IBM AS400 Security Procedures(8)

Auditor(s) Assigned Audit Date

Workpaper

Audit Objectives and Procedures Ref. By

________________________________________________________________________________________________________

K.5 Objects

Objectives: To ensure that appropriate access authority is defined at

the object level in order to protect specific production data files and programs from unauthorized access.

Object security establishes security at the specific object level. It is used when different objects require different protection requirements. The client may choose to protect specific sensitive objects at the object level if their inherent risk is high or if library level protection is not used. It can also be used as an exception to the general authorization rules.

Procedures:

K.5.1 Select a sample of sensitive production objects (data files or source

programs) and print their specific object authorities:

DSPOBJAUT OBJ(library/file) OBJTYPE(*FILE) (for files), and

DSPOBJAUT OBJ(library/program) OBJTYPE (*PGM) (for programs).

K.5.2 Ensure that only authorized users or groups may access or use the

sensitive objects.

K.5.3 Review administration and authorization procedures for granting

access to significant objects.

E&Y recommendation: Since assignment of object authorities to specific objects is tedious, specific object authority should only be defined to handle exceptions; otherwise, the default public authority should be used.

SYSTEM SECURITY K/PROG

35

Page 17 of 22

Auditor(s) Assigned Audit Date

Workpaper

Audit Objectives and Procedures Ref. By

________________________________________________________________________________________________________

K.6 System Utilities

Objective: To ensure that powerful system utilities are adequately

restricted from unauthorized access and use.

The following are powerful system utilities:

SST System Service Tools DST Dedicates Service Tools DFU Data File Utility SEU Source Entry Utility SDA Screen Design Aid PDM Programming Development Manager QUERY Query Language

Procedures:

K.6.1 Determine who has access to the above utilities:

? DSPOBJAUT OBJ(QSYS/STRDFU) OBJTYPE (*CMD).

? DSPOBJAUT OBJ(QSYS/STRSEU) OBJTYPE (*CMD).

? DSPOBJAUT OBJ(QSYS/STRSDA) OBJTYPE (*CMD).

? DSPOBJAUT OBJ(QSYS/STRPDM) OBJTYPE (*CMD).

? DSPOBJAUT OBJ(QSYS/STRQRY) OBJTYPE (*CMD).

Only authorized programmers should have access to these utilities.

E&Y recommendation: *PUBLIC access should be set to *EXCLUDE, not *USE.

SYSTEM SECURITY K/PROG

36

Page 18 of 22

Auditor(s) Assigned Audit Date

Workpaper

Audit Objectives and Procedures Ref. By

________________________________________________________________________________________________________

K.7 System Commands

Objective: To ensure that powerful system commands are adequately

restricted from unauthorized use.

The following are powerful system commands:

* CRTUSRPRF Create User Profile * CHGUSRPRF Change User Profile * DLTUSRPRF Delete User Profile * RSTUSRPRF Restore User Profile

?? CHGDSTPWD Change Dedicated Service Tool Password

RSTAUT Restore Authority # STRSST System Service Tools ~ CRTAUTHLR Create Authority Holder ? DLTAUTHLR Delete Authority Holder ?? SAVSYS Save the System

~ CHGSYSLIBL Change System Library

CHGSYSVAL Change System Value

* Restricted to the security administrator (QSECADM) and security

officer (QSECOFR) only. PUBLIC access is irrelevant. A user cannot use these commands even if he/she has *ALLOBJ special authority.

# Restricted to the service engineer (OSRV) only. ~ Restricted to the security officer (QSECOFR) only.

? You need the DST security password to change the DST passwords. ? Restricted to *SAVSYS capability holder. ? *PUBLIC should be set to *EXCLUDE.

See the sensitive command object authority matrix.

SYSTEM SECURITY K/PROG

37

Page 19 of 22

Auditor(s) Assigned Audit Date

Workpaper

Audit Objectives and Procedures Ref. By

________________________________________________________________________________________________________

K.7 System Commands - Cont'd

Procedure:

K.7.1 Review the object authority to the above significant security related

commands:

DSPOBJAUT OBJ(QSYS/cmd) OBJTYPE(*CMD).

Ensure that only authorized personnel may use these commands.

E&Y recommendation: Public authority of these commands should be set at *EXCLUDE.

Command source object contains …… 此处隐藏：2035字，全部文档内容请下载后查看。喜欢就下载吧 ……