May I Have the Envelope, Please?
Some organizations need to limit access to power—perhaps for an audit requirement—so they create processes to control who has these powerful capabilities. Sometimes, they create a "production access" ID and keep its password in a sealed envelope. But as soon as the envelope is opened, more than one person (the person who created the password and anyone who then uses the password) has that access, making it difficult to attribute actions to an individual—not to mention that this is a low-tech solution to a high-tech problem. If you're at Grandma's house for Thanksgiving and you get a support call, it might be difficult to access that envelope.

Halt! Who Goes There?
Another method is to modify the initial program of a powerful profile so that anyone who signs on as that user goes through a secondary authentication process. For example, if Susan needs access to QSECOFR, she signs on as QSECOFR and is presented with a screen that asks for her own ID and password and the reason for assuming the high-level authority. Unfortunately, this attempt at adding accountability to the process introduces new holes. Shops that use this type of process forget that a 5250 sign-on screen isn't the only way to access an iSeries; the user could gain access with FTP, ODBC, Remote Command, etc. and never be subjected to the secondary authentication process.

Brokering Authority
Many companies came to PowerTech asking how to monitor and manage their powerful users. We understood the problem; we addressed it years ago with a tool we used internally. In 2005, PowerTech released PowerLock AuthorityBroker so that everyone could monitor, control, and report on the activities of powerful users. PowerLock AuthorityBroker enables you to temporarily assign powerful authorities to users and then get a report on their actions. Companies the world over are embracing the AuthorityBroker approach because it provides a clean, simple interface that doesn't inhibit people's ability to get their job done. And its comprehensive set of reports satisfies your auditor's demands to account for the actions of your systems' powerful users.

AuthorityBroker has two operating modes, standard and FireCall, and you can assign IT staff to either mode, depending on your support requirements. In standard mode, IT staff members have a list of user IDs whose authorities they can run under anytime. When they choose a set of authorities, alerts are sent to the appropriate oversight authorities, and activity is recorded in a secure system audit journal. The system administrator can control the dates and times someone can start the process and how long a user can use this authority.

Fire! Fire! Ring the Bell!
Sometimes applications go bump in the night and people who shouldn't normally have high authority need access to production systems at odd hours. You don't want to wake up five people to get approval for the programmer to access the system, but you still need to record what transpired and be able to report on it. FireCall allows you to delegate limited assignment authority to help desk or computer operations personnel and let them assign higher authority to IT staff. Again, every action is monitored and tracked, and complete reporting is available.

AuthorityBroker is unique in the marketplace as it allows you to remove powerful authorities from IT staff members without inhibiting their ability to support production systems. AuthorityBroker ships with i5/OS, so you can experience a 30-day trial by locating your V5R3 or V5R4 CDs or download it from our Web site.

Check out PowerTech's other offerings in the MC Showcase Buyer's Guide.

John Earl is Vice President and CTO of The PowerTech Group. He can be reached at This email address is being protected from spambots. You need JavaScript enabled to view it..

John Earl is the founder and Director of Technology and Security for  The PowerTech Group.  a Seattle-area software company that specializes in System i security. He has over 25 years experience with IBM midrange systems and security, has published numerous articles and columns for industry magazines, and served as a Subject Matter Expert (SME) for Security for COMMON. A highly regarded speaker on OS/400 and i5/OS security, Mr. Earl has presented several hundred of iSeries security sessions at industry conferences and user groups all over the world. He is a three-time winner of COMMON's Speaker Excellence award and has also served on the board of directors of COMMON U.S.

 

He can be reached at 253.872.7788 or at This email address is being protected from spambots. You need JavaScript enabled to view it..