Q: We use OfficeVision/400 and have some sensitive documents online. I was told that an OfficeVision user can view all of the documents in the system. According to the IBM security manual, "*SECADM special authority gives the user comprehensive authority to manage OfficeVision/400 objects and users." Can an OfficeVision administrator who has *SECADM special authority view the documents of other users? Is there a way to secure sensitive documents so that OfficeVision administrators have no access?
A: You can prevent OfficeVision administrators from accessing sensitive documents. OfficeVision allows you to give an administrator full or limited *SECADM special authority. An administrator who has full *SECADM special authority is able to work with system objects, such as libraries, while using the Office-Vision program. An administrator with limited *SECADM special authority cannot work with system objects while using the OfficeVision program.
The default is to enroll administrators with limited *SECADM special authority in OfficeVision, which limits the administrator's access to documents of other users. A user with limited *SECADM special authority can be restricted from accessing documents and folders using OS/400 document library security.
You should check the enrollment for all OfficeVision administrators. You can determine if administrators have full or limited *SECADM special authority by selecting administration (option 9) from the main office menu. Select Work with Office users (option 1); then use option 2 (change) to select a user. Select Enrollment information (option 4) to display the OfficeVision administrators' access. If the administrators are restricted from object management (Allow object management is N), they are given no special access.
CAUTION: When an administrator enrolls a new user, the administrator becomes the owner of the user profile for that user. This ownership allows the administrator to submit jobs running with the user profile of the enrolled user. These jobs could grant the administrator access to sensitive documents. It is difficult to prevent this back door for administrators. The best policy would be for the QSECOFR to enroll the users who have sensitive documents.
Q: If I am the owner of an object, can I always control access to the object? What happens if I store an object that I own in a library and then my access to the library is revoked? Can I still authorize access to the object or delete the object?
A: Good question! I thought the owner of an object could always control access to an object, but I had to do some testing on the AS/400 to verify how this works. When the object owner is not authorized to the library where the object is stored, the object owner cannot use the Grant, Revoke, or Edit Object Authority (GRTOBJAUT, RVKOBJAUT, or EDTOBJAUT) commands. These commands fail with a message that the user is "not authorized to library xxx."
The owner of the object can use the Work with Objects by Owner (WRKOBJOWN) command to obtain a list of objects owned. This list includes the object in the restricted library. Attempts to use options from the WRKOBJOWN menu for objects in restricted libraries also result in "not authorized" messages. The only solution is to see your friendly security officer for assistance.
More than ever, there is a demand for IT to deliver innovation. Your IBM i has been an essential part of your business operations for years. However, your organization may struggle to maintain the current system and implement new projects. The thousands of customers we've worked with and surveyed state that expectations regarding the digital footprint and vision of the company are not aligned with the current IT environment.
TRY the one package that solves all your document design and printing challenges on all your platforms. Produce bar code labels, electronic forms, ad hoc reports, and RFID tags – without programming! MarkMagic is the only document design and print solution that combines report writing, WYSIWYG label and forms design, and conditional printing in one integrated product. Make sure your data survives when catastrophe hits. Request your trial now! Request Now.
Forms of ransomware has been around for over 30 years, and with more and more organizations suffering attacks each year, it continues to endure. What has made ransomware such a durable threat and what is the best way to combat it? In order to prevent ransomware, organizations must first understand how it works.
Disaster protection is vital to every business. Yet, it often consists of patched together procedures that are prone to error. From automatic backups to data encryption to media management, Robot automates the routine (yet often complex) tasks of iSeries backup and recovery, saving you time and money and making the process safer and more reliable. Automate your backups with the Robot Backup and Recovery Solution. Key features include:
Business users want new applications now. Market and regulatory pressures require faster application updates and delivery into production. Your IBM i developers may be approaching retirement, and you see no sure way to fill their positions with experienced developers. In addition, you may be caught between maintaining your existing applications and the uncertainty of moving to something new.
IT managers hoping to find new IBM i talent are discovering that the pool of experienced RPG programmers and operators or administrators with intimate knowledge of the operating system and the applications that run on it is small. This begs the question: How will you manage the platform that supports such a big part of your business? This guide offers strategies and software suggestions to help you plan IT staffing and resources and smooth the transition after your AS/400 talent retires. Read on to learn:
LATEST COMMENTS
MC Press Online