RE: iSeries Security in Computerworld

This makes great sense, Francis.  Another thing you can do is to create the
user profile with just enough authority to sign on and run an initial
program that says to call IT.  Set the password to expired so they have to
change it.

Then, only after they've verified to the security handlers who they are (and
that they've signed on) do you actually grant them authority to do work.

Joe

 

From: Lapeyre, Francis

We have a Security Office who are the only ones who can create user
profiles. New profiles can't be created unless they appear in HR or are
on an exception list (IBM-supplied, contractors, and so forth). New
profiles are set to *DISABLED, and a new user must call the help desk to
have it enabled. They have to verify the last 4 digits of the user's
SSN. HD has no access to CHGUSRPRF (except through the program that
validates the user through the HR files) or CRTUSRPRF.

When a user is terminated, their profile is automatically disabled early
the next morning, when we get the update from HR. The HD cannot enable
terminated users.