|
IBM i & AIX Security Tips
Carol Woodbury, Editor
November 2012
|
|
|
|
|
|
|
Managing Mis-Managed Groups and Authorization Lists
by Carol Woodbury
Co-founder, President & CTO, SkyView Partners, Inc.
About this time of year, if you looked at my cupboards or my garage, I'll admit, they need a good cleaning. I usually organize my home in the spring and don't do a good job of keeping things in order throughout the rest of the year. So by now, things are in a bit of disarray. In fact, there are a couple of cupboards that may need attention before spring. When I go to clean a cupboard or my garage the approach I take is to pull everything out and basically start over. I throw out the items I no longer use and re-organize everything else. You're probably wondering what this has to do with security administration! I give this example because this is the approach we take when addressing group profiles or authorization lists that haven't been maintained.
SkyView Partners Consulting Services have been involved with several projects where either group profiles or authorization lists haven't been maintained. The result is often a group profile with members that work in very different parts of the organization. Why is this a problem? If you are granting groups access to files or other objects, in the case of groups that have not been maintained, you are likely giving access to some members of the group that have no business reason to see the data.
So what do you do ...
|
|
SkyView offers Unlimited Corporate Licenses
How many IBMi or AIX partitions do you have? (Including production, test, development, HA, and DR.)
SkyView is now offering Unlimited Licenses, and depending on the number of partitions, this might be hugely cost advantageous to you.
|
|
Recent Webinars available for viewing now:.
5 Steps for Implementing Role-based Access on the IBM i
One of the ways to simplify the administration and management of users' capabilities and access rights is to implement role-based access (RBAC). This technique is often preferred by auditors because it provides a more simple way to review users' configuration and access.
In this session, security expert Carol Woodbury will explain RBAC, the 5 steps you can take to achieve RBAC, as well as how to use SkyView's Policy Minder product to simplify the setup and daily management of RBAC configuration and policies. Attaining and Maintaining the Compliance Lifestyle
With the realization that compliance laws and regulations, like PCI DSS, are not going away, compliance needs to become a way of life; that is, part of your organization's "lifestyle." What we've discovered is that, once our customers passed their audit, they kicked back and relaxed until notice of the next audit came around. Unfortunately, when that happens, a lot of things fall out of compliance.
In this session, SkyView Partners' Vice President J. D. Seal will describe how to accomplish "compliance as a lifestyle" by providing tips on knowing what you have to be in compliance with. J. D. will also talk about the steps you can take to avoid falling out of compliance. Finally, J. D. will show how you can use SkyView Partners' products to "Attain and Maintain the Compliance Lifestyle.
|
|
SPECIAL RECORDED WEBINARS
|
|
Check out the sessions below then click on the "Listen Now" link to begin .
Coffee with Carol: Step by Step Approach to Implementing Object Level Security
More organizations are realizing the need for implementing object level security - especially for database files that contain information which must comply with various laws or regulations. But the question many administrators have is, how do you secure files without breaking the application or other processes? This session explains how. Configuration options, testing steps, "gotchas" to avoid, along with real-life examples will be presented.
Implementing Security Best Practices for the IBM i
In this session, security expert Carol Woodbury will discuss the sources of security best practices, the security best practices for IBM i and then applying those best practices to the system using SkyView's Policy Minder for IBM i.
|
|
|
|
