Re: Vendor wants an SST profile

Let me preface by saying that I would not grant that access either, without an explicit reason as to why it was needed and what would be done. I would certainly push for me to take the actions needed, and not blindly trust the vendor.

But I have to temper that with the question of what does HA Vendor mean? The vendor who wrote the software? The company that is running HA for you? Do they have control of another site with your replicated data?

If someone has given away the keys to the kingdom to a company that manages both the DR site and the mechanism to sync the data, why would you care? If they have *ALLOBJ rights to your current production system, and they know the setup of the system under their control, they can easily change any program on their system and port it back to you anyway. Sure, in theory I would love to care, but if the business wants it run that way, they have already handed all the data (what really matters) to someone they found trustworthy. I doubt that even encrypted fields would not be accessible when they own the system that is supposed to replace yours in a disaster. At the very least, they can grant themselves the rights to the profiles that can decrypt the data.

Some of us are stuck in that boat. If I wasn't, I would assume that they can't get the software to work without changing the program state (I may be forgetting the correct terminology from Leif's guide), and I would find someone who can get their software to work without compromising the system.
_____________________________________________________________________
Spirax-Sarco Engineering Plc. This e-mail has been scanned for viruses by Cisco Cloud Email Security.