The Defense Information Systems Agency (DISA) is a part of the Department of Defense (DoD), and is a combat support agency. DISA created and maintain a security standard for computer systems and networks that connect to the DoD. These guidelines are sets of configurations and checklists, known as Security Technical Implementation Guides (STIGs), which help to ensure the security of computer networks and systems. These standards have become the de facto policy for many DoD organizations, saving them significant time and effort in developing independent standards.
The purpose of STIGs is to make sure that any organization that is connecting to DoD networks is using the most secure settings possible. This also ensures that there is a standard that all organizations accessing DoD systems must follow, which can help with configuration and connection issues. STIGs both improve security and simplify IT services.
BMC AMI Security Policy Manager supports compliance testing for the following STIGs. The STIG titles and descriptions are from https://stigviewer.com/stigs documentation for the specific external security manager (ESM) type.
| | | | | |
|---|
| V-223443 | high | Access to the System Master Catalog must be properly protected. | To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement. Access control policies include: identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include: access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system. Satisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000324-GPOS-00125 | SV-223443r958472_rule | Refer to SYSCATxx member of SYS1.NUCLEUS.
Multiple SYSCATxx members may be defined if so refer to Master Catalog message for IPL.
If the member is not found, refer to the appropriate LOADxx member of SYS1.PARMLIB. If data set rules for the Master Catalog do not restrict greater than "READ" access to only z/OS systems programming personnel, this is a finding. If Products or procedures requiring system programmer access for system level maintenance meet the following specific case:
- The batch job or procedure must be documented in the SITE Security Plan.
- Reside in a data set that is restricted to systems programmers' access only.
If the above is true, this is not a finding. If data set rules for the Master Catalog do not specify that all (i.e., failures and successes) greater than "READ" access will be logged, this is a finding. |
| V-223445 | high | Must limit Write or greater access to SYS1.NUCLEUS to system programmers only. | To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement. Access control policies include: identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include: access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system. Satisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000259-GPOS-00100, SRG-OS-000324-GPOS-00125 | SV-223445r958472_rule | If all of the following are untrue, this is not a finding. If any of the following is true, this is a finding. The ACP data set rules for SYS1.NUCLEUS do not restrict WRITE and/or ALLOCATE access to only z/OS systems programming personnel. The ACP data set rules for SYS1.NUCLEUS do not specify that all (i.e., failures and successes) WRITE and/or ALLOCATE access will be logged. |
| V-223446 | high | Must limit Write or greater access to SYS1.LPALIB to system programmers only. | To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement. Access control policies include: identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include: access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system. Satisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000259-GPOS-00100, SRG-OS-000324-GPOS-00125 | SV-223446r958472_rule | Execute a data set list of access for SYS1.LPALIB. If any of the following is true, this is a finding. - The ACF2 data set rules for SYS1.LPALIB do not restrict WRITE and/or ALLOCATE access to only z/OS systems programming personnel.
- The ACF2 data set rules for SYS1.LPALIB do not specify that all (i.e., failures and successes) WRITE and/or ALLOCATE access will be logged. |
| V-223449 | high | Must limit Write and Allocate access to all APF-authorized libraries to system programmers only. | To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement. Access control policies include: identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include: access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system. This requirement applies to operating systems with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs which execute with escalated privileges. Only qualified and authorized individuals must be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications. Satisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000259-GPOS-00100, SRG-OS-000324-GPOS-00125 | SV-223449r958472_rule | From Any ISPF input line, enter:
TSO ISRDDN APF If all of the following are untrue, this is not a finding. If any of the following is true, this is a finding. - The ACP data set rules for APF libraries do not restrict WRITE and/or ALLOCATE access to only z/OS systems programming personnel.
- The ACP data set rules for APF libraries do not specify that all (i.e., failures and successes) WRITE and/or ALLOCATE access will be logged. |
| V-223450 | high | Must limit Write or greater access to all LPA libraries to system programmers only. | To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement. Access control policies include: identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include: access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system. Satisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000259-GPOS-00100, SRG-OS-000324-GPOS-00125 | SV-223450r958472_rule | From any ISPF input line, enter TSO ISRDDN LPA. If all of the following are untrue, this is not a finding. If any of the following is true, this is a finding. The ACP data set rules for LPA libraries do not restrict WRITE and/or ALLOCATE access to only z/OS systems programming personnel. The ACP data set rules for LPA libraries do not specify that all (i.e., failures and successes) WRITE and/or ALLOCATE access will be logged. |
| V-223451 | medium | Must limit Write and Allocate access to LINKLIST libraries to system programmers only. | To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement. Access control policies include: identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include: access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system. Satisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000259-GPOS-00100 | SV-223451r958472_rule | From any ISPF input line, enter TSO ISRDDN LINKLIST If all of the following are untrue, this is not a finding. If any of the following is true, this is a finding. The ACP data set rules for LINKLIST libraries do not restrict WRITE and/or ALLOCATE access to only z/OS systems programming personnel. The ACP data set rules for LINKLIST libraries do not specify that all (i.e., failures and successes) WRITE and/or ALLOCATE access will be logged. |
| V-223454 | medium | Access to SYS1.LINKLIB must be properly protected. | If the operating system were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to operating systems with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs which execute with escalated privileges. Only qualified and authorized individuals must be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications. The operating system or software configuration management utility must enforce control of software installation by users based upon what types of software installations are permitted (e.g., updates and security patches to existing software) and what types of installations are prohibited (e.g., software whose pedigree with regard to being potentially malicious is unknown or suspect) by the organization. Satisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000259-GPOS-00100, SRG-OS-000324-GPOS-00125, SRG-OS-000362-GPOS-00149 | SV-223454r1001093_rule | Execute a data set list of access to SYS1.LINKLIB. If the ESM data set rules for SYS1.LINKLIB allow inappropriate (e.g., global READ) access, this is a finding. If data set rules for SYS1.LINKLIB do not restrict READ, UPDATE and ALTER access to only systems programming personnel, this is a finding. If data set rules for SYS1.LINKLIB do not restrict READ and UPDATE access to only domain level security administrators, this is a finding. If data set rules for SYS1.LINKLIB do not restrict READ access to only system Level Started Tasks, authorized Data Center personnel, and auditors, this is a finding. If data set rules for SYS1.LINKLIB do not specify that all (i.e., failures and successes) UPDATE and/or ALTER access will be logged this is a finding. |
| V-223465 | medium | Must limit Write and allocate access to the JES2 System data sets (e.g., Spool, Checkpoint, and Initialization parameters) to system programmers only. | To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement. Satisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000324-GPOS-00125, SRG-OS-000259-GPOS-00100 | SV-223465r958472_rule | The ACF2 data set rules for the JES2 System data sets (e.g., Spool, Checkpoint, and Initialization parameters) do not restrict WRITE and/or ALLOCATE access to only z/OS systems programming personnel. The ACF2 data set rules for the JES2 System data sets (e.g., Spool, Checkpoint, and Initialization parameters) allow inappropriate access not documented and approved by the ISSO. If both of the above are untrue, this is not a finding. If either of the above are true, this is a finding. |
| V-223514 | high | ACF2 security data sets and/or databases must be properly protected. | An isolation boundary provides access control and protects the integrity of the hardware, software, and firmware that perform security functions. Security functions are the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Operating systems implement code separation (i.e., separation of security functions from nonsecurity functions) in a number of ways, including through the provision of security kernels via processor rings or processor modes. For non-kernel code, security function isolation is often achieved through file system protections that serve to protect the code on disk and address space protections that protect executing code. Developers and implementers can increase the assurance in security functions by employing well-defined security policy models; structured, disciplined, and rigorous hardware and software development techniques; and sound system/security engineering principles. Implementation may include isolation of memory space and libraries. Operating systems restrict access to security functions through the use of access control mechanisms and by implementing least privilege capabilities. Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges. Privileged functions include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals that do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users. Satisfies: SRG-OS-000134-GPOS-00068, SRG-OS-000080-GPOS-00048, SRG-OS-000259-GPOS-00100, SRG-OS-000324-GPOS-00125 | SV-223514r958518_rule | Determine all associated ACF2 security data sets and/or databases. If the ACF2 data set rules for ACF2 security data sets and/or databases restrict READ access to auditors and DASD batch, this is not a finding. If the ACF2 data set rules for ACF2 security data sets and/or databases restrict READ and/or greater access to z/OS systems programming personnel, security personnel, and/or batch jobs that perform ACP maintenance, this is not a finding. If all (i.e., failures and successes) data set access authorities (i.e., READ, WRITE, ALLOCATE, and CONTROL) for ACP security data sets and/or databases are logged, this is not a finding. |
| V-223554 | medium | SMF collection files (i.e., SYS1.MANx) access must be limited to appropriate users and/or batch jobs that perform SMF dump processing. | SMF data collection is the system activity journaling facility of the z/OS system. Unauthorized access could result in the compromise of logging and recording of the operating system environment, ACF2, and customer data. Unauthorized disclosure of audit records can reveal system and configuration data to attackers, thus compromising its confidentiality. Audit information includes all information (e.g., audit records, audit settings, audit reports) needed to successfully audit operating system activity. Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029, SRG-OS-000256-GPOS-00097, CCI-001494, SRG-OS-000257-GPOS-00098, SRG-OS-000258-GPOS-00099, SRG-OS-000080-GPOS-00048, SRG-OS-000206-GPOS-00084, SRG-OS-000324-GPOS-00125 | SV-223554r958434_rule | Refer to the SMFPRMxx member in SYS1.PARMLIB. Determine the SMF and/or Logstream data set name. If the following statements are true, this is not a finding. - The ACF2 data set rules for the SMF data collection files (e.g., SYS1.MAN* or IFASMF.SYS1.*) restrict ALLOCATE access to only z/OS systems programming personnel.
- The ACF2 data set rules for the SMF data collection files (e.g., SYS1.MAN* or IFASMF.SYS1.*) restrict WRITE access to z/OS systems programming personnel and/or batch jobs that perform SMF dump processing and others as approved by the ISSM.
- The ACF2 data set rules for the SMF data collection files (e.g., SYS1.MAN* or IFASMF.SYS1.*) restrict READ access to auditors and others approved by the ISSM.
- The ACF2 data set rules for SMF data collection files (e.g., SYS1.MAN* or IFASMF.SYS1.*) specify that all (i.e., failures and successes) WRITE and/or ALLOCATE access is logged. |
| | DFSMS resources must be protected in accordance with the proper security requirements. | DFSMS provides data, storage, program, and device management functions for the operating system. Some DFSMS storage administration functions allow a user to obtain a privileged status and effectively bypass all ACP data set and volume controls. Failure to properly protect DFSMS resources may result in unauthorized access. This exposure could compromise the availability and integrity of the operating system environment, system services, and customer data. | | Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(ZSMS0010)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ZSMS0010)
Ensure that all SMS resources and/or generic equivalent are properly protected according to the requirements specified. If the following guidance is true, this is not a finding.
___ The STGADMIN.** profile in the FACILITY resource class has a default access of NONE and no access is granted at this level.
___ STGADMIN.DPDSRN.olddsname is restricted to System Programmers and all access is logged.
___ The STGADMIN.IGD.ACTIVATE.CONFIGURATION is restricted to System Programmers and all access is logged.
___ The STGADMIN.IGG.DEFDEL.UALIAS is restricted to Centralized and Decentralized Security personnel and System Programmers and all access is logged.
___
To avoid authorization failures once a base cluster is accessed via a PATH or AIX by a user or application that has authority to the PATH and AIX, but not the base cluster, APAR OA50118 must be applied.
The resource STGADMIN.IGG.CATALOG.SECURITY.CHANGE is defined with access of NONE
The resource STGADMIN.IGG.CATALOG.SECURITY.BOTH is defined with access of READ
Note: the resource STGADMIN.IGG.CATALOG.SECURITY.CHANGE can be defined with read access for migration purposes. If it is, a detailed migration plan must be documented and filed by the ISSM that determines a definite migration period. All access must be logged. At the completion of migration this resource must be configured with access = NONE.
If the resource STGADMIN.IGG.CATALOG.SECURITY.CHANGE and STGADMIN.IGG.CATALOG.SECURITY.BOTH are both defined, STGADMIN.IGG.CATALOG.SECURITY.BOTH takes precedence.
___ The following resources and prefixes may be available to the end-user.
STGADMIN.ADR.COPY.CNCURRNT
STGADMIN.ADR.COPY.FLASHCPY
STGADMIN.ADR.COPY.TOLERATE.ENQF
STGADMIN.ADR.DUMP.CNCURRNT
STGADMIN.ADR.DUMP.TOLERATE.ENQF
STGADMIN.ADR.RESTORE.TOLERATE.ENQF
STGADMIN.ARC.ENDUSER.
STGADMIN.IGG.ALTER.SMS
___ The following resource is restricted to Application Production Support Team members, Automated Operations, DASD managers, and System programmers.
STGADMIN.IDC.DCOLLECT
___ The following resources are restricted to Application Production Support Team members, DASD managers, and System programmers.
STGADMIN.ARC.CANCEL
STGADMIN.ARC.LIST
STGADMIN.ARC.QUERY
STGADMIN.ARC.REPORT
STGADMIN.DMO.CONFIG
STGADMIN.IFG.READVTOC
STGADMIN.IGG.DELGDG.FORCE
___ The following resource prefixes, at a minimum, are restricted to DASD managers and System programmers.
STGADMIN.ADR
STGADMIN.ANT
STGADMIN.ARC
STGADMIN.DMO
STGADMIN.ICK
STGADMIN.IDC
STGADMIN.IFG
STGADMIN.IGG
STGADMIN.IGWSHCDS
___ The following Storage Administrator functions prefix is restricted to DASD managers and System programmers and all access is logged.
STGADMIN.ADR.STGADMIN.
___ The RACF resource access authorizations are defined with UACC(NONE) and NOWARNING. |
| | Dynamic lists must be protected in accordance with proper security requirements. | Dynamic lists provide a method of making z/OS system changes without interrupting the availability of the operating system. Failure to properly control access to these facilities could result in unauthorized personnel modifying sensitive z/OS lists. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data. | | Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(FACILITY)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ACP00270)
Verify that the accesses for CSV-prefixed resources are properly restricted. If the following guidance is true, this is not a finding.
___ The RACF resources and/or generic equivalent are defined with a default access of NONE.
___ The RACF resources and/or generic equivalent identified below will be defined with AUDIT(ALL(READ)) and UPDATE access restricted to system programming personnel:
CSVAPF.
CSVAPF.MVS.SETPROG.FORMAT.DYNAMIC
CSVAPF.MVS.SETPROG.FORMAT.STATIC
CSVDYLPA.
CSVDYNEX.
CSVDYNEX.LIST
CSVDYNL.
CSVDYNL.UPDATE.LNKLST
CSVLLA.
___ The RACF CSVDYNEX.LIST resource and/or generic equivalent will be defined with AUDIT(FAILURE(READ)SUCCESS(UPDATE)) and UPDATE access restricted to system programming personnel.
___ The RACF CSVDYNEX.LIST resource and/or generic equivalent will be defined with READ access restricted to auditors.
___ If the products CICS and/or CONTROL-O are on the system, the RACF access to the CSVLLA resource and/or generic equivalent will be defined with AUDIT(ALL) and UPDATE access restricted to the CICS and CONTROL-O STC userids.
___
___ If any software product requires access to dynamic LPA updates on the system, the RACF access to the CSVDYLPA resource and/or generic equivalent will be defined with LOG and SERVICE(UPDATE) only after the product has been validated with the appropriate STIG or SRG for compliance AND receives documented and filed authorization that details the need and any accepted risks from the site ISSM or equivalent security authority.
Note: In the above, UPDATE access can be substituted with ALTER or CONTROL. Review the permissions in the IBM documentation when specifying UPDATE. |
| | CICS region logonid(s) must be defined and/or controlled in accordance with the security requirements. | CICS is a transaction-processing product that provides programmers with the facilities to develop interactive applications. Improperly defined or controlled CICS region userids may provide an exposure and vulnerability within the CICS environment. This could result in the compromise of the confidentiality, integrity, and availability of the CICS region, applications, and customer data.
