InfoCenter Optim Security

I am trying to understand Optim Security in more detail so I can meet two new requirements:

1. We need to restrict Browse of archive files in our production Optim Directory to a specific user ID.
2. We now are planning an archive of data which is maintained under Specific Nationality nationals only NDA, so all access to the files, even restricted Browse from above, is control to only those who have executed the appropriate NDA.

The full support team currently has Browse enabled in the Access Control Domain [ACD] called (Default).
I think I can meet requirement 1 if I disallow Browse and ACD editing for all users except ID1 and ID2. When I create a File Access Definition [FAD] for the special NDA application, I enable it for just ID2, to meet the second requirement.

When ID1 starts Optim (either by logging into the Windows machine or with a runas statement) it will be able to Browse the archive files except for those under NDA. Browse is used to quickly obtain record counts for application decommission validation.

When ID2 starts Optim, it will be able to do the same Browse and Browse the NDA application archives.

Does this plan of action make sense, and satisfy the two use cases?
Are there any batch process holes with the standard Optim Linux run ID still owning the files in Linux?
Will Auto Delete of Archives upon expiry still work?
Will Optim Connect, running as root, permit authorized users to query the archives?


------------------------------
Ed Lipson
BNYMellon
Brooklyn NY
718 315 4763
------------------------------

#InfoSphereOptim
#Optim

Hi Ed,

All of the suggested use cases are going to work provided how you configure Roles, ACD, FAD.

Please take a look at the article contains configuration steps with some examples:

IBM InfoSphere Optim Data Growth Solution: Enable security on an Optim Archive File

Ibm		remove preview
IBM InfoSphere Optim Data Growth Solution: Enable security on an Optim Archive File IBM InfoSphere Optim Solutions allows you to manage data throughout the data lifecycle. This tutorial walks you step-by-step through how to use function-level, object-level, and archive-file security to set data-specific security in a database. View this on Ibm >

------------------------------
Thanks,
Tulasi Uppu
------------------------------

Original Message:
Sent: 09-27-2018 09:27
From: Ed Lipson
Subject: Optim Security

InfoCenter Optim Security

I am trying to understand Optim Security in more detail so I can meet two new requirements:

1. We need to restrict Browse of archive files in our production Optim Directory to a specific user ID.
2. We now are planning an archive of data which is maintained under Specific Nationality nationals only NDA, so all access to the files, even restricted Browse from above, is control to only those who have executed the appropriate NDA.

The full support team currently has Browse enabled in the Access Control Domain [ACD] called (Default).
I think I can meet requirement 1 if I disallow Browse and ACD editing for all users except ID1 and ID2. When I create a File Access Definition [FAD] for the special NDA application, I enable it for just ID2, to meet the second requirement.

When ID1 starts Optim (either by logging into the Windows machine or with a runas statement) it will be able to Browse the archive files except for those under NDA. Browse is used to quickly obtain record counts for application decommission validation.

When ID2 starts Optim, it will be able to do the same Browse and Browse the NDA application archives.

Does this plan of action make sense, and satisfy the two use cases?
Are there any batch process holes with the standard Optim Linux run ID still owning the files in Linux?
Will Auto Delete of Archives upon expiry still work?
Will Optim Connect, running as root, permit authorized users to query the archives?


------------------------------
Ed Lipson
BNYMellon
Brooklyn NY
718 315 4763
------------------------------

#InfoSphereOptim
#Optim

Hi Tulsi,

Link provided for this response seems to be migrated to new portal. is this knowledge material still available for reference?

------------------------------
Madhav A
------------------------------

Original Message:
Sent: Fri September 28, 2018 12:35 PM
From: Tulasi Uppu
Subject: Optim Security

Hi Ed,

All of the suggested use cases are going to work provided how you configure Roles, ACD, FAD.

Please take a look at the article contains configuration steps with some examples:

IBM InfoSphere Optim Data Growth Solution: Enable security on an Optim Archive File

Ibm		remove preview
IBM InfoSphere Optim Data Growth Solution: Enable security on an Optim Archive File IBM InfoSphere Optim Solutions allows you to manage data throughout the data lifecycle. This tutorial walks you step-by-step through how to use function-level, object-level, and archive-file security to set data-specific security in a database. View this on Ibm >

------------------------------
Thanks,
Tulasi Uppu

Original Message:
Sent: 09-27-2018 09:27
From: Ed Lipson
Subject: Optim Security

InfoCenter Optim Security

I am trying to understand Optim Security in more detail so I can meet two new requirements:

1. We need to restrict Browse of archive files in our production Optim Directory to a specific user ID.
2. We now are planning an archive of data which is maintained under Specific Nationality nationals only NDA, so all access to the files, even restricted Browse from above, is control to only those who have executed the appropriate NDA.

The full support team currently has Browse enabled in the Access Control Domain [ACD] called (Default).
I think I can meet requirement 1 if I disallow Browse and ACD editing for all users except ID1 and ID2. When I create a File Access Definition [FAD] for the special NDA application, I enable it for just ID2, to meet the second requirement.

When ID1 starts Optim (either by logging into the Windows machine or with a runas statement) it will be able to Browse the archive files except for those under NDA. Browse is used to quickly obtain record counts for application decommission validation.

When ID2 starts Optim, it will be able to do the same Browse and Browse the NDA application archives.

Does this plan of action make sense, and satisfy the two use cases?
Are there any batch process holes with the standard Optim Linux run ID still owning the files in Linux?
Will Auto Delete of Archives upon expiry still work?
Will Optim Connect, running as root, permit authorized users to query the archives?


