RE: Separation of Duties...

["Wilt, Charles" <WiltC@xxxxxxxxxx>]

> -----Original Message-----
> From: midrange-l-bounces@xxxxxxxxxxxx 
> [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Joe Pluta
> Sent: Wednesday, October 31, 2007 11:40 AM
> To: 'Midrange Systems Technical Discussion'
> Subject: RE: Separation of Duties...
>
> > From: Wilt, Charles
> >
> > Lastly, perhaps you could consider the Service Tools QSECOFR ID the 
> > "system Admin" and the regular QSECOFR ID as the "Database Admin".
>
> Oooo, I like this Charles.  It probably wouldn't clear a 
> common sense check, because you don't need SST for purely 
> sysadmin jobs like backup and recovery, but it IS required 
> for the hardware stuff that you have to typically do on 
> Windows machines and that you rarely have to worry about on 
> the System i.
>
> But then again, a LOT of auditing is not about common sense.  
> Trying to create common admin roles for the System i and a 
> Windows box is sort of like trying to create a common 
> driver's manual for a Mopar and a moped.  So you might get 
> away with it.

Thanks Joe, I liked it too <grin>.

I agree that it may not meet the common sense check.  Backup/Recovery may be an issue, but then again,
maybe not as Backup/Recovery of the DB is usually the responiblity of the DB admin.  In the case of
the iSeries, recovering the DB automatically recovers the "system", unless you're dealing with recover
on a different box.

One thing I see as an issue for sure would be creation/modification of the various *DEVD.

Wouldn't it be nice do deal with auditor's who actually have some expertise in what they are auditing?

Charles


This e-mail transmission contains information that is intended to be confidential and privileged.  If you receive this e-mail and you are not a named addressee you are hereby notified that you are not authorized to read, print, retain, copy or disseminate this communication without the consent of the sender and that doing so is prohibited and may be unlawful.  Please reply to the message immediately by informing the sender that the message was misdirected.  After replying, please delete and otherwise erase it and any attachments from your computer system.  Your assistance in correcting this error is appreciated.