The region userid should be associated with a unique RACF userid. | | a) Refer to the following report produced by the z/OS Data Collection:
- EXAM.RPT(CICSPROC)
Refer to the following reports produced by the RACF Data Collection:
- RACFCMDS.RPT(LISTUSER)
- DSMON.RPT(RACCDT)
Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010.
b) Ensure that the following is defined for each CICS region:
1) A unique userid is defined.
2) Defined to the STARTED resource class.
c) If (b) is true, this is not a finding.
d) If (b) is untrue, this is a finding. |
| | Surrogate users must be controlled in accordance with proper security requirements. | Surrogate users have the ability to submit jobs on behalf of another user (the execution user) without specifying the execution user's password. Jobs submitted by surrogate users run with the identity of the execution user. Failure to properly control surrogate users could result in unauthorized personnel accessing sensitive resources. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data. | | Refer to the following report produced by the RACF Data Collection:
SENSITVE.RPT(SURROGAT)
If no executionuserid.SUBMIT resources are defined to the SURROGAT resource class, this is not applicable.
For each executionuserid.SUBMIT resource defined to the SURROGAT resource class, if the following items are in true regarding surrogate controls, this is not a finding.
___ All executionuserid.SUBMIT resources defined to the SURROGAT resource class specify a default access of NONE.
___ All resource access is logged; at the discretion of the ISSM/ISSO scheduling tasks may be exempted.
.
___ Access authorization is restricted to scheduling tools, started tasks or other system applications required for running production jobs.
___ Other users may have minimal access required for running production jobs with documentation properly approved and filed with the site security official (ISSM or equivalent). |
| | LNKAUTH=APFTAB is not specified in the IEASYSxx member(s) in the currently active parmlib data set(s). | Failure to specify LINKAUTH=APFTAB allows libraries other than those designated as APF to contain authorized modules which could bypass security and violate the integrity of the operating system environment. This expanded authorization list inhibits the ability to control inclusion of these modules. | | a) Refer to the following report produced by the z/OS Data Collection:
- EXAM.RPT(PARMLIB) - Refer to the IEASYSxx listing(s).
Automated Analysis
Refer to the following report produced by the z/OS Data Collection:
- PDI(AAMV0030)
b) If the LNKAUTH=APFTAB parameter is specified in the IEASYSxx member, there is NO FINDING.
c) If the LNKAUTH=APFTAB parameter is not specified, this is a FINDING. |
| | Inaccessible APF libraries defined. | If a library designated by an APF entry does not exist on the volume specified, a library of the same name may be placed on this volume and inherit APF authorization. This could allow the introduction of modules which bypass security and violate the integrity of the operating system environment. | | PDI Screen Sort Order: AAMV0040 Default Severity: Category III
a) Refer to the following reports produced by the z/OS Data Collection:
- PARMLIB.ACCESS(IEAAPFxx)
- PARMLIB.ACCESS(PROGxx)
NOTE: The IEAAPFxx and PROGxx reports are only produced if inaccessible libraries exist. The report names represent the actual SYS1.PARMLIB members where inaccessible libraries are found. If these reports do not exist, there is NO FINDING.
Automated Analysis
Refer to the following report produced by the z/OS Data Collection:
- PDI(AAMV0040)
b) If no inaccessible APF libraries exist, there is NO FINDING.
c) If inaccessible APF libraries do exist, this is a FINDING. |
| | Duplicated sensitive utilities and/or programs exist in APF libraries. | Modules designated as sensitive utilities have the ability to significantly modify the operating system environment. Duplication of these modules causes an exposure by making it extremely difficult to track modifications to them. This could allow for the execution of invalid or trojan horse versions of these utilities. | | a) Refer to the following report produced by the z/OS Data Collection:
- EXAM.RPT(APFDUPS)
Automated Analysis
Refer to the following report produced by the z/OS Data Collection:
- PDI(AAMV0050)
b) If duplicate APF modules exist, compare the duplicates to the modules specified below:
The following list contains Sensitive Utilities that will be checked.
AHLGTF AMASPZAP AMAZAP AMDIOCP AMZIOCP
BLSROPTR CSQJU003 CSQJU004 CSQUCVX CSQUTIL
CSQ1LOGP DEBE DITTO FDRZAPOP GIMSMP
HHLGTF ICKDSF ICPIOCP IDCSC01 IEHINITT
IFASMFDP IGWSPZAP IHLGTF IMASPZAP IND$FILE
IOPIOCP IXPIOCP IYPIOCP IZPIOCP WHOIS
L052INIT TMSCOPY TMSFORMT TMSLBLPR TMSMULV
TMSREMOV TMSTPNIT TMSUDSNB
c) If none of the sensitive utilities are duplicated, there is NO FINDING.
d) If any of the sensitive utilities is duplicated, this is a FINDING. |
| | Inapplicable PPT entries have not been invalidated. | If invalid or inapplicable PPT entries exist, a venue is provided for the introduction of trojan horse modules with security bypass capabilities. | | a) Refer to the following report produced by the z/OS Data Collection:
- EXAM.RPT(PPTXRPT)
Automated Analysis
Refer to the following report produced by the z/OS Data Collection:
- PDI(AAMV0160)
b) Review the program entries in the CA-EXAMINE PPT LIBRARY SEARCH report. For all programs not found on the operating system (i.e., missing link date, size, volume, and library name), review their corresponding entries in the CA-EXAMINE PROGRAM PROPERTIES TABLE ANALYSIS report. If a program entry is found with any of the following excessive privileges, ensure that a matching SCHEDxx entry exists for that program revoking these privileges:
1) Data set integrity bypass
2) Keys 0-7
3) Security bypass
c) If a SCHEDxx entry exists for all applicable PPT programs revoking the excessive privileges above, there is NO FINDING.
d) If a SCHEDxx entry does not exist for an applicable PPT program, or does not revoke all the excessive privileges above, this is a FINDING.
Note: Modules for products not in use on the system will have their special privileges explicitly revoked. |
| | Non-existent or inaccessible LINKLIST libraries. | LINKLIST libraries give a common access point for the general usage of modules. Many of the subsystems installed on a domain rely upon these modules for proper execution. If the list of libraries found in this LINKLIST is not properly maintained, the integrity of the operating environment is subject to compromise. | | a) Refer to the following report produced by the z/OS Data Collection:
- PARMLIB.ACCESS(LNKLSTxx)
NOTE: The LNKLSTxx reports are only produced if inaccessible libraries exist. The report names represent the actual SYS1.PARMLIB members where inaccessible libraries are found. If these reports do not exist, there is NO FINDING.
Automated Analysis
Refer to the following report produced by the z/OS Data Collection:
- PDI(AAMV0350)
b) If no inaccessible LINKLIST libraries exist, there is NO FINDING.
c) If any inaccessible LINKLIST library exists, this is a FINDING. |
| | Non-standard SMF data collection options specified. | SMF data collection is the basic unit of tracking of all system functions and actions. Included in this tracking data are the audit trails from each of the ACPs. If the control options for the recording of this tracking are not properly maintained, then accountability cannot be monitored, and its use in the execution of a contingency plan could be compromised. | | Refer to the following reports produced by the z/OS Data Collection:
- EXAM.RPT(SMFOPTS)
- EXAM.RPT(PARMLIB) - Alternate report; refer to the SMFPRMxx listing.
Automated Analysis
Refer to the following report produced by the z/OS Data Collection:
- PDI(AAMV0370)
NOTE: Issues with subtype 4 and 5 of type 30 records can be exempted from collection. The following is an example of the entry to perform this:
SUBSYS(STC,EXITS(IEFU29,IEFU83,IEFU84,IEFUJP,IEFUSO),
INTERVAL(SMF,SYNC),NODETAIL)
NOTE: If the JWT parameter is greater than 15 minutes, and the system is processing unclassified information, review the following items. If any of these items is true, there is NO FINDING.
1) If a session is not terminated, but instead is locked out after 15 minutes of inactivity, a process must be in place that requires user identification and authentication before the session is unlocked. Session lock-out will be implemented through system controls or terminal screen protections.
2) A system's default time for terminal lock-out or session termination may be lengthened to 30 minutes at the discretion of the IAM or IAO. The IAM and/or IAO will maintain the documentation for each system with a time-out adjusted beyond the 15-minute recommendation to explain the basis for this decision.
3) The IAM and/or IAO may set selected userids to have a time-out of up to 60 minutes in order to complete critical reports or transactions without timing out. Each exception must meet the following criteria:
(a) The time-out exception cannot exceed 60 minutes.
(b) A letter of justification fully documenting the user requirement(s) must be submitted and approved by the site IAM or IAO. In addition, this letter must identify an alternate means of access control for the terminal(s) involved (e.g., a room that is locked at all times, a room with a cipher lock to limit access, a password protected screen saver set to 30 minutes or less, etc.).
(c) The requirement must be revalidated on an annual basis.
Ensure SMF collection options are specified as stated below with exception of those specified in the above NOTEs. The settings for several parameters are critical to the collection process:
ACTIVE Activates the collection of SMF data.
JWT(15) The maximum amount of consecutive time that an executing job may spend as ineligible to use any CPU resources before being canceled for inactivity. (This may be extended if controlled through other means, e.g., a Session Manager or ACP.)
MAXDORM(0500) Specifies the amount of real time that SMF allows data to remain in an SMF buffer before it is written to a recording data set.
SID Specifies the system ID to be recorded in all SMF records
SYS(DETAIL) Controls the level of detail recorded.
SYS(INTERVAL) Ensures the periodic recording of data for long running jobs.
SYS Specifies the types and sub types of SMF records that are to be collected. SYS(TYPE) indicates that the supplied list is inclusive (i.e., specifies the record types to be collected). Record types not listed are not collected. SYS(NOTYPE) indicates that the supplied list is exclusive (i.e., specifies those record types not to be collected). Record types listed are not collected. The site may use either form of this parameter to specify SMF record type collection. However, at a minimum all record types listed. |
| | Required SMF data record types must be collected. | SMF data collection is the basic unit of tracking of all system functions and actions. Included in this tracking data are the audit records from each of the ACPs and system. If the required SMF data record types are not being collected, then accountability cannot be monitored, and its use in the execution of a contingency plan could be compromised. | | Refer to the following reports produced by the z/OS Data Collection: - EXAM.RPT(SMFOPTS) - EXAM.RPT(PARMLIB) - Alternate report; refer to the SMFPRMxx listing. Automated Analysis Refer to the following report produced by the z/OS Data Collection: - PDI(AAMV0380) If all of the required SMF record types identified below are collected, this is not a finding. IBM SMF Records to be collected at a minimum: 0 (00) – IPL 6 (06) – External Writer/ JES Output Writer/ Print Services Facility (PSF) 7 (07) – [SMF] Data Lost 14 (0E) – INPUT or RDBACK Data Set Activity 15 (0F) – OUTPUT, UPDAT, INOUT, or OUTIN Data Set Activity 17 (11) – Scratch Data Set Status 18 (12) – Rename Non-VSAM Data Set Status 24 (18) – JES2 Spool Offload 25 (19) – JES3 Device Allocation 26 (1A) – JES Job Purge 30 (1E) – Common Address Space Work 32 (20) – TSO/E User Work Accounting 41 (29) – DIV Objects and VLF Statistics 42 (2A) – DFSMS statistics and configuration 43 (2B) – JES Start 45 (2D) – JES Withdrawal/Stop 47 (2F) – JES SIGNON/Start Line (BSC)/LOGON 48 (30) – JES SIGNOFF/Stop Line (BSC)/LOGOFF 49 (31) – JES Integrity 52 (34) – JES2 LOGON/Start Line (SNA) 53 (35) – JES2 LOGOFF/Stop Line (SNA) 54 (36) – JES2 Integrity (SNA) 55 (37) – JES2 Network SIGNON 56 (38) – JES2 Network Integrity 57 (39) – JES2 Network SYSOUT Transmission 58 (3A) – JES2 Network SIGNOFF 60 (3C) – VSAM Volume Data Set Updated 61 (3D) – Integrated Catalog Facility Define Activity 62 (3E) – VSAM Component or Cluster Opened 64 (40) – VSAM Component or Cluster Status 65 (41) – Integrated Catalog Facility Delete Activity 66 (42) – Integrated Catalog Facility Alter Activity 80 (50) – RACF/TOP SECRET Processing 81 (51) – RACF Initialization 82 (52) – ICSF Statistics 83 (53) – RACF Audit Record For Data Sets 90 (5A) – System Status 92 (5C) except subtypes 10, 11 – OpenMVS File System Activity 102 (66) – DATABASE 2 Performance 103 (67) – IBM HTTP Server 110 (6E) – CICS/ESA Statistics 118 (76) – TCP/IP Statistics 119 (77) – TCP/IP Statistics 199 (C7) – TSOMON 230 (E6) – ACF2 or as specified in ACFFDR (vendor-supplied default is 230) 231 (E7) – TSS logs security events under this record type |
| | ACP database is not on a separate physical volume from its backup and recovery datasets. | The ACP backup and recovery data files provide the only means of recovering the ACP database in the event of its damage. In the case where this damage is to the physical volume on which it resides, and any of these recovery data files exist on this volume as well, then complete recovery of the ACP database would be extremely difficult, if even possible. | | a) Refer to the following item gathered from the z/OS Data Collection:
- Step 8 (c)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(AAMV0410)
For RACF sites only, refer to the following report produced by the RACF Data Collection:
- DSMON.RPT(RACDST)
For ACF2 sites only, refer to the following report produced by the ACF2 Data Collection:
- ACF2CMDS.RPT(ACFBKUP)
For TSS sites only, refer to the following report produced by the z/OS Data Collection, review procedure library member TSS for information:
- EXAM.RPT(PROCLIBS)
b) If the Access Control Product (ACP) database is not located on the same volume as either its alternate or backup file, there is NO FINDING.
c) If the ACP database is collocated with either it's alternate or backup, this is a FINDING. |
| | PASSWORD data set and OS passwords are utilized. | All protection of system resources must come from the ACP. If multiple protection mechanisms are in place, the accessibility of data, specifically under contingency plan execution, is subject to compromise. | | a) Refer to the following report produced by the z/OS Data Collection:
- EXAM.RPT(PASSWORD)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(AAMV0440)
b) If, based on the information provided, it can be determined that the system PASSWORD data set and OS passwords are not used, there is NO FINDING.
c) If it is evident that OS passwords are utilized, this is a FINDING. |
| | SYS1.PARMLIB is not limited to only system programmers. | SYS1.PARMLIB contains the parameters which control system IPL, configuration characteristics, security facilities, and performance. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data. | | a) Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(PARMRPT)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ACP00010)
___ The ACP data set rules for SYS1.PARMLIB allow inappropriate (e.g., global READ) access.
___ The ACP data set rules for SYS1.PARMLIB do not restrict READ, UPDATE and ALTER access to only systems programming personnel.
___ The ACP data set rules for SYS1.PARMLIB do not restrict READ and UPDATE access to only domain level security administrators.
___ The ACP data set rules for SYS1.PARMLIB do not restrict READ access to only system Level Started Tasks, authorized Data Center personnel, and auditors.
___ The ACP data set rules for SYS1.PARMLIB do not specify that all (i.e., failures and successes) UPDATE and/or ALTER access will be logged.
b) If all of the above are untrue, there is NO FINDING.
c) If any of the above is true, this is a FINDING. |
| | Access to SYS1.LINKLIB is not properly protected. | This data set is automatically APF-authorized, contains system SVCs and the base PPT. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data. | | a) Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(LINKRPT)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ACP00020)
___ The ACP data set rules for SYS1.LINKLIB allow inappropriate access.
___ The ACP data set rules for SYS1.LINKLIB do not restrict UPDATE and/or ALTER access to only z/OS systems programming personnel.
___ The ACP data set rules for SYS1.LINKLIB do not specify that all (i.e., failures and successes) UPDATE and/or ALTER access will be logged, this is a FINDING.
b) If all of the above are untrue, there is NO FINDING.
c) If any of the above is true, this is a FINDING. |
| | Write or greater access to SYS1.SVCLIB must be limited to system programmers only. | This data set is automatically APF-authorized, contains system SVCs, and may also contain I/O appendages. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data. | | Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(SVCRPT)
Automated Analysis
Review the following report produced by the Data Set and Resource Data Collection:
- PDI(ACP00030)
___ Ensure that the ACP data set rules for SYS1.SVCLIB are limited to only appropriate authorized access.
___ Ensure that the ACP data set rules for SYS1.SVCLIB restrict UPDATE and/or ALTER access to only z/OS systems programming personnel.
