RE: iSeries Security in Computerworld -- MIDRANGE-L

Any time some new package is implemented, or we go through a conversion todifferent platform, etc. there ought to be some consideration given to thesecurity rules. However, in any implementation or conversion, people tendto be swamped ... IT, project team, testers, management, everyone.

In our Y2K conversion, we were going from BPCS/36 to BPCS/400, and ourproject team got an education in choices on 400 and in BPCS. They saw thatit was possible to run this with no security whatsoever, and that's whatthey called for. Normally I did everything the project team called for,going to management for occasional help on prioritizing, and getting helpwhere some things were going to take forever. With what I considered to bebad security decisions, I went to management to try to make the case thatwe ought to have on the new system a level of security commensurate withwhat we had before, then as time permits, study the new securitycapabilities to see what bars ought to be raised.

I was particularly annoyed when our consultants took security off of thesystem without first checking with me, and I told management that if youever want to have security in the future, that all the testing to datecould be for naught. The consultant's explanation was that they had a lotof work to get done, and the security was getting in the way, so instead ofdiagnosing the problem, they killed the security.

In any conversion, everyone is swamped, including management. So they madea ruling to compromise between what I was calling for (such as a minimum of4 characters in the passwords, and blocking ordinary users from runningend-fiscal stuff that could not be reversed) and what the project team wascalling for (no passwords). Management made a perfect compromise. Twocharacters minimum for passwords. We still that way today.

As new managers come on board, I tell them that when they get familiar withour system, I would like to brief them on what I consider are some of ourproblem areas, such as poor security. Many opt out on this briefing, butquite a few have been told about the 2 character password minimum, and haveconsciously decided to continue that rule.

I guess it just depends on your priorities.  It's been a long time since I
heard of a company where IT gives out profiles without some sort of
controls.  Hell, we had to bend over backwards at SSA to get a user profile.

Joe

> From: rob@xxxxxxxxx
>
> Same as everyone else out there, look at the default for password on
> CRTUSRPRF.  We get some who says "we gotta have a signon for ...".  Then
> they never actually sign on and change their password.