------------------------------
Ed Lipson
BNYMellon
Brooklyn NY
718 315 4763
------------------------------

#InfoSphereOptim
#Optim

Hi Madhav,

I am not sure about that change. I have a copy of the document attached. Hope this will going to help.

Thanks,
Tulasi

------------------------------
Tulasi Uppu
------------------------------

Original Message:
Sent: Thu February 03, 2022 05:33 AM
From: Raj
Subject: Optim Security

Hi Tulsi,

Link provided for this response seems to be migrated to new portal. is this knowledge material still available for reference?

------------------------------
Madhav A

Original Message:
Sent: Fri September 28, 2018 12:35 PM
From: Tulasi Uppu
Subject: Optim Security

Hi Ed,

All of the suggested use cases are going to work provided how you configure Roles, ACD, FAD.

Please take a look at the article contains configuration steps with some examples:

IBM InfoSphere Optim Data Growth Solution: Enable security on an Optim Archive File

Ibm		remove preview
IBM InfoSphere Optim Data Growth Solution: Enable security on an Optim Archive File IBM InfoSphere Optim Solutions allows you to manage data throughout the data lifecycle. This tutorial walks you step-by-step through how to use function-level, object-level, and archive-file security to set data-specific security in a database. View this on Ibm >

------------------------------
Thanks,
Tulasi Uppu

Original Message:
Sent: 09-27-2018 09:27
From: Ed Lipson
Subject: Optim Security

InfoCenter Optim Security

I am trying to understand Optim Security in more detail so I can meet two new requirements:

1. We need to restrict Browse of archive files in our production Optim Directory to a specific user ID.
2. We now are planning an archive of data which is maintained under Specific Nationality nationals only NDA, so all access to the files, even restricted Browse from above, is control to only those who have executed the appropriate NDA.

The full support team currently has Browse enabled in the Access Control Domain [ACD] called (Default).
I think I can meet requirement 1 if I disallow Browse and ACD editing for all users except ID1 and ID2. When I create a File Access Definition [FAD] for the special NDA application, I enable it for just ID2, to meet the second requirement.

When ID1 starts Optim (either by logging into the Windows machine or with a runas statement) it will be able to Browse the archive files except for those under NDA. Browse is used to quickly obtain record counts for application decommission validation.

When ID2 starts Optim, it will be able to do the same Browse and Browse the NDA application archives.

Does this plan of action make sense, and satisfy the two use cases?
Are there any batch process holes with the standard Optim Linux run ID still owning the files in Linux?
Will Auto Delete of Archives upon expiry still work?
Will Optim Connect, running as root, permit authorized users to query the archives?


------------------------------
Ed Lipson
BNYMellon
Brooklyn NY
718 315 4763
------------------------------

#InfoSphereOptim
#Optim

Thank you so much for the attachment. This is really helpful.

------------------------------
Raj
------------------------------

Original Message:
Sent: Fri February 04, 2022 10:53 AM
From: Tulasi Uppu
Subject: Optim Security

Hi Madhav,

I am not sure about that change. I have a copy of the document attached. Hope this will going to help.

Thanks,
Tulasi

------------------------------
Tulasi Uppu

Original Message:
Sent: Thu February 03, 2022 05:33 AM
From: Raj
Subject: Optim Security

Hi Tulsi,

Link provided for this response seems to be migrated to new portal. is this knowledge material still available for reference?

------------------------------
Madhav A

Original Message:
Sent: Fri September 28, 2018 12:35 PM
From: Tulasi Uppu
Subject: Optim Security

Hi Ed,

All of the suggested use cases are going to work provided how you configure Roles, ACD, FAD.

Please take a look at the article contains configuration steps with some examples:

IBM InfoSphere Optim Data Growth Solution: Enable security on an Optim Archive File

Ibm		remove preview
IBM InfoSphere Optim Data Growth Solution: Enable security on an Optim Archive File IBM InfoSphere Optim Solutions allows you to manage data throughout the data lifecycle. This tutorial walks you step-by-step through how to use function-level, object-level, and archive-file security to set data-specific security in a database. View this on Ibm >

------------------------------
Thanks,
Tulasi Uppu

Original Message:
Sent: 09-27-2018 09:27
From: Ed Lipson
Subject: Optim Security

InfoCenter Optim Security

I am trying to understand Optim Security in more detail so I can meet two new requirements:

1. We need to restrict Browse of archive files in our production Optim Directory to a specific user ID.
2. We now are planning an archive of data which is maintained under Specific Nationality nationals only NDA, so all access to the files, even restricted Browse from above, is control to only those who have executed the appropriate NDA.

The full support team currently has Browse enabled in the Access Control Domain [ACD] called (Default).
I think I can meet requirement 1 if I disallow Browse and ACD editing for all users except ID1 and ID2. When I create a File Access Definition [FAD] for the special NDA application, I enable it for just ID2, to meet the second requirement.

When ID1 starts Optim (either by logging into the Windows machine or with a runas statement) it will be able to Browse the archive files except for those under NDA. Browse is used to quickly obtain record counts for application decommission validation.

When ID2 starts Optim, it will be able to do the same Browse and Browse the NDA application archives.

Does this plan of action make sense, and satisfy the two use cases?
Are there any batch process holes with the standard Optim Linux run ID still owning the files in Linux?
Will Auto Delete of Archives upon expiry still work?
Will Optim Connect, running as root, permit authorized users to query the archives?


------------------------------
Ed Lipson
BNYMellon
Brooklyn NY
718 315 4763
------------------------------

#InfoSphereOptim
#Optim