PowerLock AuthorityBroker is a new, easy-to-use solution that works with OS/400 and i5/OS security to protect and audit access to sensitive corporate assets. Organizations in every industry and country are now impacted by one or more security or privacy regulations. Legislation like Sarbanes-Oxley, HIPAA, GLBA, and the California Privacy Act has emboldened auditors, making IT audits more rigorous and tougher to pass. Whether it is root access on UNIX or special authorities on OS/400, auditors consistently rate the overuse of powerful user profiles as one of the top exception items.

Today's Problems

Many AS/400, iSeries, and i5/OS systems have a problem with too many users having privileged or special levels of user access. Special authorities have been assigned indiscriminately to user profiles. Programmers and IT staff often have security officer (QSECOFR) levels of access built into their everyday profiles along with command line access. We all know this is risky security practice, but the standard excuse is "We need to have security officer access to do our jobs and to keep the business running."

Many administrators have inherited such legacy issues. User and group profiles were defined when there was little concern or awareness about security. Yet how many times have system users shot themselves in the foot by having too much authority? Can staff members view the payroll file or edit sensitive data on a whim? Or without any trace of their activity?

The Solution

PowerTech's new product, AuthorityBroker, allows privileged access only when it is really necessary. With PowerLock AuthorityBroker, you specify when and how users exercise powerful authority. PowerLock AuthorityBroker enables system administrators to reduce the number of profiles with special authorities on their systems without disrupting production. Users "switch" profiles when they need the higher authorities, but all of their actions are fully audited.

Managers can get regular reports of activity or even email notifications when one of their staff members switches to the powerful profile.
As shown in the screen shot below, the administrator simply configures a table of system users with an allowed set of "switch profiles" that they can switch into. When users need higher authority, they simply type a command from the command line and enter the reason for the switch.