Re: Security questions

[Vern Hamberg <vhamberg@xxxxxxxxxxxxxxxxxxxxxxxxx>]

ODBC/JDBC/OLEDB, CLient Access data transfer, FTP. *LMTCPB is not honored 
by any of these. If an ODBC connection uses a more secure profile (can be 
hard-coded in an application), anything is possible.

Restricting to *READ still allows anyone with a valid 400 profile to see 
data, download to Excel, sell to competitors, etc. I'd be inclined to have 
*PUBLIC *EXCLUDE to all production data, then use your menu approach. This 
is better, still not bulletproof.

Look at Tips and Tricks for Securing Your iSeries (usually sent with a new 
machine-available at InfoCenter). Wayne Evans used to have info an why 
menu-based access is limitied these days.

There are a number of products to assist you in protecting your resources. 
We have one, insure/RESOURCES (www.centerfieldtechnology.com) and there are 
others.

Might be worth getting in on John Earl's security webcast on the 25th, too.

Regards

Vern

At 11:05 AM 3/20/2003 +0100, you wrote:
> Hello,
>
> we have OS/400 security set up by the book - i.e. basically user has no
> rights (limit capabilities *yes) to execute commands etc.
> For productive data and objects user only have *read or *use authority.
> The used programs belong to the application owner profile
> and have adopted authority. System access for users goes through a menu
> system.
>
> So, where are the loopholes in this config?
>
> Thanks,
>
> Oliver