Access control restricts the availability of system resources to only those users you have authorized to interact with the resources. The server allows you to control authorization of users to system resources.
Your organization should identify each system resource in the organization's security hierarchy. The hierarchy should clearly delineate the levels of access authorization users have to resources.
All of the service programs in i5/OS™ Option 35 are shipped with *EXCLUDE authority for *PUBLIC. You must give users *USE authority for the service program that they need to use. In addition, you must also give users *USE authority to the QC6SRV service program in library QCCA.
Users who take part in setting up a Cryptographic Coprocessor must have *IOSYSCFG special authority to use the Master_Key_Process (CSNBMKP), Access_Control_Initialize (CSUAACI), or Cryptographic_Facility_Control (CSUACFC) security application programming interfaces (SAPIs). These three SAPIs are used to perform all configuration steps for the Cryptographic Coprocessors. For all SAPIs, users may require additional object authorities.
For the most secure environments, consider assigning the role of Coprocessor Administrators to a set of users who do not have *ALLOBJ special authority. This way, users with *ALLOBJ special authority cannot alter the configuration of the Coprocessor because they will not be able to log on to an administrative role on the Coprocessor. They can, however, control object authority to the SAPI service programs, preventing misuse by the administrators.
In order to use the Cryptographic Coprocessor configuration web utility, users must have *SECADM special authority.
Cryptographic Coprocessors have separate access controls which are unrelated to the access controls of the server. The Cryptographic Coprocessor access controls allow you to control access to the Cryptographic Coprocessor hardware commands.
For even more security, limit the capabilities of the default role within your Cryptographic Coprocessor. Assign capabilities among other roles to require two or more people to perform security-sensitive functions, like changing the master key. You can do this when you work with roles and profiles.