MS Access, software app or a System?

There is a debate among our security people. Some say that MS Access is a
software app, others considered a system and needs to be CNA`d. I say its a
software app. Any thoughts.

Now here's a debate!

I'd say it is an App which is used to build systems... One way or another,
if you use it to house sensitive information then you need to take steps to
secure it's access. But on a closed LAN with proper security in place,
problems should be minimal.

It will be very interesting to see what others say on this matter.
--
Hope this helps,

Daniel Pineault
http://www.cardaconsultants.com/
For Access Tips and Examples: http://www.devhut.net
Please rate this post using the vote buttons if it was helpful.



"Jody Jenkins" wrote:

There is a debate among our security people. Some say that MS Access is a
software app, others considered a system and needs to be CNA`d. I say its a
software app. Any thoughts.

On 4/23/10 5:38 AM, Jody Jenkins wrote:
There is a debate among our security people. Some say that MS Access is a
software app, others considered a system and needs to be CNA`d. I say its a
software app. Any thoughts.

I'm a bit unclear on what constitutes a "system", so I really can't
address that directly. However, I tend to look at Access as three things
in one package:

1) A database engine
2) An IDE
3) An application

1) Consider SQL Server. It's a database engine, and you certainly can't
hand it off to a user and expect them to find their way around the
tables and rows.

2) Consider Visual Studio. It's an IDE and you can write code to build
an application with it. It doesn't come with a database engine... at
least not without you taking step to actually include or refer to it. It
also can't run an application as an application. You would use it to run
it in debug mode to test/step through the code but not to actually use it.

Access does all of that in the same package - but of course this assumes
that the user is the developer which is not always the case here - more
often than not, the user is here to use it as an application that's
developed by someone else (even if not officially a developer - could be
just a power user or the "most tech savvy guy in the office").

Back to the question - if I were to want them to treat Access as an
application, I'd think about distributing MDE/ACCDE files instead so it
will in fact act more like an application and less than an IDE. That
won't save the developer's machine from needing to be auditing because
we still need the full version of Access (and thus the IDE capability)
to develop the applications. (That's assuming they would treat an IDE as
a "system"... how do they handle Visual Studio and software supporting
SQL Server (e.g. SSMS & BIDS?)

My $0.02 FWIW.

In the works of the security officer that thinks that Access is a software
app, a System has funding, O&M, hardware/software and specialized personnel
hired to maintain it, etc,etc.

"Banana" wrote:

On 4/23/10 5:38 AM, Jody Jenkins wrote:
There is a debate among our security people. Some say that MS Access is a
software app, others considered a system and needs to be CNA`d. I say its a
software app. Any thoughts.

I'm a bit unclear on what constitutes a "system", so I really can't
address that directly. However, I tend to look at Access as three things
in one package:

1) A database engine
2) An IDE
3) An application

1) Consider SQL Server. It's a database engine, and you certainly can't
hand it off to a user and expect them to find their way around the
tables and rows.

2) Consider Visual Studio. It's an IDE and you can write code to build
an application with it. It doesn't come with a database engine... at
least not without you taking step to actually include or refer to it. It
also can't run an application as an application. You would use it to run
it in debug mode to test/step through the code but not to actually use it.

Access does all of that in the same package - but of course this assumes
that the user is the developer which is not always the case here - more
often than not, the user is here to use it as an application that's
developed by someone else (even if not officially a developer - could be
just a power user or the "most tech savvy guy in the office").

Back to the question - if I were to want them to treat Access as an
application, I'd think about distributing MDE/ACCDE files instead so it
will in fact act more like an application and less than an IDE. That
won't save the developer's machine from needing to be auditing because
we still need the full version of Access (and thus the IDE capability)
to develop the applications. (That's assuming they would treat an IDE as
a "system"... how do they handle Visual Studio and software supporting
SQL Server (e.g. SSMS & BIDS?)

My $0.02 FWIW.
.

On 4/23/10 7:25 AM, Jody Jenkins wrote:
In the works of the security officer that thinks that Access is a software
app, a System has funding, O&M, hardware/software and specialized personnel
hired to maintain it, etc,etc.

Well, as I alluded to earlier, how do they currently treat Visual Studio
and SQL Server (or whatever software they use for development
work/database) may be a good indication of how they should treat Access
because as I've explained, Access has the features of an IDE, a database
engine and an application all in one package so it's more closer to a
System than a software app, IMHO.

The hard part is that in some ways, Access is more or less intended to
be more accessible to people who are not necessarily the developer, the
DBA or involved in the trade - it's supposed to (in theory) democratize
the database development/creation by allowing office monkeys to build
their ad hoc database which eventually may transform into mission
critical applications. Not all make that steps but some do. If you've
not already, I strongly recommend you & the other security officers read
the paper from FMS Inc. on the database evolution.

http://www.fmsinc.com/tpapers/genaccess/dbod.asp

"Jody Jenkins" wrote in message
...
There is a debate among our security people. Some say that MS Access is a
software app, others considered a system and needs to be CNA`d. I say its
a
software app. Any thoughts.


