× The internal search function is temporarily non-functional. The current search engine is no longer viable and we are researching alternatives.
As a stop gap measure, we are using Google's custom search engine service.
If you know of an easy to use, open source, search engine ... please contact support@midrange.com.


  1.  Home
  2. MIDRANGE-L
  3. October 2006

Re: Security and "package" application software

Dave,
I think that vendors consider it the customer's responsibility to apply whatever security you want. Your organization and access needs may (and probably are) totally different from mine.
The problem, as I see it, is that many (most?) organizations (i5 or otherwise) give little or no thought to security.
That being said, I do think that vendors should, as part of their installation instructions, at least mention the fact that security is a customer responsibility. And then go a step further by grouping application tables in some manner to aid us in applying our own authorization lists, etc. 


        * Jerry C. Adams
*IBM System i5/iSeries Programmer/Analyst
B&W Wholesale Distributors, Inc.* *
voice
        615.995.7024
fax
        615.995.1201
email
        jerry@xxxxxxxxxxxxxxx <mailto:jerry@xxxxxxxxxxxxxxx>



Dave Odom wrote:


Is the following normal for i5 "package" vendors:

You buy and install a vendor's applications and, while they have an
internal security mechanism for allowing users to each and every piece
of their application, there is NO SECURITY on the files of the vendor's
applications if any user has command line access, Query access, ODBC,
FTP, etc.   Is this normal in the i5 world that a vendor would leave you
"open Kimono"  when comes to back doors?

I understood that reputable vendor's created their software such that
all files were MAYBE READ ONLY to end users and all access to change
data was via the application's authority and the application gained
those authorities during installation using a userid like QSECOFR or
QPGMR or other designated user with special privileges to objects.

What am I missing about the i5 world and its typical application vendor
and their development methodologies?

Thanks in advance,

Dave

As an Amazon Associate we earn from qualifying purchases.

This thread ...
Replies:
Follow On AppleNews
Return to Archive home page | Return to MIDRANGE.COM home page

This mailing list archive is Copyright 1997-2025 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].

Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.