___ Ensure that the ACP data set rules for SYS1.SVCLIB specify that all (i.e., failures and successes) UPDATE and/or ALTER access will be logged. |
| | Write or greater access to SYS1.IMAGELIB must be limited to system programmers only. | SYS1.IMAGELIB is a partitioned data set containing universal character set (UCS), forms control buffer (FCB), and printer control information. Most IBM standard UCS images are included in SYS1.IMAGELIB during system installation. This data set should be protected as a z/OS system data set. | | Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(IMAGERPT)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection.
- PDI(ACP00040)
If the following guidance is true, this is not a finding.
___ The ACP data set rules for SYS1.IMAGELIB allow inappropriate access.
___ The ACP data set rules for SYS1.IMAGELIB do not restrict UPDATE and/or ALTER access to only systems programming personnel.
___ The ACP data set rules for SYS1.IMAGELIB do not specify that all (i.e., failures and successes) UPDATE and/or ALTER access will be logged. |
| | Write or greater access to SYS1.LPALIB must be limited to system programmers only. | SYS1.LPALIB is automatically APF-authorized during IPL processing and can contain SVCs. LPA modules, once loaded into the Link Pack Area, are capable of performing APF-authorized functions. This authorization allows a program to bypass various levels of security checking. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data. | | a) Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(LPARPT)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ACP00050)
___ The ACP data set rules for SYS1.LPALIB allow inappropriate access.
___ The ACP data set rules for SYS1.LPALIB do not restrict UPDATE and/or ALTER access to only z/OS systems programming personnel.
___ The ACP data set rules for SYS1.LPALIB do not specify that all (i.e., failures and successes) UPDATE and/or ALTER access will be logged.
b) If all of the above are untrue, there is NO FINDING.
c) If any of the above is true, this is a FINDING. |
| | Update and allocate access to all APF -authorized libraries are not limited to system programmers only. | The Authorized Program List designates those libraries that can contain program modules which possess a significant level of security bypass capability. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data. | | a) Refer to the following reports produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(APFXRPT)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ACP00060)
___ The ACP data set rules for APF libraries allow inappropriate access.
___ The ACP data set rules for APF libraries do not restrict UPDATE and/or ALTER access to only z/OS systems programming personnel.
___ The ACP data set rules for APF libraries do not specify that all (i.e., failures and successes) UPDATE and/or ALTER access will be logged.
b) If all of the above are untrue, there is NO FINDING.
c) If any of the above is true, this is a FINDING. |
| | Write or greater access to all LPA libraries must be limited to system programmers only. | LPA modules, once loaded into the Link Pack Area, are capable of performing APF-authorized functions. This authorization allows a program to bypass various levels of security checking. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data. | | a) Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(LPAXRPT)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ACP00070)
___ The ACP data set rules for LPA libraries allow inappropriate access.
___ The ACP data set rules for LPA libraries do not restrict UPDATE and/or ALTER access to only z/OS systems programming personnel.
___ The ACP data set rules for LPA libraries do not specify that all (i.e., failures and successes) UPDATE and/or ALTER access will be logged.
b) If all of the above are untrue, there is NO FINDING.
c) If any of the above is true, this is a FINDING. |
| | Write or greater access to SYS1.NUCLEUS must be limited to system programmers only. | This data set contains a large portion of the system initialization (IPL) programs and pointers to the master and alternate master catalog. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data. | | a) Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(NUCLRPT)
Automated Analysis
Refer to the following report produced by the a Data Set and Resource Data Collection:
- PDI(ACP00080)
___ The ACP data set rules for SYS1.NUCLEUS allow inappropriate access.
___ The ACP data set rules for SYS1.NUCLEUS do not restrict UPDATE and/or ALTER access to only z/OS systems programming personnel.
___ The ACP data set rules for SYS1.NUCLEUS do not specify that all (i.e., failures and successes) UPDATE and/or ALTER access will be logged.
b) If all of the above are untrue, there is NO FINDING.
c) If any of the above is true, this is a FINDING. |
| | Write or greater access to libraries that contain PPT modules must be limited to system programmers only. | Specific PPT designated program modules possess significant security bypass capabilities. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data. | | a) Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(PPTXRPT)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ACP00100)
___ The ACP data set rules for libraries that contain PPT modules allow inappropriate access.
___ The ACP data set rules for libraries that contain PPT modules do not restrict UPDATE and ALLOCATE access to only z/OS systems programming personnel.
___ The ACP data set rules for libraries that contain PPT modules do not specify that all UPDATE and ALLOCATE access will be logged.
b) If all of the above are untrue, there is NO FINDING.
c) If any of the above is true, this is a FINDING. |
| | Update and allocate access to LINKLIST libraries are not limited to system programmers only. | The primary function of the LINKLIST is to serve as a single repository for commonly used system modules. Failure to ensure that the proper set of libraries are designated for LINKLIST can impact system integrity, performance, and functionality. For this reason, controls must be employed to ensure that the correct set of LINKLIST libraries are used. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data. | | a) Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(LNKXRPT)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ACP00110)
___ The ACP data set rules for LINKLIST libraries allow inappropriate access.
___ The ACP data set rules for LINKLIST libraries do not restrict UPDATE and/or ALTER access to only z/OS systems programming personnel.
___ The ACP data set rules for LINKLIST libraries do not specify that all (i.e., failures and successes) UPDATE and/or ALTER access will be logged.
Note: Any DoD AIS Loadlibs defined to LINKLIST within z/OS Domains will be listed after all system libraraies and will be removed on the test for access to systems programmers in the SRRAUDT check.
b) If all of the above are untrue, there is NO FINDING.
c) If any of the above is true, this is a FINDING. |
| | The ACP security data sets and/or databases must be properly protected. | The Access Control Program (ACP) database files contain all access control information for the operating system environment and system resources. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data. | | Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(ACPRPT)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ACP00120)
Verify that the accesses to the ACP security data sets and/or databases are properly restricted. If the following guidance is true, this is not a finding.
___ The ACP data set rules for ACP security data sets and/or databases restrict READ access to auditors and DASD batch.
___ The ACP data set rules for ACP security data sets and/or databases restrict READ and/or greater access to z/OS systems programming personnel, security personnel, and/or batch jobs that perform ACP maintenance.
___ All (i.e., failures and successes) data set access authorities (i.e. READ, UPDATE, ALTER, and CONTROL) for ACP security data sets and/or databases are logged. |
| | Access greater than Read to the System Master Catalog must be limited to system programmers only. | System catalogs are the basis for locating all files on the system. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data. | | a) Refer to the following reports produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(CATMRPT) - Master Catalog
Automated Analysis:
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ACP00130)
If data set rules for System catalogs allow inappropriate access, this is a finding.
If data set rules for the Master Catalog do not restrict greater than "READ" access to only z/OS systems programming personnel, this is a finding.
Access greater than "READ" for the Master catalog is allowed to a batch job ID in the following specific case:
The batch job must reside in a data set that is restricted to systems programmers only.
If dataset rules for the Master Catalog do not specify that all (i.e., failures and successes) greater than "READ" access will be logged, this is a finding. |
| | Update and allocate access to all system-level product installation libraries are not limited to system programmers only. | System-level product installation libraries constitute the majority of the systems software libraries. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data. Configure CustomDsnType to define a custom DSN type for the sens (sensitive data sets) table. | | a) Refer to the following reports produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(SMPERPT)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ACP00140)
Have the systems programmer for z/OS supply the following information:
- The data set name and associated SREL for each SMP/E CSI utilized to maintain this system.
- The data set name of all SMP/E TLIBs and DLIBs used for installation and production support. A comprehensive list of the SMP/E DDDEFs for all CSIs may be used if valid.
___ The ACP data set rules for system-level product installation libraries (e.g., SMP/E CSIs) allow inappropriate access.
___ The ACP data set rules for system-level product installation libraries (e.g., SMP/E CSIs) do not restrict UPDATE and/or ALTER access to only z/OS systems programming personnel.
b) If all of the above are untrue, there is NO FINDING.
c) If any of the above is true, or if these data sets cannot be identified due to a lack of requested information, this is a FINDING. |
| | Update and allocate access to the JES2 System data sets (e.g., Spool, Checkpoint, and Initialization parameters) are not limited to system programmers only. | The JES2 System data sets are a common repository for all jobs submitted to the system and the associated printout and configuration of the JES2 environment. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data. | | a) Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(JES2RPT)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ACP00150)
___ The ACP data set rules for the JES2 System data sets (e.g., Spool, Checkpoint, and Initialization parameters) allow inappropriate access.
___ The ACP data set rules for the JES2 System data sets (e.g., Spool, Checkpoint, and Initialization parameters) do not restrict UPDATE and/or ALTER access to only z/OS systems programming personnel.
b) If both of the above are untrue, there is NO FINDING.
c) If either of the above is true, this is a FINDING. |
| | Write or greater access to SYS1.UADS must be limited to system programmers only and read and update access must be limited to system programmer personnel and/or security personnel. | SYS1.UADS is the data set where emergency USERIDs are maintained. This ensures that logon processing can occur even if the ACP is not functional. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data. | | a) Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(UADSRPT)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ACP00170)
___ The ACP data set rules for SYS1.UADS allow inappropriate access.
___ The ACP data set rules for SYS1.UADS do not restrict ALTER access to only z/OS systems programming personnel.
___ The ACP data set rules for SYS1.UADS do not restrict READ and/or UPDATE access to z/OS systems programming personnel and/or security personnel.
___ The ACP data set rules for SYS1.UADS do not specify that all (i.e., failures and successes) data set access authorities (i.e., READ, UPDATE, ALTER, and CONTROL) will be logged.
b) If all of the above are untrue, there is NO FINDING.
c) If any of the above is true, this is a FINDING. |
| | Update and allocate access to SMF collection files (i.e., SYS1.MANx) are not limited to system programmers and/or batch jobs that perform SMF dump processing. | SMF data collection is the system activity journaling facility of the z/OS system. With the proper parameter designations it serves as the basis to ensure individual user accountability. SMF data is the primary source for cost charge back in DISA. Unauthorized access could result in the compromise of logging and recording of the operating system environment, ACP, and customer data. | | a) Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(SMFXRPT)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ACP00180)
___ The ACP data set rules for the SMF data collection files (e.g., SYS1.MAN*) allow inappropriate access.
___ The ACP data set rules for the SMF data collection files (e.g., SYS1.MAN*) do not restrict ALTER access to only z/OS systems programming personnel.
___ The ACP data set rules for the SMF data collection files (e.g., SYS1.MAN*) do not restrict UPDATE access to z/OS systems programming personnel, and/or batch jobs that perform SMF dump processing.
___ The ACP data set rules for SMF data collection files (e.g., SYS1.MAN*) do not specify that all (i.e., failures and successes) UPDATE and/or ALTER access will be logged.
b) If all of the above are untrue, there is NO FINDING.
c) If any of the above is true, this is a FINDING. |
| | Update and allocate access to data sets used to backup and/or dump SMF collection files are not limited to system programmers and/or batch jobs that perform SMF dump processing. | SMF backup data sets are those data sets to which SMF data has been offloaded in order to ensure a historical tracking of individual user accountability. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data. | | a) Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(SMFBKRPT)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ACP00190)
Have the systems programmer supply the procedures and collection specifics for SMF datasets and backup.
___ The ACP data set rules for the SMF dump/backup files allow inappropriate access.
___ The ACP data set rules for the SMF dump/backup files do not restrict UPDATE and/or ALTER access to authorized DISA and site personnel (e.g., systems programmers and batch jobs that perform SMF processing).
___ The ACP data set rules for SMF dump/backup files do not specify that all (i.e., failures and successes) UPDATE and/or ALTER access will be logged.
b) If all of the above are untrue, there is NO FINDING.
c) If any of the above is true, or if these data sets cannot be identified due to a lack of requested information, this is a FINDING. |
| | Access to SYSTEM DUMP data sets are not limited to system programmers only. | System DUMP data sets are used to record system data areas and virtual storage associated with system task failures. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data. | | a) Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(DUMPRPT)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ACP00200)
___ The ACP data set rules for System Dump data sets allow inappropriate access.
___ The ACP data set rules for System Dump data sets do not restrict READ, UPDATE and/or ALTER access to only systems programming personnel.
___ The ACP data set rules for all System Dump data sets do not restrict READ access to personnel having justification to review these dump data sets for debugging proposes.
b) If all of the above are untrue, there is NO FINDING.
c) If any of the above is true, this is a FINDING.
The dump data sets displayed by the DD command along with the dump datasets specified in the DUMPSRV routine are to be restricted to system programmers unless unless a letter justifying access is filed with the IAO. |
| | Update and allocate access to System backup files are not limited to system programmers and/or batch jobs that perform DASD backups. | System backup data sets are necessary for recovery of DASD resident data sets. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data. Configure CustomDsnType to define a custom DSN type for the sens (sensitive data sets) table. | | a) Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(BKUPRPT)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ACP00210)
Collect from the storage management group the identification of the DASD backup files and all associated storage management userids/LIDs/ACIDs.
___ The ACP data set rules for system DASD backup files allow inappropriate access.
___ The ACP data set rules for system DASD backup files do not restrict UPDATE and ALLOCATE access to z/OS systems programming and/or batch jobs that perform DASD backups.
b) If both of the above are untrue, there is NO FINDING.
c) If either of the above is true, or if these data sets cannot be identified due to a lack of requested information, this is a FINDING. |
| | Access to SYS(x).TRACE is not limited to system programmers only. | SYS1.TRACE is used to trace and debug system problems. Unauthorized access could result in a compromise of the integrity and availability of all system data and processes. | | a) Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(TRACERPT)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ACP00220)
___ The ACP data set rule for SYS1.TRACE allows inappropriate access.
___ The ACP data set rule for SYS1.TRACE does not restrict access to systems programming personnel and started tasks that perform GTF processing.
b) If both of the above are untrue, there is NO FINDING.
c) If either of the above is true, this is a FINDING. |
| | Access to System page data sets (i.e., PLPA, COMMON, and LOCALx) are not limited to system programmers. | Page data sets hold individual pages of virtual storage when they are paged out of real storage. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data. | | a) Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(PGXXRPT)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ACP00230)
___ The ACP data set rules for system page data sets (PLPA, COMMON, and LOCAL) allow inappropriate access.
___ The ACP data set rules for system page data sets (PLPA, COMMON, and LOCAL) do not restrict access to only systems programming personnel.
b) If both of the above are untrue, there is NO FINDING.
c) If either of the above is true, this is a FINDING |
| | Write or greater access to Libraries containing EXIT modules must be limited to system programmers only. | System exits have a wide range of uses and capabilities within any system. Exits may introduce security exposures within the system, modify audit trails, and alter individual user capabilities. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data. | | a) Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(MVSXRPT)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ACP00240)
___ The ACP data set rules for libraries that contain exit modules allow inappropriate access.
___ The ACP data set rules for libraries that contain system exit modules do not restrict UPDATE and ALLOCATE access to only z/OS systems programming personnel.
___ The ACP data set rules for libraries that contain exit modules do not specify that all UPDATE and ALLOCATE access will be logged.
b) If all of the above are untrue, there is NO FINDING.
c) If any of the above is true, this is a FINDING. |
| | Memory and privileged program dumps must be protected in accordance with proper security requirements. | Access to memory and privileged program dumps running Trusted Control Block (TCB) key 0-7 may hold passwords, encryption keys, or other sensitive data that must not be made available. Failure to properly control access to these facilities could result in unauthorized personnel modifying sensitive z/OS lists. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data. | | From a command input screen enter:
RLIST FACILITY (IEAABD. IEAABD.DMPAUTH IEAABD.DMPAKEY) ALL
Alternately, this can be viewed by following steps:
Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(ACP00260)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ACP00260)
Ensure that the Memory and privileged program dumps resources are properly protected as stated below. If all of the following guidance is true, this is not a finding.
___ Ensure that the IEAABD. resource and/or generic equivalent is defined and all access is logged. Access will not be given to any user.
___ Ensure that IEAABD.DMPAUTH. resource and/or generic equivalent is defined and READ access is limited to authorized users.
___ Ensure that IEAABD.DMPAUTH. resource and/or generic equivalent UPDATE or greater access is restricted to only systems personnel and all access is logged.
___ Ensure that IEAABD.DMPAKEY resources and/or generic equivalent is defined and all access is restricted to systems personnel and that all access is logged.
