RE: work files in qtemp

[qsrvbas@xxxxxxxxxxxx (Tom Liotta)]

rpg400-l-request@xxxxxxxxxxxx wrote:

>   4. RE: work files in qtemp (Ken Sims)
>
>> > The object is definitely deleted, but you didn't delete it.
>>
>>If Larry didn't delete it, who did?  I'm confused.
>
>If Larry and I worked at the same company, and he used his utility to take 
>over one of my jobs and had it delete an object, then *I* deleted the 
>object.  If object auditing is turned on and you looked the audit record 
>for the deletion, it would show deleted by me.  There would be no clue that 
>Larry was the one who instigated it, except the program name might show the 
>name of his exit program, but even then there would be no way to know from 
>that audit record who it was that actually used the utility.


It is the installation of the Performance Tools product that gives the ability. 
Obviously any product that allows external manipulation of a job must be 
closely controlled -- AND audited.

Auditing should show usage of the STRJOBTRC command (and subsequent actions) 
and provide the link back to the guilty party. This is an example of the level 
of audit forensics needed to reconstruct past events. It also illustrates why 
setting up and starting auditing can be a good idea for simple self-defense.

Tom Liotta

-- 
Tom Liotta
The PowerTech Group, Inc.
19426 68th Avenue South
Kent, WA 98032
Phone  253-872-7788 x313
Fax    253-872-7904
http://www.powertech.com


__________________________________________________________________
Switch to Netscape Internet Service.
As low as $9.95 a month -- Sign up today at http://isp.netscape.com/register

Netscape. Just the Net You Need.

New! Netscape Toolbar for Internet Explorer
Search from anywhere on the Web and block those annoying pop-ups.
Download now at http://channels.netscape.com/ns/search/install.jsp