RE: Installing running applications as QSECOFR ( was RE: Anti-virusfor i5OS )

There is absolutely no reason that any product should force you to
signon as "QSECOFR". It is reasonable to assume that sometimes a
product requires that you have one or more special authorities (Though I
would very, very, skeptical of any package that claimed the need for
*SERVICE special authority), but a "requirement" to use the "QSECOFR"
profile is simply an admission by the vendor that they do not know what
the security requirements of their own product are.

jte

--

John Earl, VP and Chief Technology Officer
PowerTech: 253-872-7788
Direct: 253-479-1408
Mobile: 206-669-3336
John.Earl@xxxxxxxxxxxxx




Email is an excellent way to communicate material that is not time
sensitive. If your communication is of a more urgent nature, please
call.

===========================
This email message and any attachments are intended only for the use of
the intended recipient named above and may contain information that is
privileged and confidential. If you are not the intended recipient, any
dissemination, distribution, or copying is strictly prohibited. If you
received this email message in error, please immediately notify the
sender by replying to this email message or by telephone and delete the
message from your email system. Thank you.

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of David Gibbs
Sent: Tuesday, April 01, 2008 1:28 PM
To: Midrange Systems Technical Discussion
Subject: Re: Installing running applications as QSECOFR ( was
RE: Anti-virusfor i5OS )

Wilt, Charles wrote:

Yep, or if I really need it, I install it without QSECOFR

and call the

vendor if it breaks.

Requiring installation user QSECOFR is 99% of the time the vendor
taking the easy way out. That worked in the past, today it doesn't
fly.

FWIW: Some applications really do need QSECOFR authority to
be installed. Specifically those that have code that needs
to adopt QSECOFR authority. Change Management products come
to mind immediately (for obvious reasons).

Of course I suspect most, if not all, SCM vendors have a
white paper or other document that explains the requirement
that should satisfy most auditors.

david
--
This is the Midrange Systems Technical Discussion
(MIDRANGE-L) mailing list To post a message email:
MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change
list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting,
please take a moment to review the archives at
http://archive.midrange.com/midrange-l.