RE: Not a security person but.

["Andy Nolen-Parkhouse" <aparkhouse@xxxxxxxxxxx>]

Bill,

This sounds like a real mess in terms of security design/implementation.  If
multiple contractors are working on the system with *ALLOBJ authority, then
your client should declare an immediate crisis if they care about security
at all.  The situation you describe is unacceptable!

Apparently you did what you needed to do in order to perform the work your
client was asking of you.

If you feel the need to give advice to the Ops Manager, I would suggest that
they hire a security consultant to look at their overall situation and
tighten things up.  You signing on with a restricted profile is trivial
compared to the liability of all of those security officers running around.
They could also designate one of their staff members and provide training.
One way or another they should recognize that they are at a very high level
of exposure and either do something about it or openly agree to live with
it.

Regards,
Andy Nolen-Parkhouse

> This is what I was able to do:
> 
> My profile
> *SECOFR
> *ALLOBJ
> *JOBCTL
> *SECADM
> *SERVICE
> *SPLCTL
> has init pgm and menu.
> 
> EXODUS server profile
> *ALLOBJ
> *IOSYSCFG
> has *signoff
> 
> I changed EXODUS to have new password the changed to
> have init pgm and menu. I then signon as EXODUS and changed my profile
> to have *IOSYSCFG special authority. Signed back on and started my own
> server.
> 
> What should I suggest to the Ops Manager to correct this work around?
> Besides just changing my profile :) Others are out there like this( mainly
> contractors ) and I'm
> afraid they might come back after they leave. Should I voice my concern or
> is there one.
> Client did know of my actions so I wasn't doing this in the dark just
> showing it to him. But my knowledge is limited in
> this side of things what direction should he go.
> 
> Thanks
> Bill Hopkins