RE: Adopted authority vs profile switching

["Joe Pluta" <joepluta@xxxxxxxxxxxxxxxxx>]

> From: John Earl
> 
> Also, to answer the question of the "security exposure" that switching
> might introduce, I don't really see it.  If I have *USE authority to
> your profile I can assume your identity in a number of ways.

The security exposure is the very fact that it requires me having
authority to the swapped profile.  My contention is that I should NEVER
have *USE authority to your (or anyone else's) profile.  And I don't
need it in a properly designed system.

If I want to do something "as" someone else, that's a potential security
risk and should be tightly controlled.  All such requests should, IMHO,
be housed in a single proxy program that adopts the required authority.
The proxy program can provide security above even the standard object
security of OS/400.  It can make sure certain functions can only be done
at certain times, on certain workstations, etc., as well as logging all
such activity.

Note that at this point, whether you do a swap or submit a job under the
user's profile is immaterial.  I'm not against swapping (although there
are some issues with journals).  I'm against users having *USE authority
to any profile but their own, because THAT, as you point out John, is a
severe security risk.

So while profile swapping is a quick fix for a number of design issues,
if implemented incorrectly it's a poor one from a security standpoint.

Joe