___ Ensure that resource rules for the above resources and/or generic equivalent specify UACC(NONE) and NOWARNING. |
| | LOGONIDs must not be defined to SYS1.UADS for non-emergency use. | SYS1.UADS is a dataset where LOGONIDs will be maintained with applicable password information when the ACP is not functional. If an unauthorized user has access to SYS1.UADS, they could enter their LOGONID and password into the SYS1.UADS dataset and could give themselves all special attributes on the system. This could enable the user to bypass all security and alter data. They could modify the audit trail information so no trace of their activity could be found. | | a) Refer to the following report produced by the z/OS Data Collection:
- EXAM.RPT(TSOUADS)
Please provide a list of all emergency userids available to the site along with the associated function of each.
b) If SYS1.UADS userids are limited and reserved for emergency purposes only, there is NO FINDING.
c) If any SYS1.UADS userids are assigned for other than emergency purposes, this is a FINDING. |
| | All system PROCLIB data sets must be limited to system programmers only | Unauthorized access to PROCLIB data sets referenced in the JES2 procedure can allow unauthorized modifications to STCs and other system level procedures. This could result in the compromise of the operating system environment, ACP, and customer data. | | Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(PROCRPT)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ACP00250)
Refer to the following for the PROCLIB data sets that contain the STCs and TSO logons from the following sources:
- MSTJCLxx member used during an IPL. The PROCLIB data sets are obtained from the IEFPDSI and IEFJOBS DD statements.
- PROCxx DD statements and JES2 Dynamic PROCLIBs. Where 'x' is the PROCLIB entries for the STC and TSU JOBCLASS configuration definitions.
Verify that the accesses to the above PROCLIB data sets are properly restricted. If the following guidance is true, this is not a finding.
___ The ACP data set access authorizations restrict READ access to all authorized users.
___ The ACP data set access authorizations restrict WRITE and/or greater access to systems programming personnel. |
| | Sensitive CICS transactions are not protected in accordance with security requirements. | Sensitive CICS transactions offer the ability to circumvent transaction level controls for accessing resources under CICS. These transactions must be protected so that only authorized users can access them. Unauthorized use can result in the compromise of the confidentiality, integrity, and availability of the operating system or customer data. | | a) Refer to the following reports produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(TCICSTRN)
- SENSITVE.RPT(GCICSTRN)
NOTE: If a CICS region is using a site-defined transaction resource class pair, execute a RACF RLIST command against these resource classes.
Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010.
b) Ensure the following items are in effect for all CICS regions:
1) Transactions listed in tables CICS CATEGORY 2 CICS AND OTHER PRODUCT TRANSACTIONS and CICS CATEGORY 4 COTS-SUPPLIED SENSITIVE TRANSACTIONS, in the z/OS STIG Addendum, are restricted to authorized personnel.
Note: The exception to this is the CEOT and CSGM transactions, which can be made available to all users.
Note: The exception to this is the CWBA transaction, can be made available to the CICS Default user.
Note: The transactions beginning with "CK" apply to regions running WebSphere MQ.
Note: Category 1 transactions are internally restricted to CICS region userids.
c) If the items mentioned in (b) are true for all CICS transaction resource classes, there is NO FINDING.
d) If any item mentioned in (b) is untrue for a CICS transaction resource class, this is a FINDING. |
| | The Automatic Data Set Protection (ADSP) SETROPTS value is not set to NOADSP. | (RACF0250: CAT II) ADSP indicates that RACF automatically creates discrete data set profiles to protect datasets created by users having this attribute.
ADSP specifies that data sets created by users who have the ADSP attribute will be RACF protected automatically. NOADSP cancels automatic RACF protection for users who have ADSP.
The system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation. | | a) Refer to the following report produced by the RACF Data Collection:
- RACFCMDS.RPT(SETROPTS)
Automated Analysis
Refer to the following report produced by the RACF Data Collection:
- PDI(RACF0250)
b) If the ADSP value is NOT IN EFFECT, there is NO FINDING.
Note: NOADSP is the required setting. In the SETROPTS LIST output this will display as AUTOMATIC DATASET PROTECTION IS NOT IN EFFECT.
c) If the ADSP value is IN EFFECT, this is a FINDING. |
| | The AUDIT SETROPTS value is improperly set. | (RACF0260: CAT II) AUDIT specifies the names of the classes for which you want RACF to perform auditing. For the classes that you specify, RACF logs all uses of the RACDEF SVC and all changes made to profiles by RACF commands. NOAUDIT cancels auditing.
The system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation. | | a) Refer to the following report produced by the RACF Data Collection:
- RACFCMDS.RPT(SETROPTS)
Automated Analysis
Refer to the following report produced by the RACF Data Collection:
- PDI(RACF0260)
b) If all ACTIVE classes are also listed under the AUDIT classes, there is NO FINDING.
Note: All Classes must be enabled for AUDITing.
c) If there are ACTIVE classes that are not specified in the AUDIT classes, this is a FINDING. |
| | The CLASSACT SETROPTS must be specified for the TEMPDSN Class. | CLASSACT specifies those classes defined by entries in the class descriptor table for which RACF checking is to be ACTIVE. DATASET, USER, and GROUP are active by default and cannot be activated or deactivated.
The system-wide options control the default settings for determining how the Access Control Program (ACP) will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation. | | Refer to the following report produced by the RACF Data Collection:
- RACFCMDS.RPT(SETROPTS)
Automated Analysis
Refer to the following report produced by the RACF Data Collection:
- PDI(RACF0270)
If the TEMPDSN resource class is ACTIVE, this is not a finding.
Note: At minimum, the TEMPDSN class should be ACTIVE. |
| | The CMDVIOL SETROPTS value is not set to CMDVIOL. | (RACF0280: CAT II) The CMDVIOL specifies whether RACF is to log violations detected by RACF commands. You must have the auditor attribute to specify these commands. A violation may occur because a user is not authorized to modify a particular profile, or is not authorized to enter a particular operand on a command.
The system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation. | | a) Refer to the following report produced by the RACF Data Collection:
- RACFCMDS.RPT(SETROPTS)
Automated Analysis
Refer to the following report produced by the RACF Data Collection:
- PDI(RACF0280)
b) If the CMDVIOL value is listed as one of the ATTRIBUTES, there is NO FINDING.
c) If the CMDVIOL value is not listed as one of the ATTRIBUTES, this is a FINDING. |
| | The EGN SETROPTS value specified is not set to EGN. | (RACF0290: CAT II) EGN changes the meaning of the signle generic character *. The system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation. | | a) Refer to the following report produced by the RACF Data Collection:
- RACFCMDS.RPT(SETROPTS)
Automated Analysis
Refer to the following report produced by the RACF Data Collection:
- PDI(RACF0290)
b) If the EGN (ENHANCED GENERIC NAMING) IS IN EFFECT, there is NO FINDING.
c) If the EGN (ENHANCED GENERIC NAMING) IS NOT IN EFFECT, this is a FINDING. |
| | The ERASE ALL SETROPTS value must be set to ERASE(ALL) on all systems. | The ERASE ALL specifies that data management is to erase all scratched data sets including temporary data sets. NOERASE specifies that no DASD data sets are erased when deleted.
The system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation. | | Refer to the following report produced by the RACF Data Collection:
- RACFCMDS.RPT(SETROPTS)
Automated Analysis requires Additional Analysis.
Refer to the following report produced by the RACF Data Collection:
- PDI(RACF0300)
For all systems, if the ERASE values are set as follows, this is not a finding.
ERASE-ON-SCRATCH IS ACTIVE, CURRENT OPTIONS:
ERASE-ON-SCRATCH FOR ALL DATA SETS IS IN EFFECT |
| | The GENCMD SETROPTS value is not enabled for ACTIVE classes. | (RACF0310: CAT II) The system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation. | | a) Refer to the following report produced by the RACF Data Collection:
- RACFCMDS.RPT(SETROPTS)
Automated Analysis
Refer to the following report produced by the RACF Data Collection:
- PDI(RACF0310)
b) Other than the exemptions listed below for which GENCMD need not be enabled, if the classes listed as ACTIVE are also listed as GENCMD, there is NO FINDING.
c) If there are ACTIVE classes not also shown as GENCMD classes and not in the list of exemptions below, this is a FINDING.
EXEMPTIONS:
The following are defined with GENERIC=DISALLOWED per RACF Macros and Interfaces Appendix C:
CDT
KERBLINK
REALM
SECLABEL
SECLMBR
The following should not use GENERICS:
USER
GROUP
The following are listed in RACF Command Lang Ref as not being recommended
for GENERICS:
DIGTCERT
DIGTRING
Any Class identified as a GROUP class (per RACF Macros and Interfaces Appendix C):
BCICSPCT
DIMS
ECICSDCT
GCICSTRN
GCPSMOBJ
GCSFKEYS
GDASDVOL
GDSNBP
GDSNCL
GDSNDB
GDSNJR
GDSNPK
GDSNPN
GDSNSC
GDSNSG
GDSNSM
GDSNSP
GDSNSQ
GDSNTB
GDSNTS
GDSNUF
GDSNUT
GEJBROLE
GIMS
GINFOMAN
GLOBAL
GMQADMIN
GMQCHAN
GMQNLIST
GMQPROC
GMQQUEUE
GMXADMIN
GMXNLIST
GMXPROC
GMXQUEUE
GMXTOPIC
GSDSF
GSOMDOBJ
GTERMINL
GXFACILI
HCICSFCT
HIMS
JIMS
KCICSJCT
MIMS
NCICSPPT
NODES ** should not be excluded.
PROGRAM
QCICSPSB
QIMS
RACFVARS
SECDATA
SECLABEL
UCICSTST
UIMS
VCICSCMD
VMXEVENT
WCICSRES
WIMS
The following are reporting-only classes (PROFDEF=NO per RACF Macros and Interfaces Appendix C):
DIRACC
DIRAUTH
DIRSRCH
FSOBJ
FSSEC
IPCOBJ
PROCACT
PROCESS
TEMPDSN
VMMAC |
| | The GENERIC SETROPTS value is not enabled for ACTIVE classes. | (RACF0320: CAT II) The system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation. | | a) Refer to the following report produced by the RACF Data Collection:
- RACFCMDS.RPT(SETROPTS)
Automated Analysis
Refer to the following report produced by the RACF Data Collection:
- PDI(RACF0320)
b) Other than the exemptions listed below for which GENERIC need not be enabled, if the classes listed as ACTIVE are also listed as GENERIC, there is NO FINDING.
c) If there are ACTIVE classes not also shown as GENERIC classes and not in the list of exemptions below, this is a FINDING.
EXEMPTIONS:
The following are defined with GENERIC=DISALLOWED per RACF Macros and Interfaces Appendix C:
CDT
KERBLINK
REALM
SECLABEL
SECLMBR
The following should not use GENERICS:
USER
GROUP
The following are listed in RACF Command Lang Ref as not being recommended
for GENERICS:
DIGTCERT
DIGTRING
The following are GROUP classes per RACF Macros and Interfaces Appendix C:
BCICSPCT
DIMS
ECICSDCT
GCICSTRN
GCPSMOBJ
GCSFKEYS
GDASDVOL
GDSNBP
GDSNCL
GDSNDB
GDSNJR
GDSNPK
GDSNPN
GDSNSC
GDSNSG
GDSNSM
GDSNSP
GDSNSQ
GDSNTB
GDSNTS
GDSNUF
GDSNUT
GEJBROLE
GIMS
GINFOMAN
GLOBAL
GMQADMIN
GMQCHAN
GMQNLIST
GMQPROC
GMQQUEUE
GMXADMIN
GMXNLIST
GMXPROC
GMXQUEUE
GMXTOPIC
GSDSF
GSOMDOBJ
GTERMINL
GXFACILI
HCICSFCT
HIMS
JIMS
KCICSJCT
MIMS
NCICSPPT
NODES ** should not be excluded.
PROGRAM
QCICSPSB
QIMS
RACFVARS
SECDATA
SECLABEL
UCICSTST
UIMS
VCICSCMD
VMXEVENT
WCICSRES
WIMS
The following are reporting-only classes (PROFDEF=NO per RACF Macros and
Interfaces Appendix C):
DIRACC
DIRAUTH
DIRSRCH
FSOBJ
FSSEC
IPCOBJ
PROCACT
PROCESS
TEMPDSN
VMMAC |
| | The TERMINAL SETROPTS value is not set to READ. | (RACF0330: CAT II) TERMINAL is used to set the universal access authority (UACC) associated with undefined terminals. If you specify TERMINAL, but do not specify read or none, the system will prompt you for a value.
The system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation. | | a) Refer to the following report produced by the RACF Data Collection:
- RACFCMDS.RPT(SETROPTS)
Automated Analysis
Refer to the following report produced by the RACF Data Collection:
- PDI(RACF0330)
b) If the TERMINAL value is set to READ, there is NO FINDING.
c) If the TERMINAL value is set to NONE, this is a FINDING. |
| | The PASSWORD(MINCHANGE) value must be specified as (1). | MINCHANGE specifies the number of days that must pass between a user's password and password phrase changes. Users can not change their own passwords and password phrases within the minimum change interval.
The system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation. | | Refer to the following report produced by the RACF Data Collection:
- RACFCMDS.RPT(SETROPTS)
Automated Analysis
Refer to the following report produced by the RACF Data Collection:
- PDI(RACF0445)
If the PASSWORD(MINCHANGE) value shows "PASSWORD MINIMUM CHANGE INTERVAL IS <1> DAYS" this is not a finding. |
| | The INACTIVE SETROPTS value is not set to 35 days. | The system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation. | | Refer to the following report produced by the RACF Data Collection:
- RACFCMDS.RPT(SETROPTS)
Automated Analysis
Refer to the following report produced by the RACF Data Collection:
- PDI(RACF0360)
Ensure the INACTIVE value is set properly In the message "INACTIVE USERIDS ARE BEING AUTOMATICALLY REVOKED AFTER xxx DAYS.", where xxx is a value of 1 to 35. |
| | The GRPLIST SETROPTS value is not set to ACTIVE. | (RACF0350: CAT II) GRPLIST specifies that RACF processing is to perform group list access checking for all system users. When you specify GRPLIST, a users authority to access a resource is not based only on the authority of the users current connect group; access is based on the authority of any group to which the user is connected.
The system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation. | | a) Refer to the following report produced by the RACF Data Collection:
- RACFCMDS.RPT(SETROPTS)
Automated Analysis
Refer to the following report produced by the RACF Data Collection:
- PDI(RACF0350)
b) If the GRPLIST is enabled then the message "LIST OF GROUPS ACCESS CHECKING IS ACTIVE." will be displayed, there is NO FINDING.
c) If the message indicates that LIST OF GROUPS is NOT ACTIVE, this is a FINDING. |
| | The INITSTATS SETROPTS value is not set to INITSTATS. | RACF0370: CAT II) INITSTATS specifies statistics available during RACINIT SVC processing are to be recorded. These statistics include the date and time RACINIT is issued for a particular user, the number of RACINITs for a user to a particular group, and the date and time of the last RACINIT for a user to a particular group.
The system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation. | | a) Refer to the following report produced by the RACF Data Collection:
- RACFCMDS.RPT(SETROPTS)
Automated Analysis
Refer to the following report produced by the RACF Data Collection:
- PDI(RACF0370)
b) If the INITSTATS value is listed as one of the ATTRIBUTES, there is NO FINDING.
c) If the INITSTATS value is not listed as one of the ATTRIBUTES, this is a FINDING. |
| | The JES(BATCHALLRACF) SETROPTS value is not set to JES(BATCHALLRACF). | (RACF0380: CAT II) JES(BATCHALLRACF) specifies that JES is to test for the presence of a USERID and password on the job statement or for propagated RACF identification information for all batch jobs.
The system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation. | | a) Refer to the following report produced by the RACF Data Collection:
- RACFCMDS.RPT(SETROPTS)
Automated Analysis
Refer to the following report produced by the RACF Data Collection:
- PDI(RACF0380)
b) If the JES(BATCHALLRACF) is enabled then the message "JES-BATCHALLRACF OPTION IS ACTIVE" will be displayed, there is NO FINDING.
c) If the message "JES-BATCHALLRACF OPTION IS INACTIVE" is displayed, this is a FINDING. |
| | The JES(XBMALLRACF) SETROPTS value is not set to JES(XBMALLRACF). | (RACF0400: CAT II) XBMALLRACF ensures that (assuming you have JES configured to support XBM jobs) any XBM job submitted by a user must have a RACF identity or the job
will fail. This is used only in JES2.
