RE: SQL and IT Controls

Not that I'm aware of.

You might find such capabilities in a third party SQL product such as
SEQUEL.
http://www.asc-iseries.com/sequel/


HTH,

Charles Wilt
iSeries Systems Administrator / Developer
Mitsubishi Electric Automotive America
ph: 513-573-4343
fax: 513-398-1121
 

> -----Original Message-----
> From: Chuck Bower [mailto:cbower@xxxxxxxxxxxx]
> Sent: Tuesday, November 23, 2004 9:21 AM
> To: security400@xxxxxxxxxxxx
> Subject: [Security400] SQL and IT Controls
> 
> 
> Group:
>  
> We are attempting to wrestle with a final Sarbanes Oxley 
> issue relating to SQL, specifically using STRSQL via the 
> command line.  While STRSQL is restricted to those who have a 
> business need to use it, our problem relates to the potential 
> for data manipulation and changes that are not logged.  Our 
> development staff can use it (but not update production data) 
> but our security officers can of course use it, AND update 
> production data.  It is NOT practical for us to journal all 
> of our production data libraries.  While I do have STRSQL 
> command usage logged via the OS/400 audit journal, (we know 
> who uses it and when) it does not provide the log of activity 
> within the STRSQL session.
>  
> Are there any tools on the market that can log the activity 
> within the STRSQL session?   Any feedback you can provide 
> would be GREATLY appreciated!
>  
> Chuck Bower
> VP of IS
> Coachmen Technology Services, Inc.
>  
> _______________________________________________
> This is the Security Administration on the AS400 / iSeries 
> (Security400) mailing list
> To post a message email: Security400@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/security400
> or email: Security400-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/security400.
>