Re: Security and "package" application software

This is a common security hole, typical in our market.

You have to get a 3rd party fix, which costs a few $ k and is 
a nightmare to explain to non-technical management why we 
need it, or you can learn enough to re-write the package to 
the way it should have been originally, which is a huge 
project far above Y2K conversion effort.

Result is, the security hole is not fixed at most companies.  
This will not change until we have some heavily publicized 
breaches that take down some companies that have the hole, 
leading to multi-million $ lawsuits against the vendor 
involved, leading to the vendor involved going out of 
business, leading to the competition scrambling to not be 
next, paying for the fix with the sales to former customers 
of the vendor that went out of business.

---- Original message ----

Date: Thu, 05 Oct 2006 12:21:36 -0700
From: "Dave Odom" <Dave.Odom@xxxxxxxxxxxx>  
Subject: Security and "package" application software  
To: <midrange-l@xxxxxxxxxxxx>

Is the following normal for i5 "package" vendors:

You buy and install a vendor's applications and, while they 

have an

internal security mechanism for allowing users to each and 

every piece

of their application, there is NO SECURITY on the files of 

the vendor's

applications if any user has command line access, Query 

access, ODBC,

FTP, etc.   Is this normal in the i5 world that a vendor 

would leave you

"open Kimono"  when comes to back doors?

I understood that reputable vendor's created their software 

such that

all files were MAYBE READ ONLY to end users and all access 

to change

data was via the application's authority and the application 

gained

those authorities during installation using a userid like 

QSECOFR or

QPGMR or other designated user with special privileges to 

objects.

What am I missing about the i5 world and its typical 

application vendor

and their development methodologies?

Thanks in advance,

Dave
-- 
This is the Midrange Systems Technical Discussion (MIDRANGE-

L) mailing list

To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.