Re: Preparing for a High-profile Termination

[Larry Bolhuis <lbolhuis@xxxxxxxxxx>]

Review all programs that operate with adopted authority of powerful 
profiles.

Review every user profile that gets changed or created upon termination.

Absolutely do not assume backdoor access will us a profile with a 
recognized name! Like the Book of Hezekia in the Bible, how many of you 
can tell me quickly which of the following user profiles does not 
belong: QPEX, QNTP, QSMTP, QMSF, QIPP, QTCM?? (There is no Hezekia by 
the way but it will send most people looking!)   If an adopted profile 
program lays in the right place (i.e. as a fake Trigger program or as a 
powerful profile's signon program) access may be re-created 
automatically by this program and it might not happen for weeks or even 
months when your vigilance is worn.

 - Larry

ps: It's QSMTP, the others are legit.

Steve Martinson wrote:
> Situation:
>
> High-profile, knowledgeable staff member soon to be terminated (employment, not by 
> Ahh-nold); has "keys to the kingdom" for both the System i and the network; 
> likely knows passwords for many service and/or utility profiles on the iSeries.
>
> Requirement:
>
> Prior to term date, analyze system for vulnerabilities associated with a 
> position like the one described above and prepare a task list that will address 
> the situation both before and after the termination.
>
> Areas to be reviewed include system values, network attributes (exit points 
> too), directory entries, SST, job descriptions, subsystem routing entries, all 
> user and group profile parameters and their implications, authorities to 
> libraries, directory (WRKLNK) authorities, etc.
>
> Can anyone think of anything else that could be a critical hole that should be 
> reviewed/covered?
>  
> Best regards and TIA,
>  
> Steven W. Martinson, CISSP, CISM
> Sheshunoff Management Services, LP.
> Senior Consultant - Technology & Risk Management
> 2801 Via Fortuna, Suite 600 | Austin, TX 78746
> Direct: 281.758.2429 | Mobile: 512.779.2630
> e.Mail: smartinson@xxxxxxxxx
>