Re: SQL and Data security

[John Hall <jhall@xxxxxxxxxxx>]

I think you might be missing something here - 

You want to remove the ability of the "programmers" to update files
through sql from the command line but leave them the ability to update
through sql in an application ... which of course can be created by a
programmer.

Not much security in that ???

One way to accomplish this is to remove all update authority from the
programmers.  Use another user profile to grant adopted authority to the
programs so they can update the files.  When the programming changes are
complete the new program is then changed to use adopted authority so
that it can be used on the live data.

We are using (well implementing it anyways) this technique to lock out
our users from the data except by calling programs we have written.  The
users have no rights at all to the data.  The users are only granted
minimal access to the program library.  

This is a much cleaner method than trying to lock down DFU, EDTF, DBU
etc.  Lock your files - not the utilities.  

John Hall

Richard Shealy wrote:
> 
> During a pre-audit, a flag was raised about programmers have access to data
> altering utilities on the production AS400.  DFU, EDTF, DBU, WRKDBF, etc.
> are easy enough to restict.  However, the problem comes with SQL. How can a
> user be limited in the execution of SQL?  We need to be able to allow the
> programmers SQL SELECT, but prevent UPDATE or DELETE.  These rules should
> only be in place when SQL is executed from a command line, but allowed
> within RPG or CL programs since the application uses embedded SQL.  Any
> thoughts?
> 
> Richard Shealy
>
+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---