I work with the Bsafe (Now enforcive) tool for AS400 security.
The application audit involves the use of various application servers like
1. FTP server/Client,
2. RMTCMD’s program call and command call
3.RMTSQL
4.DDM
5. Database
6.Data Queue
7. File transfer
8. File server
9. TFTP
etc.

The application audit log shows the use of above application with the details like user profile, application, sub function, action type etc.

I remember having the auditors ask me if I could change an in-house application to allow field-level security for every field in the system based on user Id (for display/non-display/change etc). The system wasn’t that big or complex, but it still would have had several thousand fields in various files.

I told them I could do this, but it would take me about a year full-time to accomplish and then we’d need to hire several extra people in to maintain the security settings. I also mentioned that the performance of the system would probably suffer, with every program having to lookup the security values for every field for the current user before displaying a screen. Needless to say, they didn’t push it any further….

Always makes me wonder what sort of background or training these people have.

Regards,

Martin Gilbert.