Re: Limit ODBC to read only.

The statement below is essentially true for assets that are stored on and
protected by windows, but does not apply to resources stored on i5/OS and
therefore protected by i5/OS access control. To adequately protect a
resource, you must use the access control mechanism associated with the
system on which that resource resides.  iSeries cannot be used to
adequately protect assets stored on non-iSeries systems either.  At best,
this only provides security by obscurity, but it doesn't protect you
against a determined attacker or even a curious and mildly technical
end-user.

Another problem with the logic below is that it is invalid to assume that
an attacker will:
   only use a windows system to mount an attack
   If an attacker can get through your firewall, they might be able to use
   their own Unix/Linux system.
   only use client access software to mount an attack
   If an attacker can access a workstation, they are also likely able to
   run their own application to access iSeries systems in the network. This
   means they would not necessarily be limited by any security mechanism in
   other applications running on the PC.
Neither of which are valid assumptions (at least in my opinion :-) ).


Patrick Botz
Senior Technical Staff Member
Rochester CTC, eServer Security Architecture & Consulting
iSeries Security Architect
(507) 253-0917, T/L 553-0917
email: botz@xxxxxxxxxx

For more information on CTC, visit our website at
http://www.ibm.com/eserver/services
http://www.ibm.com/servers/eserver/services


midrange-l-bounces@xxxxxxxxxxxx wrote on 07/26/2005 11:56:23 AM:

> Steve,
> *********** REPLY SEPARATOR  ***********
>
> On 26-7-05 at 9:16 Steve Landess wrote:
>
> >Carel -
> >
> >If the Windows user doesn't have admin rights, can't you use Windows
> >Policies to secure them from being able to change this information
> within the ODBC manager?
>
>
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>