Implementation Considerations › Determine Appropriate Security Mode

Determine Appropriate Security Mode

The mode used for specific DB2 resource checks defaults to the mode of the facility used for the DB2 subsystem, unless the mode is specified on a PERMIT. The facility is determined by the specification of the DB2FAC control option. Consider the following scenario:

• TSO facility in WARN mode
• CICSPROD facility in FAIL mode
• DB2PROD facility in FAIL mode
• DB2 DSNP subsystem associated with DB2PROD via DB2FAC control option

All security checks from TSO or CICSPROD accessing DB2 subsystem DSNP will occur in FAIL mode under the DB2PROD facility. Unless MODE is specified on the resource permission, the mode is determined by the DB2 facility.

CA Top Secret Option for DB2 supports all four security modes (DORMANT, WARN, IMPLEMENT, FAIL) for DB2 resource protection.