The system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation. | | a) Refer to the following report produced by the RACF Data Collection:
- RACFCMDS.RPT(SETROPTS)
Automated Analysis
Refer to the following report produced by the RACF Data Collection:
- PDI(RACF0400)
b) If the JES(XBMALLRACF) is enabled then the message "JES-XBMALLRACF OPTION IS ACTIVE" will be displayed, there is NO FINDING.
c) If the message "JES-XBMALLRACF OPTION IS INACTIVE" is displayed, this is a FINDING. |
| | The OPERAUDIT SETROPTS value is not set to OPERAUDIT. | (RACF0420: CAT II) OPERAUDIT specifies whether RACF is to log all actions, such as accesses to resources and commands, allowed only because a user has the OPERATIONS or group OPERATIONS attribute.
The system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation. | | a) Refer to the following report produced by the RACF Data Collection:
- RACFCMDS.RPT(SETROPTS)
Automated Analysis
Refer to the following report produced by the RACF Data Collection:
- PDI(RACF0420)
b) If the OPERAUDIT value is listed as one of the ATTRIBUTES, there is NO FINDING.
c) If the OPERAUDIT value is not listed as one of the ATTRIBUTES, this is a FINDING. |
| | The PASSWORD(HISTORY) SETROPTS value is not set to 10. | (RACF0430: CAT II) HISTORY specifies the number of previous passwords that RACF saves for each USERID and compares with an intended new password. If there is a match with one of the previous passwords, or with the current password, RACF rejects the intended new password.
The system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation. | | a) Refer to the following report produced by the RACF Data Collection:
- RACFCMDS.RPT(SETROPTS)
Automated Analysis
Refer to the following report produced by the RACF Data Collection:
- PDI(RACF0430)
b) If the PASSWORD(HISTORY) value is set properly then the message "x GENERATIONS OF PREVIOUS PASSWORDS BEING MAINTAINED.", where x is greater than or equal to 10, there is NO FINDING.
c) If the PASSWORD(HISTORY) value is set improperly then the message "x GENERATIONS OF PREVIOUS PASSWORDS BEING MAINTAINED.", where x is less than 10, this is a FINDING. |
| | The PASSWORD(INTERVAL) SETROPTS value is not set to 60 days. | (RACF0440: CAT II) INTERVAL specifies the maximum number of days that each users password is valid. When a user logs on to the system, RACF compares the system password interval value specified in the user profile. RACF uses the lower of the two values to determine if the users password has expired.
The system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation. | | a) Refer to the following report produced by the RACF Data Collection:
- RACFCMDS.RPT(SETROPTS)
Automated Analysis
Refer to the following report produced by the RACF Data Collection:
- PDI(RACF0440)
Note: Current DoD policy has changed requiring that the password change interval be at the most 60 days. Ensure that this is in effect.
b) If the PASSWORD(INTERVAL) value is set properly then the message "PASSWORD CHANGE INTERVAL IS xxx DAYS.", where xxx is less than or equal to 60 and not equal to 0, there is NO FINDING.
c) If the PASSWORD(INTERVAL) value is set improperly then the message "PASSWORD CHANGE INTERVAL IS xxx DAYS.", where xxx is greater than 60 or equal to 0, this is a FINDING. |
| | The PASSWORD(REVOKE) SETROPTS value specified is not in accordance with security requirements. | (RACF0450: CAT II) The IAO will ensure that PASSWORD(REVOKE) SETROPTS value is
set to 1 or 2. This value specifies the number of consecutive incorrect password attempts RACF allows before it revokes the USERID on the next incorrect attempt. If you specify REVOKE, ensure
INITSTATS are in effect.
The system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation. | | a) Refer to the following report produced by the RACF Data Collection:
- RACFCMDS.RPT(SETROPTS)
Automated Analysis
Refer to the following report produced by the RACF Data Collection:
- PDI(RACF0450)
b) If the PASSWORD(REVOKE) value shows "AFTER <n> CONSECUTIVE UNSUCCESSFUL PASSWORD ATTEMPTS, A USERID WILL BE REVOKED." where <n> is either 1 or 2, there is NO FINDING.
c) If the PASSWORD(REVOKE) value is not enabled and is not set to either 1 or 2, this is a FINDING. |
| | The PASSWORD(RULEn) SETROPTS value(s) must be properly set. | Password complexity, or strength, is a measure of the effectiveness of a password in resisting guessing and brute-force attacks. Password complexity is one factor of several that determine how long it takes to crack a password. The more complex the password is, the greater the number of possible combinations that need to be tested before the password is compromised. Use of a complex password helps to increase the time and resources required to compromise the password.
The PASSWORD SETROPTS value(s) specify the rules that RACF will apply when a user selects a new password. Improper setting of any of these fields, individually or in combination with another, can result in weakened passwords and compromise the security of the processing environment. | | Refer to the following report produced by the RACF Data Collection:
- RACFCMDS.RPT(SETROPTS)
Automated Analysis
Refer to the following report produced by the RACF Data Collection:
- PDI(RACF0460)
If the following options are specified, this is not a finding.
___ Verify at least one PASSWORD(RULE) under "INSTALLATION PASSWORD SYNTAX RULES" is defined with the values shown below:
RULE 1 LENGTH(8) xxxxxxxx
___ Verify the following options are in effect under "PASSWORD PROCESSING OPTIONS":
"MIXED CASE PASSWORD SUPPORT IS IN EFFECT"
"SPECIAL CHARACTERS ARE ALLOWED." |
| | The PASSWORD(WARNING) SETROPTS value is improperly set. | WARNING specifies the number of days before a password expires when RACF
is to issue a warning message to the user.
The system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation. | | a) Refer to the following report produced by the RACF Data Collection:
- RACFCMDS.RPT(SETROPTS)
Automated Analysis
Refer to the following report produced by the RACF Data Collection:
- PDI(RACF0470)
b) If the PASSWORD(WARNING) value shows "PASSWORD EXPIRATION WARNING LEVEL IS xxx DAYS.", where xxx is greater than or equal to 10, there is NO FINDING.
c) If the PASSWORD(WARNING) value shows "PASSWORD EXPIRATION WARNING LEVEL IS xxx DAYS.", where xxx is less than 10, this is a FINDING. |
| | The PROTECTALL SETROPTS value specified must be properly set. | When PROTECTALL processing is active and set to FAIL, the system automatically rejects any request to create or access a data set that is not RACF protected.
Temporary data sets that comply with standard MVS temporary data set naming conventions are excluded from PROTECTALL processing. PROTECTALL requires that data sets be RACF protected. In order for PROTECTALL to work effectively, you must specify GENERIC to activate generic profile checking. Otherwise, RACF would allow users to create or access only data sets protected by discrete profiles.
The system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation. | | a) Refer to the following report produced by the RACF Data Collection:
- RACFCMDS.RPT(SETROPTS)
Automated Analysis requires Additional Analysis.
Automated Analysis
Refer to the following report produced by the RACF Data Collection:
- PDI(RACF0480)
b) If the SETROPTS values for PROTECTALL is ACTIVE and set to FAIL, there is NO FINDING.
c) If the SETROPTS PROTECTALL parameter is set to NOPROTECTALL or PROTECTALL(WARNING), this is a FINDING.
Additional analysis may be required to determine whether this FINDING should be downgraded to a Category II or remain a Category I.
Example of a Category I FINDING where no further analysis is required:
Control Options: SETROPTS NOPROTECTALL
Example of a possible Category I FINDING requiring additional analysis:
Control Options: SETROPTS PROTECTALL(WARNING)
PROTECTALL(WARNING) allows access to a data set only if it is not protected by a profile in the DATASET resource class. Therefore if all sensitive data sets are properly protected by profiles in the DATASET resource class, PROTECTALL(WARNING) will not allow unauthorized access. This situation allows for a downgrade to a Category II. |
| | The REALDSN SETROPTS value specified is improperly set. | REALDSN specifies that RACF is to record, in any SMF log records and operator messages, the real data set name (not the naming-conventions name) used on the data set commands and during resource access checking and resource definition.
The system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation. | | a) Refer to the following report produced by the RACF Data Collection:
- RACFCMDS.RPT(SETROPTS)
Automated Analysis
Refer to the following report produced by the RACF Data Collection:
- PDI(RACF0490)
b) If the REALDSN is enabled then the message "REAL DATA SET NAMES OPTION IS ACTIVE" will be displayed, there is NO FINDING.
c) If the message "REAL DATA SET NAMES OPTION IS INACTIVE" is displayed, this is a FINDING. |
| | The RETPD SETROPTS value specified is improperly set. | RETPD specifies the default RACF security retention period for tape data sets. The security
retention period is the number of days that RACF protection is to remain in effect for the
tape data set and should be set to a value of 99999.
The system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation. | | a) Refer to the following report produced by the RACF Data Collection:
- RACFCMDS.RPT(SETROPTS)
Automated Analysis
Refer to the following report produced by the RACF Data Collection:
- PDI(RACF0500)
b) If the RETPD is enabled then the message "SECURITY RETENTION PERIOD IN EFFECT IS NEVER-EXPIRES DAYS" will be displayed, there is NO FINDING.
c) If the RETPD value is not set to "NEVER-EXPIRES", this is a FINDING. |
| | The SETROPTS RVARYPW values must be properly set. | RVARYPW specifies passwords that an operator is to use to respond with requests to approve RVARY command processing.
The system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation. | | Refer to the following report produced by the RACF Data Collection:
- RACFCMDS.RPT(SETROPTS)
Automated Analysis requires Additional Analysis.
Refer to the following report produced by the RACF Data Collection:
- PDI(RACF0510)
If the SETROPTS RVARYPW entries conform to the following requirements, this is not a finding.
___ The "INSTALLATION DEFINED RVARY PASSWORD IS IN EFFECT" message for both the SWITCH and STATUS functions.
___ The SWITCH and STATUS password content follow the password requirements documented in RACF0460. |
| | The SAUDIT SETROPTS value specified is improperly set. | SAUDIT specifies whether RACF is to log all RACF commands issued by users with the
SPECIAL or group SPECIAL attribute.
The system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation. | | a) Refer to the following report produced by the RACF Data Collection:
- RACFCMDS.RPT(SETROPTS)
Automated Analysis
Refer to the following report produced by the RACF Data Collection:
- PDI(RACF0520)
b) If the SAUDIT value is listed as one of the ATTRIBUTES, there is NO FINDING.
c) If the NOSAUDIT value is listed as one of the ATTRIBUTES, this is a FINDING. |
| | The TAPEDSN SETROPTS value specified is improperly set. | TAPEDSN activates tape data set protection. When tape data set protection is
in effect, RACF can protect individual tape data sets as well as tape volumes.
The system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation. | | a) Refer to the following report produced by the RACF Data Collection:
- RACFCMDS.RPT(SETROPTS)
Automated Analysis
Refer to the following report produced by the RACF Data Collection:
- PDI(RACF0550)
b) If the TAPEDSN is enabled then the message "TAPE DATA SET PROTECTION IS ACTIVE" will be displayed, there is NO FINDING.
NOTE 1: TAPEDSN should be active for domains without a tape management product.
NOTE 2: For domains running CA 1, Computer Associates recommends that TAPEDSN be active and CA 1 parameter OCEOV be set to OFF.
c) If the TAPEDSN value is set to INACTIVE, this is a FINDING. |
| | The WHEN(PROGRAM) SETROPTS value specified is not active. | WHEN(PROGRAM) activates RACF program control, which
includes both access control to load modules and program access to data sets.
The system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation. | | a) Refer to the following report produced by the RACF Data Collection:
- RACFCMDS.RPT(SETROPTS)
Automated Analysis
Refer to the following report produced by the RACF Data Collection:
- PDI(RACF0560)
b) If the WHEN(PROGRAM) value is listed as one of the ATTRIBUTES, there is NO FINDING.
c) If the NOWHEN(PROGRAM) value is listed as one of the ATTRIBUTES, this is a FINDING. |
| | RACF users do not have the required default fields. | Ensure that Every USERID is uniquely identified to the system. Within the USERID record, the user's name, default group, the owner, and the user's passdate fields are completed. This will uniquely identify each user. If these fields are not completed for each user, user accountability will become lost.
Every user will be identified to RACF via each user's unique userid profile. To RACF, a user is
an individual (user), a started task, or a batch job. Every userid will be fully identified within
RACF with the following fields completed:
NAME User's name
DFLTGRP Default group
OWNER User's profile owner
PASSWORD Password
RACF will automatically assign the default group as the password if a password is not explicitly
coded. Assign a unique password to every userid to prevent unauthorized access by a person
who knows the default group for a new userid. | | a) Refer to the following report produced by the RACF Data Collection:
- RACFCMDS.RPT(LISTUSER)
Automated Analysis
Refer to the following report produced by the RACF Data Collection:
- PDI(RACF0570)
b) If every user is fully identified with all of the following conditions:
1. A completed NAME field that can either be traced back to a current DD2875 or a Vendor Requirement (example: A Started Task).
2. The presence of the DEFAULT-GROUP and OWNER fields.
3. The PASSDATE field is not set to N/A unless this user has the PROTECTED attribute.
c) If all of the above are true, there is NO FINDING.
d) If any of above is untrue, this is a FINDING. |
| | Interactive USERIDs defined to RACF must have the required fields completed. | Improper assignments of attributes in the LOGONID record may allow users excessive privileges resulting in unauthorized access. | | Refer to the following report produced by the RACF Data Collection:
- RACFCMDS.RPT(LISTUSER)
Automated Analysis requires Additional Analysis.
Automated Analysis
Refer to the following report produced by the RACF Data Collection:
- PDI(RACF0580)
Verify that the interactive userids are properly defined. If the following guidance is true, this is not a finding.
___ Ensure that each interactive userid has a valid LAST-ACCESS date that does not contain the value UNKNOWN.
___ Ensure that PASS-INTERVAL is set to a value of 1 to 60 days.
Note: Current DoD policy has changed requiring that the password change interval is set to a value of 1 to 60. Ensure that this is in effect.
Note: FTP only process and server to server userids may have PASSWORD(NOINTERVAL) specified. These users must be identified in the FTPUSERS group in the Dialog Process or FTP in the name field. Additionally these users must change their passwords on an annual basis. |
| | RACF batch jobs are improperly secured. | Batch jobs that are submitted to the operating system should inherit the USERID of the submitter. This will identify the batch job with a userid for the purpose of accessing resources. BATCHALLRACF ensures that a valid USERID is associated with batch jobs. Jobs that are submitted to the operating system via a scheduling facility must also be identified to the system. Without a batch job having an associated USERID, access to system resources will be limited. | | a) Refer to the following reports produced by the RACF Data Collection and Data Set and Resource Data Collection:
- RACFCMDS.RPT(SETROPTS)
- SENSITVE.RPT(SURROGAT)
- RACFCMDS.RPT(LISTUSER)
Refer to the documentation of the processes used for submission of batch jobs via an automated process (i.e., scheduler or other sources) and each of the associated userids.
b) If the submission of batch jobs via an automated process (e.g., job scheduler, job submission started task, etc.) is being utilized, ensure the following items are in effect:
1) The SURROGAT resource class is active. Note: This does not need to be checked, automation check is performed in ZUSSR060.
2) Each batch job userid used for batch submission by a job scheduler (e.g., CONTROL-M, CA-7, CA-Scheduler, etc.) is defined as an execution-userid in a SURROGAT resource class profile. For example:
RDEFINE SURROGAT execution-userid.SUBMIT UACC(NONE)
OWNER(execution-userid)
3) Job scheduler userids (i.e., surrogate-userid) are permitted surrogate authority to the appropriate SURROGAT profiles. For example:
PERMIT execution-userid.SUBMIT CLASS(SURROGAT)
ID(surrogate-userid) ACCESS(READ)
c) If all of the above in (b) are true, there is NO FINDING.
d) If any of the above in (b) is untrue, this is a FINDING. |
| | RACF batch jobs are not protected with propagation control. | Batch jobs that are user-submitted to the operating system should inherit the USERID of the submitter. This will identify the batch job with the user for the purpose of accessing resources. In some environments, such as CICS, jobs submitted without the USER operand specified on the JOB statement run under a user ID other than the user submitting the job, in this case, the CICS userid. This situation presents a security violation in that the issuer of the job will inherit the authority of the CICS userid.
