Re: Recommendation for IBMi privileges for an outsourcer to support an IBMi environment

On Fri, Jun 26, 2020 at 11:06 PM Rob Berendt <rob@xxxxxxxxx> wrote:

I tend to agree with Carl here. There are things you can consider to help
with this.

Their copy of QSECOFR can only be enabled during "need". Can be difficult
if the need is off hours, when the person who enables it is out on
vacation, etc. You'll be doing it so often you need to back that up with
some of the options below.

You could use RCAC or "Row and Column Access Control". With that you can
set it up so that even QSECOFR cannot look at certain data. There's ways
around that but they'll really be noticeable.

https://www.ibm.com/support/knowledgecenter/ssw_ibm_i_74/rzahf/rzahfrcactitle.htm
Available at 7.2 and above.

You could set up a command exit point to pump their joblog to a file
whenever they use SIGNOFF or any similar command. I've done this.

https://www.ibm.com/support/knowledgecenter/ssw_ibm_i_74/rbam6/cmdanalyz.htm

You could review the journals for any time they opened a file they should
not.

https://www.ibm.com/support/knowledgecenter/ssw_ibm_i_74/rzajq/rzajqudfdisplayjournal.htm


That is helpful. It means even when they are using QSECOFR for the right

reason they will not be able to see the sensitive data. We do have a
process we can use to enable the account on demand.

Plus we do trust the outsourcer of course but like most organisations, our
security people always raise these issues we have to have deemed to have
addressed.