What is a "system" in the eyes of the people who matter? I think of Access
itself as an application, and of database apps developed with Access as
applications as well. However, it doesn't matter what I think; it matters
what your definition of a "system" is.

--
Dirk Goldgar, MS Access MVP
Access tips: www.datagnostics.com/tips.html

(please reply to the newsgroup)

Based on your own definition "a System has funding, ... specialized personnel
hired to maintain it" I would define Access in this case as a System for the
simple reason that in a well organised organization an important db will be
assigned funding and personnel to develop/maintain it.

If on the other hand it is a small project which is left "Off the books" and
left to some random employee, then I guess it would be considered an App.

I would urge you, based on your def. to treat it as a system.
--
Hope this helps,

Daniel Pineault
http://www.cardaconsultants.com/
For Access Tips and Examples: http://www.devhut.net
Please rate this post using the vote buttons if it was helpful.



"Jody Jenkins" wrote:

In the works of the security officer that thinks that Access is a software
app, a System has funding, O&M, hardware/software and specialized personnel
hired to maintain it, etc,etc.

"Banana" wrote:

On 4/23/10 5:38 AM, Jody Jenkins wrote:
There is a debate among our security people. Some say that MS Access is a
software app, others considered a system and needs to be CNA`d. I say its a
software app. Any thoughts.

I'm a bit unclear on what constitutes a "system", so I really can't
address that directly. However, I tend to look at Access as three things
in one package:

1) A database engine
2) An IDE
3) An application

1) Consider SQL Server. It's a database engine, and you certainly can't
hand it off to a user and expect them to find their way around the
tables and rows.

2) Consider Visual Studio. It's an IDE and you can write code to build
an application with it. It doesn't come with a database engine... at
least not without you taking step to actually include or refer to it. It
also can't run an application as an application. You would use it to run
it in debug mode to test/step through the code but not to actually use it.

Access does all of that in the same package - but of course this assumes
that the user is the developer which is not always the case here - more
often than not, the user is here to use it as an application that's
developed by someone else (even if not officially a developer - could be
just a power user or the "most tech savvy guy in the office").

Back to the question - if I were to want them to treat Access as an
application, I'd think about distributing MDE/ACCDE files instead so it
will in fact act more like an application and less than an IDE. That
won't save the developer's machine from needing to be auditing because
we still need the full version of Access (and thus the IDE capability)
to develop the applications. (That's assuming they would treat an IDE as
a "system"... how do they handle Visual Studio and software supporting
SQL Server (e.g. SSMS & BIDS?)

My $0.02 FWIW.
.

=?Utf-8?B?Sm9keSBKZW5raW5z?=
wrote in :

There is a debate among our security people. Some say that MS
Access is a software app, others considered a system and needs to
be CNA`d. I say its a software app. Any thoughts.

Without the definitions they have historically used to make this
determination, comment on the subject is not going to be very
illuminating, seems to me.

Access is pretty much one of a kind. The only app I can think of
that's really like it is FileMaker. This means it's not likely to
fit well into categories that have been created to catalog "normal"
applications.

--
David W. Fenton http://www.dfenton.com/
usenet at dfenton dot com http://www.dfenton.com/DFA/

=?Utf-8?B?Sm9keSBKZW5raW5z?=
wrote in :

In the works of the security officer that thinks that Access is a
software app, a System has funding, O&M, hardware/software and
specialized personnel hired to maintain it, etc,etc.

I'm reading behind the lines that there's a failure to distinguish
between:

1. Access the application, installed on a PC.

2. an Access application, which is an MDB/ACCDB that is a program
itself that incidentally requires Access to be installed to run it.

In the former case, Access is an application, not a system.

In the latter, it's a system.

I would guess that the parties with vested interests are not going
to want to distinguish between Access and the advertising
department's Assets Management application, that just so happens to
use Access. But if they had any sense, they would make just that
distinction.

--
David W. Fenton http://www.dfenton.com/
usenet at dfenton dot com http://www.dfenton.com/DFA/

On Apr 23, 7:38*am, Jody Jenkins
wrote:
There is a debate among our security people. Some say that MS Access is a
software app, others considered a system and needs to be CNA`d. I say its a
software app. Any thoughts.

Neither - or both... its a tool. You can use it to build a system
that requires "funding, O&M, hardware/software and specialized
personnel hired to maintain it" or you can just as easily use it to
create a simple little way to beat some data into submission or
anything in between.