cc:
>         Subject:        Programmer DFU access
>
>I am looking for suggestions on how to secure a current production AS/400
>that has programmer's using DFU to change data in files. We do have a
>development system and I thought change management would allow this
>practice to be ended. However, after talking with Aldon, they have no
>suggestions.  The reason I am trying to end this practice is due to an
>Audit we recently had that we failed miserably.
>
>TIA,
>
>Johnny Helms
>Mid-Range Sytems Engineer
>
>+---
>| This is the Midrange System Mailing List!
>| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
>| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
>| To unsubscribe from this list send email to
>MIDRANGE-L-UNSUB@midrange.com.
>| Questions should be directed to the list owner/operator:
>david@midrange.com 
>+---
>
>
>
>
>+---
>| This is the Midrange System Mailing List!
>| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
>| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
>| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
>| Questions should be directed to the list owner/operator: david@midrange.com 
>+---


+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com 
+---

+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---