|
|
|
It is also important to check the source code for all user SVCs. Even though you probably cannot review the source code for proprietary SVCs, the vendor might be willing to supply details about the security of the SVC. In some cases, particularly if the SVC is small (a good candidate for being an authorization SVC), you might want to decompile it from the load module. This takes either a good decompiler program or a lot of machine‑language expertise, but you can discover some surprising things this way.
The source code should be available for any locally‑written SVCs. Determine what the SVC does and what sort of self‑protection mechanisms it has. If you are unable to read assembler language, obtain a “peer review” of the source code. You can use the Program Freezer Option (5.5) to obtain a hash total of the program, which you can use during the next review to determine if any changes were made to the SVC. You can also use the ISPF/PDF Copy function to copy the SVC. In the next review, you can use the Program Comparison display (5.3) to review any changes made since you originally froze the SVC. See the SVC checklist of the System Review Checklist for specific tests that you should perform on SVCs.
| Copyright © 2009 CA. All rights reserved. | Tell Technical Publications how we can improve this information |