IBM AS400 Security Procedures(7)

Auditor(s) Assigned Audit Date

Workpaper

Audit Objectives and Procedures Ref. By

________________________________________________________________________________________________________

K.3 User/Group Profiles - Cont'd

K.3.5.6 INLPGM (Initial Program) UPINPG

*NONE: No initial program is used. User is given access to the

command level.

The initial program may not provide a way to exit from the program except to sign-off.

If a menu name is specified in the initial menu parameter then that menu is displayed. Ensure that there is no option in the menus/sub-menus to exit and access the command level.

K.3.5.7 INLMENU (Initial Menu) UPINMN

*SIGNOFF: the user will be signed off the system once the initial

program ends.

Menu security limits a user's capabilities and restricts the user to a predefined secured environment. The initial menu appears after the initial program terminates. Ensure that users are assigned menus and menu options that are suitable for their job functions.

The advantages of menu security are that it is easy to implement and therefore, incurs low security management cost; and provides ease to use interface.

Caveat: Initial menus are mostly user-defined and therefore, may contain loop-holes. The application design is critical to menu security.

E&Y recommendation: Use the limited capability approach where appropriate with library and object security.

K.3.5.8 LMTDEVSSN (Limit Device Sessions) UPLDVS

*(SYSVAL: the system value selected determines if the user is

limited to one device session.

*NO: does not limit the use of a user-id to one device session.

*YES: limits the use of a user-id to one device session.

E&Y recommended value: *YES or *SYSVAL and QLMTDEVSSN - Set to Option One(limit number of device sessions to one).

SYSTEM SECURITY K/PROG

30

Page 12 of 22

Auditor(s) Assigned Audit Date

Workpaper

Audit Objectives and Procedures Ref. By

________________________________________________________________________________________________________

K.3 User/Group Profiles - Cont'd

K.3.5.9 STATUS (Status of user profile) UPSTAT

K.3.5.10

K.3.5.11

Specifies whether the user profile is usable or not.

*ENABLED: profile is usable.

*DISABLED: profile is not usable.

E&Y recommendation: Inactive or dormant user profiles should be set to *DISABLE to prevent unauthorized usage.

Note that system profiles such as QSYS, QSECOFR, etc. must be set to *ENABLE.

Obtain a list of user profiles and review for the following: 1. Identify the users permitted access to individual and each group

profile.

2. Determine if all users are permitted access based on written

authorization by Departmental Management.

3. Confirm that all users are currently employed.

Determine whether unauthorized users can process critical

functions from their menu(s).

SYSTEM SECURITY K/PROG

31

Page 13 of 22

Auditor(s) Assigned Audit Date

Workpaper

Audit Objectives and Procedures Ref. By

________________________________________________________________________________________________________

K.3 User/Group Profiles - Cont'd

K.3.6

List all programs which adopt the privileged QSECOFR authority: DSPPGMADP USRPRF(QSECOFR)

[optional

?OUTPUT(*PRINT)? to print]

Plan for running the above command overnight as it slows down the system.

Adopted authority provides a means to handle situations where programs or commands called by a user may require a higher level of authority than is normally available to that user. It allows a user to adopt the authority of the owner of a program whenever it executes, in addition to the authority of the user. This provides a method to give a user more access to objects, but the user is limited to the program function during execution.

K.3.6.1 Determine if the security officer is aware of such programs and if he/she

evaluates any new ones that use the adopted authority.

E&Y recommendation: The security officer should monitor programs that adopt the privileged QSECOFR authority.

K.3.7 Ensure that a security and password policy or guideline has been

developed which includes:

1. the secure assignment and distribution of passwords.

2. password selection criteria.

3. change or immediate removal of terminated employee's

passwords. (Obtain report on Previous Signon Date)

4. periodic changing of passwords.

5. training users in the necessity of password secrecy and sign-off

of workstations when not in use.

6. actions to be taken for attempted security violations.

SYSTEM SECURITY K/PROG

32

Page 14 …… 此处隐藏：2835字，全部文档内容请下载后查看。喜欢就下载吧 ……