Why the fuss about special authorities? Skipping a discussion of *ALLOBJ for the moment, special authorities provide users with the capability to perform specialized functions. If that capability falls outside of their job responsibilities, they shouldn't have the special authority. Assigning users only the capabilities sufficient to perform their job functions is a requirement of several laws and regulations (including PCI Data Security Standards). In addition, it makes good business sense to allow users only the capabilities that they need.

*ALLOBJ is slightly different. Users assigned *ALLOBJ special authority can access all objects. Once you assign a user *ALLOBJ, that user cannot be prevented from accessing any object on the system. I heard the other day of an administrator trying to restrict programmers' access to several libraries. However, they had been assigned *ALLOBJ. Given the way i5/OS performs its authority checks, users with *ALLOBJ will always have access to an object. Attempting to restrict their access was a waste of time.

Why are special authorities out of control? Because most profiles are not created from "scratch." Most profiles are created by copying another profile. So if the original profile has more special authorities than necessary, the new profile will also have those special authorities.

Here are the capabilities (special authorities) you can grant users and the functions they provide:

Taking Control

The best way to rework the assignment of special authorities is to first assign users to a role. Typical roles include system administrator, operator, programmer, change control administrator, database administrator, analyst, and end user. Next, list the tasks each role typically performs. Finally, list the special authorities required by each task. This determines which special authorities each role requires.

How Skyview Policy Minder Can Help

To detect when users have gained special authorities they shouldn't have, there are two ways that Policy Minder can help.

First, you can define a user profile template, choosing to include all users of a particular user class (such as *SECOFR or *USER) or a specific group; then, specify which special authorities the users in the user class or group are to have. For example, you may specify that all users in the *SYSOPR user class are to have *SAVSYS and *JOBCTL special authorities. When you run a compliance check, the special authorities assigned to the profiles belonging to the specified user will be checked against the template (policy) you created. Any profile's special authorities that don't match the policy will be flagged as being out of compliance with the policy.

The second way that you can check special authorities with Policy Minder is to create a slightly different user profile template. In this template, you include all users who have a specific special authority—for example, *ALLOBJ. Then you specify *NO for the attribute "Allow new user profile." The first time you run a compliance check, it establishes the baseline of all users who currently have the special authority (in our example, *ALLOBJ.) The next time you run a compliance check, any profile that has been created with, changed to have, or restored with *ALLOBJ assigned will be flagged as *NEW and, therefore, out of compliance. This method is especially helpful in keeping track of the very powerful special authorities such as *ALLOBJ as well as the special authorities auditors may want to limit, such as *AUDIT.

Carol Woodbury is President and co-founder of SkyView Partners Inc., a company specializing in security policy and compliance software and services. Carol is a system security expert and an award-winning author and presenter. She is also the co-author of Experts' Guide to OS/400 and i5/OS Security.

 

Carol Woodbury is IBM i Security SME and Senior Advisor to Kisco Systems, a firm focused on providing IBM i security solutions. Carol has over 30 years’ experience with IBM i security, starting her career as Security Team Leader and Chief Engineering Manager for iSeries Security at IBM in Rochester, MN. Since leaving IBM, she has co-founded two companies: SkyView Partners and DXR Security. Her practical experience and her intimate knowledge of the system combine for a unique viewpoint and experience level that cannot be matched.

Carol is known worldwide as an author and award-winning speaker on security technology, specializing in IBM i security topics. She has written seven books on IBM i security, including her two current books, IBM i Security Administration and Compliance, 3^rd Edition and Mastering IBM i Security, A Modern, Step-by-Step Approach. Carol has been named an IBM Champion since 2018 and holds her CISSP and CRISC security certifications.

---

MC Press books written by Carol Woodbury available now on the MC Press Bookstore.

		IBM i Security Administration and Compliance: Third Edition Don't miss the newest edition by the industry’s #1 IBM i security expert. List Price $71.95 Now On Sale
		Mastering IBM i Security Get the must-have guide by the industry’s #1 security authority. List Price $49.95 Now On Sale