Doc Farmer wrote:
Mr. Farrell,
It is mainly to work as a cross-check to other change management reports. Not all of them catch ZAP functionality, and the bosses wants to keep change control just that - controlled. I don't think the auditors are as concerned about this kind of thing these days (and I used to be an auditor myself) but I do know that change management reporting is a big deal for Sarbanes-Oxley and HIPAA, among other regulations out there today - and auditors definitely check that. I agree that dataset access control is more important, but that does not mean that ZAP control is un-important, does it?
Well...I have always thought it a less than useful check, and I
think people who believe that mere access to a program named
AMASPZAP should be restricted are not aware of all the facts.
As to not being able to track all the programs, I thought there were only a handful of actual "ZAP"-capable programs out there in z/OS - IMASPZAP, IGWSPZAP, CSQUZAP, AMASPZAP, SPZAP, SUPERZAP, SUPERMAN, SUPERFLY, MARTYMCFLY, etc. Are there more that we don't know about, but should?
There is no magic in the program name. Your system programmers
and anyone else with access to z/OS distribution libraries can
construct an infinite (well, bounded by available program names,
which for most practical purposes is close enough) number of ZAP
programs using the Binder and the CSECTs for AMASPZAP. They will
be functionally identical to AMASPZAP.
For example, I could create a JOHNZAP, a DOCFZAP, and a WALTZAP
from AMASPZAP's parts, and all them would work just fine. Doing
so is not entirely straightforward, but neither is it rocket science.
But even with a JOHNZAP, DOCZAP, or WALTZAP in hand, I could
still not do anything I could not already do with another program
unless I had authorization to do it anyway. I can, however, do
many things more conveniently with AMASPZAP (or its renamed
clone) than I can do them with other programs.
Many thanks.
Doc
<snip>
--
John Eells
z/OS Technical Marketing
IBM Poughkeepsie
[EMAIL PROTECTED]
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html
