HP Archive Backup System for OpenVMS Guide to Operations

5
Security
The security model used by ABS and MDMS is designed to provide flexibility in both the level
of security and ease-of-use. ABS uses the MDMS security model, which is based on two main
elements:
• Rights - The assignment of individual rights to particular users or classes of users that allow
them to perform specific operations across the domain. Rights allow users to perform operations
on all objects or certain object classes across the domain. This is a task-based form of
security.
• Access Control - The assignment of access control is on a per-object basis, and allows specific
users to perform specific types of operations on the object. This is an object-based form
of security.
In addition, you can assign your MDMS domain one of three levels of access-control based
security as follows:
• No Access Control - As the name implies, MDMS and ABS perform no access control based
checking, even if individual objects have access control entries defined. However, rights
continue to be checked.
• Loose Access Control - This option supports access control checking on objects, but only on
those objects that have at least one access control entry. If there is at least one entry, access
to the object is restricted to users with access control entries supporting the requested
access. With objects with no access control entries, access to the object is implicitly granted.
• Tight Access Control - Designed for secure environments, this option supports access control
checking on all objects. If there is at least one access control entry on an object, access
to the object is restricted to users with access control entries supporting the requested
access. With objects with no access control entries, access to the object is implicitly
denied.This basically requires that all objects have appropriate access controls to be defined
for the object to be used. Certain domain users may access normally inaccessible objects to
prevent accidental lock-out due to insufficient access controls.
In general, the security model requires that both rights and access control are applied to users
wanting to perform operations. In other words, having the “super” right MDMS_ALL_RIGHTS
does not necessarily mean that you can do anything - any access control restrictions must also be
satisfied.
This chapter discusses the security model in more detail.
Security 5–1