RE: Separation of Duties...

From: Graap, Kenneth

We are in the middle of an IS Audit and the auditor is asking us why we
don't separate the duties of DB Administrator and System Administrator
on our System i platform.

.Historically we have always combined these duties on the System i but
we are now being pressured to come up with a way to separate them.

As anyone else had to do this and if so, how did you define these duties
and set up system security to enforce it?

or ... can anyone share a compelling argument for not separating these
duties?

I may be wrong, Kenneth, but I usually hear this sort of question from an
auditor who isn't familiar with the System i platform. Typically their
background is in Windows or *nix systems (or even mainframes) where database
administration is in fact a full-time job. On the System i platform, there
is typically much less work involved along the lines of tuning and
performance monitoring, and the actual DB admin job is more of a security
and back role, and so really falls under system administration.

Now, this isn't a blanket statement, and as more pure SQL packages are
ported to the box and/or companies write more SQL applications, the amount
of database administration may grow. If you use more SQL than native I/O,
then you may find yourself in that category.

But for the majority of today's System i shops, the DB admin tasks still fit
nicely within the scope of the system administration.

Joe