1. Through assistance with Jacqueline Chapel-Hardy, IS – iSeries Administration Analyst, on 2/12/2015, IA noted that the assignment of super user privileges is based upon job function and responsibilities. Appropriate segregation is based on individual roles. User profile access rights within the OS 400 system are defined by the OS 400 special authority capabilities given to each user profile. Per Jacqueline, the User Administration group handles provisioning of users. The iSeries Administration team is then notified by the User Administration team (or via the SkyView Policy Minder reports covered on tab SEC5.1) of new super users being set up .
2. Through assistance with Jacqueline Chapel-Hardy, IS – iSeries Administration Analyst, on 2/12/2015, IA inspected the classification of super user based on the special authority capabilities with high access rights. It was
…show more content…
IA obtained and inspected the “Super User or Privileged Account Usage Policy” document (version 3.3) approved by Franklin Donahoe, Director, on 12/17/2013, via the Costco’s intranet site, on 2/12/2015, from Jacqueline Chapel-Hardy, IS – iSeries Administration Analyst . Through inspection of the document for detailed information regarding the super user requirements related to the limitations of usage, logging, and description and review of privileged access, ascertained the following, per Section 2.4 Provisioning, “Each platform functional area manager, in conjunction with review by Information Security, will define the criteria section for super user accounts. It is the responsibility of the super users and their management to track the use of the account while it 's needed”. In addition, per Section 2.5 Monitoring, it is a requirement that “actions of a super user account shall be logged and reviewed on a regular basis. These logs should be stored in a read-only format. Super user accounts configured in the systems and logs are subject to review by Information Security or IS