Implementing Authority Broker
Authority Broker allows administrators to predefine user profiles with elevated levels of authority, then assign system users to that profile. Subsequently, the assigned system user has the capacity to "switch" (or “swap”) into that privileged profile for a specific period of time in order to perform specific tasks. Real-time alerts can inform the administrator and Interested Parties of the switch. While switched, all activity is monitored and can be assembled into reports with complete details of every transaction. Screen capture images of switched activity can also be recorded and compiled into PDF reports.
The following instructions explain how to allocate powerful authorities to authorized users using Profile Switches, and monitor privileged activity in order to increase security on your IBM i system.
By the end of this section, you will know:
- How to approach profile switching and identify the stakeholders.
- How to create a Switch Profile and configure Switch Pairs.
- How to perform the profile switch (as a user).
- How to work with Screen Captures taken during Profile Switches.
- How to implement FireCall.
- How to run reports.
For this demonstration, we will consider the following scenario:
- Joan is the Chief Financial Officer (CFO) of ACME company. She needs an AP data file fixed due to a power outage. The outage caused the AP posting program to fail, corrupting its data.
- Frank is the Applications Development Manager who manages a software developer, Alice.
- Alice is assigned the task of modifying the AP program.
- Ted is the security officer and system administrator for the IBM i system on which the AP reporting system resides.
Concerns
Alice does not have authority to update the AP files using her own User Profile on the target IBM i system. Ted tightly controls access to the sensitive AP application and its associated libraries and data, granting access to users on an "as needed" basis. Joan is cognizant of her obligations under the Sarbanes-Oxley Act and has required that she receive a report of each specific instance when a developer modifies anything in the AP system. Frank is also concerned about his developers' access to sensitive business documents and has requested a report showing the times his developers access a highly restricted portion of the accounting system.
The Solution
In order to address everyone's concerns and, of course, to allow Alice to do her work, Ted configures Authority Broker so Alice can switch profiles to APMOD (a profile he created that allows developers to access and modify the objects necessary to maintain the AP system). He also configures Authority Broker reporting to produce reports for both Joan and Frank so that they will know every time that Alice switches to the APMOD profile and what she did when using that profile.
Using a single command, Alice switches to the APMOD profile when she needs to do her work. At the time that Alice switches, Joan and Frank receive an alert that Alice has activated the APMOD profile. When Alice is finished, she enters another command to switch back to her own profile. During the period Alice was switched to the APMOD profile, her every action was audited into a secure journal.
At scheduled intervals, Ted runs the reports for both Joan and Frank that give them the information they need to ensure that Alice, and the other staff programmers, are acting within the limits of their authority.
In the above scenario we have demonstrated the following:
- Joan and Frank are Interested Parties.
- Ted is the Product Administrator.
- Alice is a System User who assumes the higher level authority of the APMOD profile.
- APMOD is a Switch Profile.
Next - Configuring Switch Pairs
|