The PROPCNTL Class was designed to prevent this from occurring. Utilize propagation control (PROPCNTL) for system-level address spaces that submit jobs on behalf of users. | | a) Refer to the following reports produced by the RACF Data Collection and Data Set and Resource Data Collection:
- RACFCMDS.RPT(SETROPTS)
- SENSITVE.RPT(PROPCNTL)
- RACFCMDS.RPT(LISTUSER)
Refer to a list all Multiple User Access Systems in use on this system. These are systems that run in a single address space, but allow multiple users to sign on to them (e.g., CICS regions, Session Managers, etc.). For each region, also include corresponding userids, profiles, data management files, and a brief description (of each region).
Refer to the documentation of the processes used for submission of batch jobs via an automated process (i.e., scheduler or other sources) and each of the associated userids.
b) If (1) the submission of batch jobs via an automated process (e.g., job scheduler, job submission started task, etc.) is being utilized, and/or (2) Multiple User Single Address Space Systems (MUSASS) capable of submitting batch jobs are active on this system, ensure the following items are in effect:
1) The PROPCNTL resource class is active.
2) A PROPCNTL resource class profile is defined for each userid associated with a job scheduler (e.g., CONTROL-M, CA-7, etc.) and a MUSASS able to submit batch jobs (e.g., CA-ROSCOE, etc.).
c) If both of the above in (b) are true, there is NO FINDING.
d) If either of the above in (b) is untrue, this is a FINDING. |
| | Started Tasks are not properly identified to RACF. | Started procedures have system generated job statements that do not contain the user, group, or password statements. To enable the started procedure to access the same protected resources that users and groups access, started procedures must have an associated USERID. If a USERID is not associated with the started procedure, the started procedure will not have access to the resources. | | Refer to the following reports produced by the RACF Data Collection:
- DSMON.RPT(RACSPT)
- RACFCMDS.RPT(LISTUSER)
Refer to a list of all started tasks (STCs) and associated userids with a brief description on the system.
Started task procedures will have a unique associated userid or STC userids will be unique per product and function if supported by vendor documentation |
| | Started Tasks are improperly defined to RACF. | Started procedures have system generated job statements that do not contain the user, group, or password statements. To enable the started procedure to access the same protected resources that users and groups access, started procedures must have an associated USERID. If a USERID is not associated with the started procedure, the started procedure will not have access to the resources. If the started procedure is associated with an incorrect user or a user with higher than necessary authority then a potential vulnerability exists. | | I. STC Group IDs
a) Refer to the following reports produced by the RACF Data Collection:
- DSMON.RPT(RACSPT)
- RACFCMDS.RPT(LISTGRP)
Refer to a list of all started tasks (STCs) and associated userids with a brief description on the system.
b) Ensure the following items are in effect:
1) All started task userids are connected to a valid STC group ID.
2) Only userids associated with STCs are connected to STC group IDs.
3) All STC userids are defined with the PROTECTED attribute.
c) If (b) above is true, there is NO FINDING.
d) If (b) above is untrue, this is a FINDING.
II. STC Default Profile
a) Ensure the following items are in effect:
1) A generic catch all profile of ** is defined to the STARTED resource class.
2) The STC group associated with the ** profile is not granted any explicit data set or resource access authorizations.
3) The STC userid associated with the ** profile is not granted any explicit dataset or resource access authorizations and is defined with the RESTRICTED attribute.
NOTE: Execute the JCL in CNTL(IRRUT100) using the STC group associated with the ** profile as SYSIN input. This report lists all occurrences of this group within the RACF database, including data set and resource access lists.
b) If (a) above is true, there is NO FINDING.
c) If (a) above is untrue, this is a FINDING.
III. ICHRIN03 Entries
a) Verify that the ICHRIN03 started procedures table is maintained to support recovery efforts in the event the STARTED resource class is deactivated or critical STC profiles are deleted. Ensure that STCs critical to support this recovery effort (e.g., JES2, VTAM, TSO, etc.) are maintained in ICHRIN03 to reflect the current STARTED resource class profiles.
b) If (a) above is true, there is NO FINDING.
c) If (a) above is untrue, this is a FINDING. |
| | DASD Management USERIDs must be properly controlled. | DASD management USERIDs require access to backup and restore all files, and present a high degree of risk to the environment. These users should be given access to perform necessary functions thru use of the DASDVOL class (for non-SMS volumes) and/or thru STGADMIN profiles in the FACILITY class for SMS managed volumes. Access to individual profiles in the DATASET class should be disallowed. These userids should also set up IAW RACF0595 for batch userids which includes use of the PROTECTED Attribute. | | Note: This applies to non-SMS volumes. Please refer to the System Managed Storage group (i.e., ZSMSnnnn) for requirements for System managed Storage.
Refer to the following reports produced by the RACF Data Collection and Data Set and Resource Data Collection:
- SENSITVE.RPT(DASDVOL)
- SENSITVE.RPT(GDASDVOL)
- RACFCMDS.RPT(LISTUSER)
- RACFCMDS.RPT(LISTGRP)
Refer to all documents and procedures that apply to Storage Management. Including identification of the DASD backup data sets and associated storage management userids.
Review storage management userids, If the following guidance is true, this is not a finding.
___ Storage management userids will not be given the "OPERATIONS" attribute.
___ Storage management userids will be defined with the "PROTECTED" attribute.
___ Storage management userids are permitted to the appropriate "STGADMIN" profiles in the "FACILITY" class for SMS-managed volumes.
___ Storage management userids assigned to storage management tasks (e.g., volume backup, data set archive and restore, etc.) are given access to data sets using "DASDVOL" and/or "GDASDVOL" profiles for non-SMS-managed volumes.
NOTE: "DASDVOL" profiles will not work with SMS-managed volume. "FACILITY" class profiles must be used instead. If "DFSMS/MVS" is used to perform DASD management operations, "FACILITY" class profiles may also be used to authorize storage management operations to non-SMS-managed volumes in lieu of using "DASDVOL" profiles. Therefore, not all volumes may be defined to the "DASDVOL/GDASDVOL" resource classes, and not all storage management userids may be represented in the profile access lists. |
| | There are started tasks defined to RACF with the trusted attribute that are not justified. | Trusted Started tasks bypass RACF checking. It is vital that this attribute is NOT granted to unauthorized Started Tasks which could then obtain unauthorized access to the system. This could result in the compromise of the confidentiality, integrity, and availability of the operating system, ACP, or customer data. | | a) Refer to the following report produced by the RACF Data Collection:
- DSMON.RPT(RACSPT)
Refer to a list of all started tasks (STCs) and associated userids with a brief description on the system.
Automated Analysis
Refer to the following report produced by the RACF Data Collection:
- PDI(RACF0660)
b) Ensure that only approved Started Tasks have the TRUSTED flag enabled. Started Tasks approved to run with the TRUSTED attribute are contained in the TRUSTED STARTED TASKS Table in the zOS STIG Addendum.
c) Ensure that no Started Tasks have been granted the PRIVILEGED attribute.
d) If all of the above are true, there is NO FINDING.
e) If any of the above is untrue, this is a FINDING. |
| | Emergency USERIDs must be properly defined. | Emergency USERIDs are necessary in the event of a system outage for recovery purposes. It is critical that those USERIDs be defined with the appropriate access to ensure timely restoration of services. | | Refer to the following report produced by the z/OS Data Collection:
- EXAM.RPT(TSOUADS)
Refer to the following reports produced by the RACF Data Collection:
- RACFCMDS.RPT(LISTUSER)
- SENSITVE.RPT(DASDVOL)
- SENSITVE.RPT(GDASDVOL)
Refer to the list from the IAO of all emergency userids available to the site along with the associated function of each userid.
At a minimum an emergency logonid will exists with the security administration attributes specified in accordance with the following requirements. If the followng guidance is not followed this is a finding.
- At least one userid exists to perform RACF security administration. These userids are defined to RACF with the system-SPECIAL attribute. They must not have the OPERATIONS attribute.
- If any userids exist to perform operating system functions, they are defined without any RACF security administration privileges. These userids are defined to RACF with the system-OPERATIONS attribute, and FULL access to all DASD volumes. They must not have the SPECIAL attribute.
NOTE: A user who has the system-OPERATIONS attribute has FULL access authorization to all RACF-protected resources in the DASDVOL/GDASDVOL resource classes. However, if their userid or any associated group (i.e., default or connect) is in the access list of a resource profile, they will only have the access specified in the access list.
- All emergency userids are defined to RACF and SYS1.UADS.
- All emergency logonid / logonid(s) are to be implemented with logging to provide an audit trail of their activities. This is accomplished with the UAUDIT attribute.
- All emergency logonid / logonid(s) will have distinct, different passwords in SYS1.UADS and in RACF, and the site is to establish procedures to ensure that the passwords differ. The password for any ID in SYS1.UADS is never to match the password for the same ID in RACF.
- All emergency logonid / logonid(s) will have documented procedures to provide a mechanism for the use of the IDs. Their release for use is to be logged, and the log is to be maintained by the IAO. When an emergency logonid is released for use, its password is to be reset by the IAO within 12 hours. |
| | The use of the RACF SPECIAL Attribute is not justified. | The SPECIAL user attribute allows full authorization to modify all profiles in the RACF database and allows the user to perform all RACF functions, except those requiring AUDITOR attributes. This privilege should be limited to the security group and administrators because of the extreme control that these users have. Users with this privilege can alter any profile or resource on the system and could also alter the audit trail information.
The Group-Special attribute allows decentralized RACF control of datasets and resources. In cases where the scope of authority granted to a Group-Special Administrator has an impact on system security, the IAO needs to be fully aware and approve its use. | | a) Refer to the following reports produced by the RACF Data Collection:
- DSMON.RPT(RACUSR)
- DSMON.RPT(RACGRP)
- RACFCMDS.RPT(LISTUSER)
Automated Analysis requires Additional Analysis.
Refer to the following report produced by the RACF Data Collection:
- PDI(RACF0710)
b) Ensure the following items are in effect regarding the SPECIAL attribute:
1) Authorization to the SYSTEM SPECIAL attribute is restricted to security personnel.
2) At minimum, ensure that any users connected to sensitive system dataset HLQ groups with the Group-SPECIAL attribute are security personnel. Otherwise, Group-SPECIAL is allowed.
c) If both items in (b) are true, there is NO FINDING.
d) If either item in (b) is untrue, this is a FINDING. |
| | Assignment of the RACF OPERATIONS attribute to individual userids must be fully justified. | A user possessing the OPERATIONS attribute has authorization to do maintenance operations on all RACF-protected data sets, tape volumes, and DASD volumes except those where the access list specifically limits the OPERATIONS user to a lower access authority than the operation requires.
Because the OPERATIONS and GROUP-OPERATIONS privileges allow widespread access they should be limited to users documented with a valid requirement. Delegation of GROUP-OPERATIONS processing to other personnel by site-defined Group Administrators is forbidden. | | a) Refer to the following reports produced by the RACF Data Collection:
- DSMON.RPT(RACUSR)
- DSMON.RPT(RACGRP)
- RACFCMDS.RPT(LISTUSER)
Automated Analysis requires Additional Analysis.
Refer to the following report produced by the RACF Data Collection:
- PDI(RACF0720)
b) Ensure the following items are in effect regarding the OPERATIONS attribute:
1) Authorization to the SYSTEM OPERATIONS attribute is restricted to key systems personnel, such as individuals responsible for continuing operations, Storage Management, and emergency recovery.
2) At minimum, ensure that any users connected to sensitive system dataset HLQ groups with the Group-OPERATIONS are key systems personnel, such as individuals responsible for continuing operations, Storage Management, and emergency recovery.
. Otherwise, Group-OPERATIONS is allowed.
c) If both items in (b) are true, there is NO FINDING.
d) If either item in (b) is untrue, this is a FINDING. |
| | The use of the RACF AUDITOR privilege must be justified. | A user having the AUDITOR attribute has the authority to specify logging options, gives control of logging SMF data and list auditing information. With the AUDITOR attribute, a user could alter SMF logging data so no trace of the activity could be found. This could destroy audit trace information for the RACF system. This attribute should be limited to a minimum number of people. This also applies to the use of Group-Auditor in cases where users are connected to sensitive system dataset HLQ or general resource owning groups with Group-Auditor. | | a) Refer to the following reports produced by the RACF Data Collection:
- DSMON.RPT(RACUSR)
- DSMON.RPT(RACGRP)
- RACFCMDS.RPT(LISTUSER)
Automated Analysis requires Additional Analysis.
Refer to the following report produced by the RACF Data Collection:
- PDI(RACF0730)
b) Ensure the following items are in effect regarding the AUDITOR attribute:
1) Authorization to the SYSTEM AUDITOR attribute is restricted to auditing and/or security personnel.
2) At minimum, ensure that any users connected to sensitive system dataset HLQ groups or general resource owning groups with the Group-AUDITOR attribute are Auditor and/or Security personnel. Otherwise, Group-AUDITOR is allowed.
c) If both items in (b) are true, there is NO FINDING.
d) If either item in (b) is untrue, this is a FINDING. |
| | The number of USERIDs possessing the Tape Bypass Label Processing (BLP) privilege is not justified. | BLP is extremely sensitive, as it allows the circumvention of security access checking for the data. When BLP is used in z/OS, the only verification that is done is for the data set name in the JCL. Any data set name can be used. A user could specify a data set name that he has access to, the job would pass the validation check, and the job would be processed, giving access to the data. BLP is typically used for tapes that are external to the tape management system used on the processor.
BLP should be granted to only a limited number of people, preferably the tape librarian and a few key people from the operations staff. If an unauthorized user possesses BLP authority, they could potentially read any restricted tape and modify any information once it has been copied. | | a) Refer to the following reports produced by the RACF Data Collection:
- SENSITVE.RPT(FACILITY)
- RACFCMDS.RPT(LISTUSER)
- RACFCMDS.RPT(LISTGRP)
- DSMON.RPT(RACCDT)
b) Ensure the following items are in effect regarding bypass label processing (BLP):
1) The ICHBLP resource is defined to the FACILITY resource class with a UACC(NONE).
2) Access authorization to the ICHBLP resource is restricted at the userid level to data center personnel (e.g., tape librarian, operations staff, etc.)
3) If no tape management system (e.g., CA-1) is installed, the TAPEVOL class is active.
c) If all items in (b) are true, there is NO FINDING.
d) If any item in (b) is untrue, this is a FINDING. |
| | TSOAUTH resources must be restricted to authorized users. | The TSOAUTH resource class controls sensitive privileges, such as OPER, ACCOUNT, MOUNT, TESTAUTH, CONSOLE, and PARMLIB. Several of these privileges offer the ability, or provide a facility, to modify sensitive operating system resources. Failure to properly control and restrict access to these privileges may result in the compromise of the operating system environment, ACP, and customer data. | | Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(ZTSO0030)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ZTSO0030)
Ensure that all TSOAUTH resources and/or generic equivalent are properly protected according to the requirements specified. If the following guidance is true, this is not a finding.
___ The ACCT authorization is restricted to security personnel.
___ The CONSOLE authorization is restricted to authorized systems personnel (e.g., systems programming personnel, operations staff, etc.) and READ access may be given to all user when SDSF in install at the IAOs discretion.
___ The MOUNT authorization is restricted to DASD batch users only.
___ The OPER authorization is restricted to authorized systems personnel (e.g., systems programming personnel, operations staff, etc.).
___ The PARMLIB authorization is restricted to only z/OS systems programming personnel and READ access may be given to auditors.
___ The TESTAUTH authorization is restricted to only z/OS systems programming personnel. |
| | DASD Volume level protection must be properly defined. | Volume access grants default access to all data sets residing on a given volume. This presents an exposure in the case of a data set improperly placed on a volume or inappropriate access being granted to a volume. | | Refer to the following reports produced by the RACF Data Collection and Data Set and Resource Data Collection:
- SENSITVE.RPT(DASDVOL)
- SENSITVE.RPT(GDASDVOL)
- RACFCMDS.RPT(LISTUSER)
- RACFCMDS.RPT(LISTGRP)
Refer to all documents and procedures that apply to Storage Management including identification of the DASD backup files and all associated storage management userids.
