| Partner TechTip: Oh No! Another Audit! |
|
|
|
| Tips & Techniques - Security | |||||
| Written by Carol Woodbury | |||||
| Thursday, 25 October 2007 18:00 | |||||
System ValuesAccording to an auditor's playbook, system values must be set to certain settings. But what happens when you can't set a system value to the auditor's required setting? Answer: You write a risk-acceptance statement justifying the current setting. SkyView Risk Assessor provides a detailed description of all security-relevant system values along with reasons you may not be able to set the value to "best practices." You then use these expert explanations in your risk-acceptance statement, which is part of your Policy Description in SkyView Policy Minder. Auditors will demand proof that you are (and have been) in compliance with your organization's policy, and Policy Minder compliance reports provide this proof. User ProfilesWhen it comes to user profile settings, auditors often expect policies to document the following:
Object AuthoritiesInternal auditors and Payment Card Industry (PCI) auditors typically require restricted access to files containing private information. Translated: i5/OS database files containing private information (healthcare information, SSNs or SINs, bank account numbers, or cardholder data) must be set to *PUBLIC *EXCLUDE. Whether the requirement is to secure a library, a directory, a specific file, or a set of files, you can set a library or directory authority template to monitor compliance with these types of audit requirements. Independent AssessmentYou can use Risk Assessor to fulfill an auditor's requirement that you have an expert, independent assessment of your system. Risk Assessor examines over 100 areas of i5/OS security settings (including object authorities, user profiles, TCP/IP configuration, file shares, system values, and more) and compares them to industry best practices. It describes the issues, providing enough information for you to determine whether the risk applies to your organization and, if it does, tips for remediating the issue. We Can HelpYour next audit is fast approaching. You want to be prepared, but you don't have the time or expertise to perform a thorough assessment of your i5/OS systems. SkyView Security Check-up is a service that takes the burden off you to determine the risks associated with the i5/OS security configuration. SkyView provides you with a detailed explanation of the issues discovered by running Risk Assessor and a summary of the recommended action plans for remediation of those issues. | |||||
|





