Re: ** Development Security Model **

Œ
Hello Ian,

You might want to move this discussion to the security mailing list.

It is always easier to set security up tightly from the start and possibly
relax it a little than it is to have 'open house' and start removing authority
from people.  They come up with the most interesting reasons for why they need
the access.

Some ideas to start things off:

Secure things at the library level rather than the object level to simplify
management.

Create one or more group profiles for your production users

Add your production users to the appropriate group

Grant the group profile access to the production libraries

Revoke *PUBLIC access to the production libraries.

Create a group profile for your deveoplers

Add the developers to the group

Create test and development versions of the production libraries (A subset of
the data is usually sufficient if it is well designed.  You should also design
an automated refresh mechanism -- either save the initial state of the test
environment or create a program that adopts authority to rebuild it from
production data.)

Grant your developers access to the development and test libraries.
(Developers should be able to copy data from the test environment into their
development libraries but not the reverse.)

Grant your development and test groups *EXCLUDE rights to the production
libraries (belt and braces).

Done.

You could also use authorization lists instead of group profiles but I prefer
groups.

You could segment further by having separate development and test groups.

The main thing is that no developer needs access to production data regardless
of how they bleat for it.  Even in a small one man shop, access to production
libraries should be via a separate profile.  There is NO need for a development
ID to have access to production data.  No developer needs *ALLOBJ or most other
special authoritites.  No developer needs read rights to production data or
objects.  DId I say that no developer needs access to production data?  Good!

Regards,
Simon Coulter.

«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»
«» FlyByNight Software         AS/400 Technical Specialists       «»
«» Eclipse the competition - run your business on an IBM AS/400.  «»
«»                                                                «»
«» Phone: +61 3 9419 0175   Mobile: +61 0411 091 400        /"\   «»
«» Fax:   +61 3 9419 0175   mailto: shc@flybynight.com.au   \ /   «»
«»                                                           X    «»
«»               ASCII Ribbon campaign against HTML E-Mail  / \   «»
«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»