Ensure the following items are in effect regarding DASD volume controls:
A profile of "**" or "*" is defined for the "DASDVOL" resource class.
Access authorization to "DASDVOL" profiles is restricted to Storage Management Personnel, Storage Management Batch Userids, and Systems Programmers.
All profiles defined to the "DASDVOL" resource class have "UACC(NONE)".
The profile "WARNING" flag is "NO".
All (i.e., failures and successes) access is logged.
NOTE: Volume authorization allows access to all data sets on the volume thru the use of storage management utilities, regardless of data set profile authorization. Access to operating system and general user storage volumes should be questioned.
If all of the items are in effect regarding DASD volume controls, this is not a finding.
If any of the items are NOT in effect regarding DASD volume controls, this is a finding. |
| | Sensitive Utility Controls will be properly defined and protected. | Sensitive Utility Controls can run sensitive system privileges or controls, and potentially can circumvent system and security controls. Failure to properly control access to these resources could result in the compromise of the confidentiality, integrity, and availability of the operating system environment, system services, ACP, and customer data. | | Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(RACF0770)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(RACF0770)
Ensure that all Sensitive Utilities resources and/or generic equivalent are properly protected according to the requirements specified in Sensitive Utility Controls table in the z/OS STIG Addendum. If the following guidance is true, this is not a finding.
___ The RACF resource access authorizations restrict access to the appropriate personnel.
___ The RACF resource logging is correctly specified.
___ The RACF resource access authorizations are defined with UACC(NONE) and NOWARNING. |
| | External RACF Classes are not active for CICS transaction checking. | Implement CICS transaction security by utilizing two distinct and unique RACF resource
classes (i.e., member and grouping) within each CICS region. If several CICS regions are
grouped in an MRO environment, it is permissible for those grouped regions to share a
common pair of resource classes. Member classes contain a RACF discrete profile for
each transaction. Grouping classes contain groups of transactions requiring equal
protection under RACF. Ideally, member classes contain no profiles, and all transactions
are defined by groups in a grouping class.
If CICS Classes are not active, this could result in the compromise of the confidentiality, integrity, and availability of the CICS region, applications, and customer data. | | a) Refer to the following report produced by the RACF Data Collection:
- RACFCMDS.RPT(SETROPTS)
Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010.
b) Ensure each CICS transaction resource class pair are active.
c) If (b) is true, there is NO FINDING.
d) If (b) is untrue, this is a FINDING. |
| | CICS System Initialization Table (SIT) parameter values must be specified in accordance with proper security requirements. | The CICS SIT is used to define system operation and configuration parameters of a CICS system. Several of these parameters control the security within a CICS region. Failure to code the appropriate values could result in unexpected operations and degraded security. This exposure may result in unauthorized access impacting the confidentiality, integrity, and availability of the CICS region, applications, and customer data. | | Refer to the following report produced by the z/OS Data Collection:
- EXAM.RPT(CICSPROC)
Refer to the following report produced by the CICS Data Collection:
- CICS.RPT(DFHSITxx)
Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010.
Refer to the CICS region SYSLOG - (Alternate source of SIT parameters) be sure to process DFHSIT based on the order specified. The system initialization parameters are processed in the following order, with later system initialization parameter values overriding those specified earlier. CICS system initialization parameters are specified in the following ways:
In the system initialization table, loaded from a library in the STEPLIB concatenation of the CICS startup procedure.
In the PARM parameter of the EXEC PGM=DFHSIP statement of the CICS startup procedure.
In the SYSIN data set defined in the startup procedure (but only if SYSIN is coded in the PARM parameter).
Ensure the following CICS System Initialization Table (SIT) parameter settings are specified for each CICS region. If the following guidance is true, this is not a finding.
___ SEC=YES - If SEC is not coded in the CICS region startup JCL, go to offset x'117' from the beginning on the SIT dump (record sequence number - 6) for a length of 1. This is the security byte flag. Below is the hex and bit settings for this flag.
X'80' EQU B'10000000' External Security Requested
___ DFLTUSER=<parameter> - If DFLTUSER is not coded in the CICS region startup JCL, go to offset x'118' from the beginning on the SIT dump (record sequence number - 6) for a length of 8 bytes. The value will be the CICS default userid.
___ XUSER=YES - If XUSER is not coded in the CICS region startup JCL, go to offset x'117' from the beginning on the SIT dump (record sequence number - 6) for a length of 1. This is the security byte flag. Below is the hex and bit settings for this flag.
X'04' EQU B'00000100' Surrogate User Checking required
___ SNSCOPE=NONE|CICS|MVSIMAGE|SYSPLEX - If SNSCOPE is not coded in the CICS region startup JCL, go to offset x'124' from the beginning on the SIT dump (record sequence number - 6) for a length of 1. This is the signon scope byte flag. Ensure that users cannot sign on to more than one CICS production region within the scope of a single CICS region, a single z/OS image, or a sysplex. Below are listed the hex and bit settings for this flag:
X'01' EQU 1 SIGNON SCOPE = NONE
X'02' EQU 2 SIGNON SCOPE = CICS
X'03' EQU 3 SIGNON SCOPE = MVSIMAGE
X'04' EQU 4 SIGNON SCOPE = SYSPLEX
Note: SNSCOPE=NONE is only allowed with test/development regions.
___ XTRAN=YES|ssrrTRN - If XTRAN is not coded in the CICS region startup JCL, go to offset x'CA' from the beginning on the SIT dump (record sequence number - 6) for a length of 7 bytes. The value will be the resource class name used for that region. If XTRAN=YES is coded, c'CICSTRN' will be present.
___ SECPRFX=YES - If SECPRFX is not coded in the CICS region startup JCL, go to offset x'117' from the beginning on the SIT dump (record sequence number - 6) for a length of 1. This is the security byte flag. Below are the hex and bit settings for this flag.
X'40' EQU B'01000000' Resource Prefix Required
If XTRAN=ssrrTRN is specified, resource prefixing (e.g., SECPRFX=YES) is not required to be enabled. Also, CICS regions cannot share the same resource class if resource prefixing is not active. |
| | Configuration files for the TCP/IP stack are not properly specified. | The TCP/IP stack reads two configuration files to determine values for critical operational parameters. These file names are specified in multiple locations and, depending on the process, are referenced differently. Because system security is impacted by some of the parameter settings, specifying the file names explicitly in each location reduces ambiguity and ensures proper operations. Inappropriate values could result in undesirable operations and degraded security. This exposure may result in unauthorized access impacting data integrity or the availability of some system services. | | a) Display the active started tasks executing on the domain using SDSF, or equivalent JES display product, and locate the TCPIP started task.
If TCPIP is inactive, review the procedure libraries defined to JES2 and locate the TCPIP JCL member.
Automated Analysis
Refer to the following report produced by the IBM Communications Server Data Collection:
- PDI(ITCP0010)
b) Ensure the following items are in effect for the TCPIP started task JCL:
1) The PROFILE and SYSTCPD DD statements specify the TCP/IP Profile and Data configuration files respectively.
2) The RESOLVER_CONFIG variable on the EXEC statement is set to the same file name specified on the SYSTCPD DD statement.
c) If both of the above are true, there is NO FINDING.
d) If either of the above is untrue, this is a FINDING. |
| | TCPIP.DATA configuration statements for the TCP/IP stack must be properly specified. | During the initialization of TCP/IP servers and clients, the TCPIP.DATA configuration file provides information that is essential for proper operations of TCP/IP applications. Inappropriate values could result in undesirable operations and degraded security. This exposure may result in unauthorized access impacting data integrity or the availability of some system services. | | Refer to the Data configuration file specified on the SYSTCPD DD statement in the TCPIP started task JCL.
Automated Analysis
Refer to the following report produced by the IBM Communications Server Data Collection:
- PDI(ITCP0020)
Verify that the following configuration statements are specified in the TCP/IP Data configuration file. If the following guidance is true, this is not a finding.
TCPIPJOBNAME
HOSTNAME
DOMAINORIGIN/DOMAIN (The DOMAIN statement is functionally equivalent to the DOMAINORIGIN Statement)
DATASETPREFIX |
| | PROFILE.TCPIP configuration statements for the TCP/IP stack are not coded properly. | The PROFILE.TCPIP configuration file provides system operation and configuration parameters for the TCP/IP stack. Inappropriate values could result in undesirable operations and degraded security. This exposure may result in unauthorized access impacting data integrity or the availability of some system services. | | a) Refer to the Profile configuration file specified on the PROFILE DD statement in the TCPIP started task JCL.
Automated Analysis
Refer to the following report produced by the IBM Communications Server Data Collection:
- PDI(ITCP0030)
b) Ensure the following items are in effect for the configuration statements specified in the TCP/IP Profile configuration file:
NOTE: If the INCLUDE statement is coded in the TCP/IP Profile configuration file, the data set specified on this statement must be checked for the following items as well.
1) The SMFPARMS statement is not coded or commented out.
2) The DELETE statement is not coded or commented out for production systems.
3) The SMFCONFIG statement is coded with (at least) the FTPCLIENT and TN3270CLIENT operands.
4) The TCPCONFIG and UDPCONFIG statements are coded with (at least) the RESTRICTLOWPORTS operand.
NOTE: If the INCLUDE statement is coded, the data set specified will be checked for access authorization compliance in STIG ID ITCP0070.
c) If all of the above are true, there is NO FINDING.
d) If any of the above is untrue, this is a FINDING. |
| | The permission bits and user audit bits for HFS objects that are part of the Base TCP/IP component must be configured properly. | HFS directories and files of the Base TCP/IP component provide the configuration, operational, and executable properties of IBMs TCP/IP system product. Failure to properly secure these objects may lead to unauthorized access resulting in the compromise of the integrity and availability of the operating system environment, ACP, and customer data. | | Refer to the following report produced by the UNIX System Services Data Collection:
- USSCMDS.RPT(ITCP0040)
Refer to the following report produced by the IBM Communications Server Data Collection:
- PDI(ZTCP0040)
The HFS permission bits and user audit bits for each directory and file match or are more restrictive than the specified settings listed in the table. If the guidance is true, this is not a finding.
BASE TCP/IP HFS Object Security Settings
File Permission Bits User Audit Bits
/etc/hosts 0744 faf
/etc/protocol 0744 faf
/etc/resolv.conf 0744 faf
/etc/services 0740 faf
/usr/lpp/tcpip/sbin 0755 faf
/usr/lpp/tcpip/bin 0755 faf
NOTE:
Some of the files listed above are not used in every configuration. Absence of any of the files is not considered a finding.
The following represents a hierarchy for permission bits from least restrictive to most restrictive:
7 rwx (least restrictive)
6 rw-
3 -wx
2 -w-
5 r-x
4 r--
1 --x
0 --- (most restrictive)
The possible audit bits settings are as follows:
f log for failed access attempts
a log for failed and successful access
- no auditing |
| | TCP/IP resources must be properly protected. | The Communication Server access authorization is used to protect TCP/IP resources such as stack, network, port, and other SERVAUTH resources. These resources provide additional security checks for TCP/IP users. Failure to properly secure these TCP/IP resources could lead to unauthorized user access resulting in the compromise of some system services and possible compromise of data. | | Refer to the following reports produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(ITCP0050)
Automated Analysis requires Additional Analysis.
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ITCP0050)
Ensure that all TCP/IP resources and/or generic equivalent are properly protected according to the requirements specified. If the following guidance is true, this is not a finding.
___ The EZA, EZB, and IST resources and/or generic equivalent are defined to the SERVAUTH resource class with a UACC(NONE).
___ No access is given to the EZA, EZB, and IST high level resources of the SERVAUTH resource class.
___ If the product CSSMTP is on the system, no access is given to EZB.CSSMTP of the SERVAUTH resource class.
___ If the product CSSMTP is on the system, EZB.CSSMTP.sysname.writername.JESnode will be specified and made available to the CSSMTP started task and authenticated users that require access to use CSSMTP for e-mail services.
___ Authenticated users that require access will be permitted access to the second level of the resources in the SERVAUTH resource class. Examples are the network (NETACCESS), port (PORTACCESS), stack (STACKACCESS), and FTP resources in the SERVAUTH resource class.
___ The EZB.STACKACCESS. resource access authorizations restrict access to those started tasks with valid requirements and users with valid FTP access requirements.
___ The EZB.FTP.*.*.ACCESS.HFS) resource access authorizations restrict access to FTP users with specific written documentation showing a valid requirement exists to access OMVS files and Directories. |
| | Started tasks for the Base TCP/IP component must be defined in accordance with security requirements. | The TCP/IP started tasks require special privileges and access to sensitive resources to provide its system services. Failure to properly define and control these TCP/IP started tasks could lead to unauthorized access. This exposure may result in the compromise of the integrity and availability of the operating system environment, ACP, and customer data. | | a) Refer to the following reports produced by the RACF Data Collection:
- RACFCMDS.RPT(LISTUSER)
- DSMON.RPT(RACSPT)
b) Ensure the following items are in effect for the userid(s) assigned to the TCP/IP address space(s):
1) Named TCPIP or, in the case of multiple instances, prefixed with TCPIP
2) Defined as a PROTECTED userid
3) z/OS UNIX attributes: UID(0), HOME directory '/', shell program /bin/sh
4) A matching entry in the STARTED resource class exists enabling the use of the standard userid(s) and appropriate group
c) Ensure the following items are in effect for the userid assigned to the EZAZSSI started task:
1) Named EZAZSSI
2) Defined as a PROTECTED userid
3) A matching entry in the STARTED resource class exists enabling the use of the standard userid and appropriate group.
d) If all of the items in (b) and (c) are true, there is NO FINDING.
e) If any item in (b) or (c) is untrue, this is a FINDING. |
| | MVS data sets for the Base TCP/IP component are not properly protected, | MVS data sets of the Base TCP/IP component provide the configuration, operational, and executable properties of IBMs TCP/IP system product. Failure to properly secure these data sets may lead to unauthorized access resulting in the compromise of the integrity and availability of the operating system environment, ACP, and customer data. Configure CustomDsnType to define a custom DSN type for the sens (sensitive data sets) table. | | a) Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(TCPRPT)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ITCP0070)
b) Ensure the following data set controls are in effect for the Base TCP/IP component:
1) WRITE and ALLOCATE access to product data sets is restricted to systems programming personnel (i.e., SMP/E distribution data sets with the prefix SYS1.TCPIP.AEZA and target data sets with the prefix SYS1.TCPIP.SEZA).
2) WRITE and ALLOCATE access to the data set(s) containing the Data and Profile configuration files is restricted to systems programming personnel.
NOTE: If any INCLUDE statements are specified in the Profile configuration file, the named MVS data sets have the same access authorization requirements.
3) WRITE and ALLOCATE access to the data set(s) containing the Data and Profile configuration files is logged.
NOTE: If any INCLUDE statements are specified in the Profile configuration file, the named MVS data sets have the same logging requirements.
4) WRITE and ALLOCATE access to the data set(s) containing the configuration files shared by TCP/IP applications is restricted to systems programming personnel.
c) If all of the items in (b) are true, there is NO FINDING.
d) If any item in (b) is untrue, this is a FINDING.
NOTE: For systems running the TSS ACP replace the WRITE and ALLOCATE with WRITE, UPDATE, CREATE, CONTROL, SCRATCH, and ALL. |
| | PROFILE.TCPIP configuration statements for the TN3270 Telnet Server must be properly specified. | The PROFILE.TCPIP configuration file provides system operation and configuration parameters for the TN3270 Telnet Server. Several of these parameters have potential impact to system security. Failure to code the appropriate values could result in unexpected operations and degraded security. This exposure may result in unauthorized access impacting data integrity or the availability of some system services. | | a) Refer to the Profile configuration file specified on the PROFILE DD statement in the TCPIP started task JCL.
Automated Analysis requires Additional Analysis.
Refer to the following report produced by the IBM Communications Server Data Collection:
- PDI(ITNT0010)
b) Ensure the following items are in effect for the configuration statements specified in the TCP/IP Profile configuration file:
NOTE: If the INCLUDE statement is coded in the TCP/IP Profile configuration file, the data set specified on this statement must be checked for the following items as well.
TELNETGLOBAL Block (only one defined)
1) The KEYRING statement, if used, is only coded within the TELNETGLOBALS statement block.
2) The KEYRING statement, if used, specifies the SAF parameter.
