Other Types of Threat and Exploitation › Production Control Personnel

Production Control Personnel

Production control personnel have the authority to change data when errors occur. They must also review the output for correctness and make appropriate changes in case of error. Without adequate controls, access to production data can be compromised.

Use CA Top Secret to:

• Prevent unauthorized use of production control ACIDs whether from TSO, BATCH, or a production control package.
• Limit the access to production data.
• Limit the use of production programs.

Once you authorize a production control person to submit jobs with a specific ACID, you also allow them to submit jobs that are not part of their job function. An example would be listing and changing data. This type of authorization creates the greatest exposure! Controls must be entrenched in the system to:

• Prevent job submission from outside the production control system.
• Examine JCL as it is being submitted.
• Prevent/limit updating of production control libraries.

To restrict the use of undefined job submission started tasks, the STC default of FAIL should be in place. Audit trails must be established by auditing the production control libraries, and compliance jobstreams must be periodically run independent of production control to assure completeness of production jobs. Job submission should be restricted to certain terminals or readers.

Allow updates only through ACIDs that are audited. Review and justify use of these ACIDs.