Re: Installing running applications as QSECOFR

[David Gibbs <david@xxxxxxxxxxxx>]

Wilt, Charles wrote:
> I'm not (quite ;) ready to defer to your knowledge on this.  Can you
> provide a concrete example?
>
> Like Joe, my experience has been that a CMS needs *ALL authority to
> any object it manages, but that authority is enough to grant access
> to the object to any other profile on the system.

I guess it's mainly a question of magnitude ... how many different
applications does the SCM product manage?  How many differing authority
models does the application have?   Is it really practical to grant the
user that the SCM product is operating as the specific authorities to
manage the those authority models.  Oh yeah, I forgot to mention the
fact that the authority models can span multiple systems.

At many of our customers, the security function is incredibly separated
from the application management functions.  Getting individual authority
changes made almost requires acts of god.  The security officers,
however, are quite satisfied with Implementers "Secure Promotion
Technology" (our own term <grin/>) such that they don't have to change
any system level authorities to let Implementer deploy the various
objects, to the various libraries, on the various systems, with the
application specific authority models.

david