Re: Privileges by session

From: Thomas A. La Porte <Thomas.LaPorte_at_dreamworks.com>
Date: Fri, 8 Jan 2010 13:13:36 -0800 (PST)
Message-ID: <alpine.LRH.2.00.1001081309530.5765_at_greenkey.anim.dreamworks.com>

If the developers own the source code for the app, and the application user password is stored in the source code of the application, changing the password will, of necessity, entail informing the developers of the new password.

This is no where near "best practices" from a security standpoint, but it is such a common occurrence in all of our environments that the discussion here is worthwhile.

On Fri, 8 Jan 2010, Joan Hsieh wrote:

> I don't get it, even hard coded in the app. There must be a way to change the
> pw. In our peoplesoft environment, the sysadm pw on dev and production are
> different. All the developers must logon as their individual account which
> grant a select role privilege. No one knows the sysadm (application account)
> pw except dba and peoplesoft admin.
>
> Blanchard, William wrote:
>
>> Correct.
>>
>
>
> --
> http://www.freelists.org/webpage/oracle-l
>
>
>

--
http://www.freelists.org/webpage/oracle-l

Received on Fri Jan 08 2010 - 15:13:36 CST