RE: Software audit (was: Can an RPG module call another RPG modul e?)

Hi Buck

I once had a short contract with a bank which included change control
duties. Part of the promotion process was to move the source to production
and create all production objects from the source on the production
machine. Source was stored in designated libraries.

This was intended to ensure that any production object had current and
available source and that the source matched the object; this was audited
regularly. It was also intended to ensure that the compilation and creation
process was performed in a way that maintained security.

Since they were a few releases behind I have no idea how they would handle
service programs and the like.

There were lots of other things we did, but it was a pretty involved
tedious detailed process :)

Regards
Evan Harris

Alan wrote:

>The point I was trying to make was, if the modules etc are
>NEVER migrated to the production area, there is no way to
>satisfy an audit. (Been there, done that) If you can prove
>that the modules etc were migrated to the production area, and
>that when they were required again, they had been migrated
>back or accessed from the production area, the auditors will
>be satisfied (been there done that)

There might be issues revolving around how the banking industry does
software audits, but we never ship any part of the development environment
to our production machines (customers.)  That means no source, modules,
binding directories, prototype /COPYs, binder language: nothing.  Just *PGM
and *SRVPGM objects.

We still haven't found a machine-enforced guaranteed chain of evidence that
THIS source is in THAT object, although manual signatures in binder source
help with service programs.  Although that can be forged easily enough.
Matching the source change date/times AND the *SRVPGM signatures AND the
file signatures provides a degree of security that the executable is pretty
much what you think it is, always presuming that you have a reference object
to compare against.
  --buck