RE: Off-List -- Re: How Secure is Windows, Really?

From: Tom Liotta

Sometimes a detail slips past. When it slips for someone with high
authority... ouch.

Okay, I'll concede this point, however rarefied.  Certainly, somebody could
ACCIDENTALLY do something really stupid that installs a virus.  But that's
human engineering, and there isn't a package, a protocol, a procedure or a
prayer that will prevent that.

So, we have to at least assume that we're working with a system where people
are aware of the difference between a beach ball and a biohazard, and that
they take the appropriate precautions.

That being the case, though, here's a question: if someone were to use one
of the program creation APIs, or if they were to change the CPP for a
command, how much of that information is caught in the various audit
journals?  Because one thing the iSeries has that is sorely lacking on most
other operating systems is a nigh-on impregnable auditing capability.
Journals did a yeoman's job on files (someday I'll share with you the story
of the guys that went to jail thanks to journaling), and when they expanded
the idea to system activities, it seemed just plain smart.

If you're REALLY worried about access to your machine (for example, you are
forced to have contractors working on a production machine), can you crank
up the auditing to capture any bizarre behavior?

Joe