Warning mode
A RACF profile setting that allows access that would normally be refused, but records a warning every time.
Also written WARNING, RACF warning mode, temporary access allowed
A RACF profile can be put in warning mode. When it is, access that the profile would normally refuse is allowed, but RACF writes a warning message to the user and a record to SMF saying the access would have failed.
This is used when introducing new protection. Suppose a site wants to protect a set of production datasets that have been open for years. If it simply adds a strict profile, jobs that nobody knew about may start failing in the middle of the night. In warning mode, those jobs carry on, and the warnings show exactly who would be affected. The security team then grants the access that is really needed, and switches warning mode off.
The messages say that access was allowed temporarily, which makes them easy to find in job logs and reports.
The danger is forgetting. A profile left in warning mode protects nothing: anyone can still get in. Auditors look for profiles in warning mode, and a good security team keeps the list short and the time in warning mode limited.
Where can I learn this hands-on?
Right here, at ZedBank. You take a junior job at a simulated bank and learn each part of the work by doing it, with Zed beside you. There's nothing to install.
Start at ZedBankRelated
- RACFThe security manager for z/OS, which decides who may sign on, read a dataset, or run a transaction.
- Dataset profileA security rule describing which datasets it covers and who is allowed to do what to them.
- Access levelHow much a user may do to a resource: read it, change it, or control it, with each level including the ones below.
- PERMITThe command that grants or removes a user or group's access to a protected resource.
- SMFSystem Management Facilities: the z/OS feature that writes a detailed record of what happened on the system, used for billing, performance and security.