Re: Off-List -- Re: How Secure is Windows, Really? -- MIDRANGE-L

Joe Pluta wrote:

So, we have to at least assume that we're working with a system where people
are aware of the difference between a beach ball and a biohazard, and that
they take the appropriate precautions.

That being the case, though, here's a question: if someone were to use one
of the program creation APIs, or if they were to change the CPP for a
command, how much of that information is caught in the various audit
journals?

Auditing capabilities are _very_ good on iSeries. It takes someserious research to find ways around it (when ways can be found at all.)

Of course, audit journal receivers can grow at extremely rapid ratestoo. It can easily become necessary to automate (and to secure theautomation!) the review of receivers to catch questionable actions.

A "questionable action" need not be malicious -- it can simply be amistake. Even mistakes ought to be caught and fixed.

Auditing provides more than pointing out 'who did what' -- it canalso be extremely useful at pointing out who _didn't_ do it. Adeveloper working on critical areas should consider how muchprotection this gives.

If you're REALLY worried about access to your machine (for example, you are
forced to have contractors working on a production machine), can you crank
up the auditing to capture any bizarre behavior?


Auditing should be active at all times, but it can be tuned.

E.g., a contractor profile might be set to audit pretty mucheverything done by that profile with the CHGUSRAUD command:


 ==>  chgusraud  usrprf( CONTRACTOR ) objaud( *ALL )  +
         audlvl( *CMD *CREATE *DELETE ... *SYSMGT )

Assuming auditing is active and that there are objects that havebeen set as OBJAUD( *USRPRF ), then it'd be pretty difficult formuch to happen without being securely noted in the audit journal.Audit receivers could be deleted, but that action would itself belogged and difficult to conceal.

Even activating job accounting could add to the tracking that mightbe done. (That might even be overlooked by someone _deliberately_deleting audit journal receivers.)

There are a variety of options available. Some of the exit pointsthat Rob has mentioned are good potential examples.


And, of course, since you asked...

<vendor plug>

Products are available. Our Authority Broker helps in bothtemporarily allowing those pesky contractors sufficient authorityand auditing their actions, for example. (Not just contractors, butin-house staff who can't do Task A or Task B without moreauthority.) And Compliance Monitor can help report audit journalentries from a single system or a large network of AS/400s in aconsolidated form.


</vendor plug>

Tom Liotta