[Security400] Security Questions

["Wills, Mike N. (TC)" <MNWills@xxxxxxxxxxxxxx>]

We are currently going through all of the users on our systems and removing
any that have not been deleted for one reason or another. Through our
looking, we have noticed people with authority that really didn't need it
(like *SAVRST and *ALLOBJ). We are currently reviewing what people need for
authority.

1) What have you guys done to maintain security?

2) How do you create new users? Do you have a "general" user which you copy
from? Do you start from scratch?

3) How do you eliminate the possibility of a user using the username for a
password and not allow 'password' for a password?

4) How often do you review the users and security?

5) Payroll notifies us when people quit or have moved to a new position, but
it doesn't tell us when remote users quit or have moved on. How do you
handle this?

Any suggestions would be appreciated.

Mike Wills