TELNETPARMS Block (one defined for each port the server is listening to, typically ports 23 and 992)
1) The TELNETPARMS INACTIVE statement is coded within each TELNETPARMS statement block and specifies a value between 1 and 900.
NOTE: Effective in z/OS release 1.2, the INACTIVE statement can appear in both TELNETGLOBAL and TELNETPARM statement blocks.
2) The TELNETPARMS TKOSPECLURECON statement is not coded or commented out.
BEGINVTAM Block (one or more defined)
1) The BEGINVTAM RESTRICTAPPL statement is not be coded or commented out.
c) If all of the above are true, there is NO FINDING.
d) If any of the above is untrue, this is a FINDING. |
| | VTAM session setup controls for the TN3270 Telnet Server must be properly specified. | After a connection from a Telnet client to the TN3270 Telnet Server has been established, the process of session setup with a VTAM application occurs. A number of BEGINVTAM statements must be coded in a specific configuration to ensure adequate control to VTAM applications is maintained. Failure to code the appropriate statements could result in unauthorized access to the host and application resources. This exposure may impact data integrity or the availability of some system services. | | a) Refer to the Profile configuration file specified on the PROFILE DD statement in the TCPIP started task JCL.
Automated Analysis requires Additional Analysis.
Refer to the following report produced by the IBM Communications Server Data Collection:
- PDI(ITNT0020)
b) Ensure the following items are in effect for the configuration statements specified in the TCP/IP Profile configuration file:
NOTE: If the INCLUDE statement is coded in the TCP/IP Profile configuration file, the data set specified on this statement must be checked for the following items as well.
1) Within each BEGINVTAM statement block, one BEGINVTAM USSTCP statement is coded that specifies only the table name operand. No client identifier, such as host name or IP address, is specified so the statement applies to all connections not otherwise controlled.
2) The USS table specified on each "back stop" USSTCP statement mentioned in Item (1) above is coded to allow access only to session manager applications and NC PASS applications.
3) Within each BEGINVTAM statement block, additional BEGINVTAM USSTCP statements that specify a USS table that allows access to other applications may be coded only if the statements include a client identifier operand that references only secure terminals.
4) Any BEGINVTAM DEFAULTAPPL statement that does not specify a client identifier, or specifies any type of client identifier that would apply to unsecured terminals, specifies a session manager application or an NC PASS application as the application name.
5) Any BEGINVTAM LUMAP statement, if used with the DEFAPPL operand and applied to unsecured terminals, specifies only a session manager application or an NC PASS application.
NOTE: The BEGINVTAM LINEMODEAPPL requirements will not be reviewed at this time. Further testing must be performed to determine how the CL/Supersession and NC-PASS applications work with line mode.
c) If all of the above are true, there is NO FINDING.
d) If any of the above is untrue, this is a FINDING. |
| | SSL encryption options for the TN3270 Telnet Server will be specified properly for each statement that defines a SECUREPORT or within the TELNETGLOBALS. | During the SSL connection process a mutually acceptable encryption algorithm is selected by the server and client. This algorithm is used to encrypt the data that subsequently flows between the two. However, the level or strength of encryption can vary greatly. Certain configuration options can allow no encryption to be used and others can allow a relatively weak 40-bit algorithm to be used. Failure to properly enforce adequate encryption strength could result in the loss of data privacy. | | Refer to the Profile configuration file specified on the PROFILE DD statement in the TCPIP started task JCL.
Automated Analysis
Refer to the following report produced by the IBM Communications Server Data Collection:
- PDI(ITNT0050)
If the following items are in effect for the configuration specified in the TCP/IP Profile configuration file, this is not a finding.
NOTE: If an INCLUDE statement is coded in the TCP/IP Profile configuration file, the data set specified on this statement must be checked for the following items as well.
NOTE: FIPS 140-2 minimum encryption is the accepted level of encryption and will override this requirement if greater.
___ The TELNETGLOBALS block that specifies an ENCRYPTION statement states one or more of the below cipher specifications.
___ Each TELNETPARMS block that specifies the SECUREPORT statement, specifies an ENCRYPTION statement states one or more of the below cipher specifications. And the TELNETGLOBALS block does or does not specify an ENCRYPTION statement.
Cipher Specifications
SSL_3DES_SHA
SSL_AES_256_SHA
SSL_AES_128_SHA |
| | SMF recording options for the TN3270 Telnet Server must be properly specified. | The TN3270 Telnet Server can provide audit data in the form of SMF records. The SMF data produced provides information about individual sessions. This data includes the VTAM application, the remote and local IP addresses, and the remote and local IP port numbers. Failure to collect and retain audit data may contribute to the loss of accountability and hamper security audit activities. | | Refer to the Profile configuration file specified on the PROFILE DD statement in the TCPIP started task JCL.
Automated Analysis.
Refer to the following report produced by the IBM Communications Server Data Collection:
- PDI(ITNT0060)
- PDIx(ITNT0060) Note: Created when sites have multiple TCP/IP and FTP started task procedures.
Ensure the following configuration statement settings are in effect in the TCP/IP Profile configuration data set. If the following guidance is true, this is not a finding.
NOTE: If the INCLUDE statement is coded in the TCP/IP Profile configuration data set, the data set specified on this statement must be checked for the following items as well.
___ The TELNETPARMS SMFINIT statement is coded with the TYPE119 operand within each TELNETPARMS statement block.
___ The TELNETPARMS SMFTERM statement is coded with the TYPE119 operand within each TELNETPARMS statement block.
NOTE: Effective in z/OS release 1.2, the SMFINIT and SMFTERM statement can appear in both TELNETGLOBAL and TELNETPARM statement blocks. |
| | The startup user account for the z/OS UNIX Telnet Server is not defined properly. | The z/OS UNIX Telnet Server (i.e., otelnetd) requires a UID(0) to provide its system services. After the user enters their userid and password, otelnetd switches to the security context of the users account. Because the otelnetd account is only used until authentication is completed, there is no need to require a unique account for this function. This limits the number of privileged accounts defined to the ACP and reduces the exposure potential. Failure to properly define and control otelnetd could lead to unauthorized access resulting in the compromise of the integrity and availability of the operating system environment, ACP, and customer data. | | a) Refer to the following report produced by the UNIX System Services Data Collection:
- USSCMDS.RPT(EINETD)
b) If the otelnetd command specifies OMVS or OMVSKERN as the user, there is NO FINDING.
c) If the otelnetd command specifies any user other than OMVS or OMVSKERN, this is a FINDING. |
| | Startup parameters for the z/OS UNIX Telnet Server are not specified properly. | The z/OS UNIX Telnet Server (i.e., otelnetd) provides interactive access to the z/OS UNIX shell. During the initialization process, startup parameters are read to define the characteristics of each otelnetd instance. Some of these parameters have an impact on system security. Failure to specify the appropriate command options could result in degraded security. This exposure may result in unauthorized access impacting data integrity or the availability of some system services. | | a) Refer to the following report produced by the UNIX System Services Data Collection:
- USSCMDS.RPT(EINETD)
b) Ensure the following items are in effect for the otelnetd startup command:
1) Option -D login is included on the otelnetd command.
2) Option -c 900 is included on the otelnetd command.
NOTE: 900 indicates a session timeout value of 15 minutes and is currently the maximum value allowed.
3) Option -h is not included on the otelnetd command.
c) If all of the items in (b) are true, there is NO FINDING.
d) If any item in (b) is untrue, this is a FINDING. |
| | HFS objects for the z/OS UNIX Telnet Server will be properly protected. | HFS directories and files of the z/OS UNIX Telnet Server provide the configuration and executable properties of this product. Failure to properly secure these objects may lead to unauthorized access resulting in the compromise of the integrity and availability of the operating system environment, ACP, and customer data. | | Refer to the following report produced by the UNIX System Services Data Collection:
- USSCMDS.RPT(IUTN0040)
Refer to the following report produced by the IBM Communications Server Data Collection:
- PDI(ZUTN0040)
The HFS permission bits and user audit bits for each directory and file match or are more restrictive than the specified settings listed in the table. If the guidance is true, this is not a finding.
z/OS UNIX TELNET Server HFS Object Security Settings
File Permission Bits User Audit Bits
/usr/sbin/otelnetd 1740 fff
/etc/banner 0744 faf
NOTE:
The /usr/sbin/otelnetd object is a symbolic link to /usr/lpp/tcpip/sbin/otelnetd. The permission and user audit bits on the target of the symbolic link must have the required settings.
The following represents a hierarchy for permission bits from least restrictive to most restrictive:
7 rwx (least restrictive)
6 rw-
3 -wx
2 -w-
5 r-x
4 r--
1 --x
0 --- (most restrictive)
The possible audit bits settings are as follows:
f log for failed access attempts
a log for failed and successful access
- no auditing |
| | The FTP Server daemon is not defined with proper security parameters. | The FTP Server daemon requires special privileges and access to sensitive resources to provide its system services. Failure to properly define and control the FTP Server daemon could lead to unauthorized access. This exposure may result in the compromise of the integrity and availability of the operating system environment, ACP, and customer data. | | a) Refer to the following reports produced by the RACF Data Collection:
- RACFCMDS.RPT(LISTUSER)
- DSMON.RPT(RACSPT)
Refer to the JCL procedure libraries defined to JES2.
b) Ensure the following items are in effect for the FTP daemon:
1) The FTP daemon is started from a JCL procedure library defined to JES2.
NOTE: The JCL member is typically named FTPD
2) The FTP daemon userid is FTPD.
3) The FTPD userid is defined as a PROTECTED userid.
4) The FTPD userid has the following z/OS UNIX attributes: UID(0), HOME directory '/', shell program /bin/sh.
5) A matching entry in the STARTED resource class exists enabling the use of the standard userid and appropriate group.
c) If all of the items in (b) are true, there is NO FINDING.
d) If any item in (b) is untrue, this is a FINDING. |
| | The startup parameters for the FTP include the ANONYMOUS, ANONYMOUS=, or INACTIVE keywords. The FTP daemon's started task JCL does not specify the SYSTCPD and SYSFTPD DD statements for configuration files. | During initialization, the FTP daemon reads JCL keywords and configuration files to determine values for critical operational parameters. Because system security is impacted by some of these parameter settings, controlling these options through the configuration file only and explicitly specifying the file locations reduces ambiguity, enhances security auditing, and ensures proper operations. Inappropriate values could result in undesirable operations and degraded security. This exposure may result in unauthorized access impacting data integrity or the availability of some system services. | | a) Display the active started tasks executing on the domain using SDSF, or equivalent JES display product, and locate the FTP daemon.
If FTP is inactive, review the procedure libraries defined to JES2 and locate the FTP JCL member.
NOTE: The JCL member is typically named FTPD.
Refer to the Profile configuration file specified on the PROFILE DD statement in the TCPIP started task JCL.
Automated Analysis
Refer to the following report produced by the IBM Communications Server Data Collection:
- PDI(IFTP0020)
b) Ensure the following items are in effect for the FTP daemon's started task JCL:
1) The SYSTCPD and SYSFTPD DD statements specify the TCP/IP Data and FTP Data configuration files respectively.
2) The ANONYMOUS keyword is not coded on the PARM parameter on the EXEC statement.
3) The ANONYMOUS=logonid combination is not coded on the PARM parameter on the EXEC statement.
4) The INACTIVE keyword is not coded on the PARM parameter on the EXEC statement.
c) The AUTOLOG statement block can be configured to have TCP/IP start the FTP Server. The FTP entry (e.g., FTPD) can include the PARMSTRING parameter to pass parameters to the FTP procedure when started.
NOTE: Parameters passed on the PARMSTRING parameter override parameters specified in the FTP procedure.
If an FTP entry is configured in the AUTOLOG statement block in the TCP/IP Profile configuration file, ensure the following items are in effect:
1) The ANONYMOUS keyword is not coded on the PARMSTRING parameter.
2) The ANONYMOUS=logonid combination is not coded on the PARMSTRING parameter.
3) The INACTIVE keyword is not coded on PARMSTRING parameter.
d) If all of the items in (b) and (c) are true, there is NO FINDING.
e) If any item in (b) or (c) is untrue, this is a FINDING. |
| | FTP.DATA configuration statements for the FTP Server are not specified in accordance with requirements. | The statements in the FTP.DATA configuration file specify the parameters and values that control the operation of the FTP Server components including the use of anonymous FTP. Several of the parameters must have specific settings to provide a secure configuration. Inappropriate values could result in undesirable operations and degraded security. This exposure may result in unauthorized access impacting data integrity or the availability of some system services. | | a) Refer to the Data configuration file specified on the SYSFTPD DD statement in the FTP started task JCL.
Automated Analysis
Refer to the following report produced by the IBM Communications Server Data Collection:
- PDI(IFTP0030)
b) Ensure the following items are in effect for the configuration statements specified in the FTP Data configuration file:
1) The ANONYMOUS statement is not coded (does not exist) or, if it does exist, it is commented out.
NOTE: Other statements prefixed with ANONYMOUS may be present. These statements indicate the level of anonymous support and applicable restrictions if anonymous support is enabled using the ANONYMOUS statement. These other ANONYMOUS-prefixed statements may be ignored.
2) The INACTIVE statement is coded with a value between 1 and 900 (seconds).
NOTES: 900 indicates a session timeout value of 15 minutes.
0 disables the inactivity timer check.
3) The UMASK statement is coded with a value of 077.
4) The BANNER statement is coded.
c) If all of the above are true, there is NO FINDING.
d) If any of the above is untrue, this is a FINDING.
FTP.DATA CONFIGURATION STATEMENTS
STATEMENT NOT CODED,
CODED WITHOUT VALUE,
OR PARAMETER VALUE
ANONYMOUS [Not Coded]
BANNER [An HFS file, e.g., /etc/ftp.banner]
INACTIVE [A value between 1 and 900 ]
UMASK 077 |
| | User exits for the FTP Server must not be used without proper approval and documentation. | Several user exit points in the FTP Server component are available to permit customization of its operating behavior. These exits can be used to modify functions such as FTP command usage, client connection controls, post processing tasks, and SMF record modifications. Without proper review and adequate documentation of these exit programs, undesirable operations and degraded security may result. This exposure could lead to unauthorized access impacting data integrity or the availability of some system services, or contribute to the loss of accountability and hamper security audit activities. | | a) Refer to the Data configuration file specified on the SYSFTPD DD statement in the FTP started task JCL.
Refer to the file(s) allocated by the STEPLIB DD statement in the FTP started task JCL.
Refer to the libraries specified in the system Linklist and LPA.
If any FTP Server exits are in use, identify them and validate that they were reviewed for integrity and approved by the site AO.
b) Ensure the following items are in effect for FTP Server user exits:
The FTCHKCMD, FTCHKIP, FTCHKJES, FTCHKPWD, FTPSMFEX and FTPOSTPR modules are not located in the FTP daemon's STEPLIB, Linklist, or LPA.
NOTE: The ISPF ISRFIND utility can be used to search the system Linklist and LPA for specific modules.
c) If both of the above are true, there is no finding.
d) If any FTP Server user exits are implemented and the site has written approval from site ISSM to install and use the exits, there is no finding.
e) If any FTP Server user exits are implemented and the site has not had the site systems programmer verify the exit was securely written and installed, this is a finding. |
| | SMF recording options for the FTP Server must be configured to write SMF records for all eligible events. | The FTP Server can provide audit data in the form of SMF records. The SMF data produced by the FTP Server provides transaction information for both successful and unsuccessful FTP commands. Failure to collect and retain audit data may contribute to the loss of accountability and hamper security audit activities. | | Refer to the Data configuration file specified on the SYSFTPD DD statement in the FTP started task JCL.
Automated Analysis
Refer to the following report produced by the IBM Communications Server Data Collection:
- PDI(IFTP0060)
Ensure the following configuration statement settings are in effect in the FTP Data configuration data set. If the following guidance is true, this is not a finding.
Ensure the following items are in effect for the configuration statements specified in the FTP Data configuration file:
___ The SMF statement is coded with a value of TYPE119.
___ The SMFJES and SMFSQL statements are coded without any additional values.
___ The SMFAPPE, SMFDEL, SMFEXIT, SMFLOGN, SMFREN, SMFRETR, and SMFSTOR statements are not coded or commented out.
FTP.DATA Configuration Statements
SMF TYPE119
SMFJES TYPE119
SMFSQL TYPE119
SMFAPPE [Not coded or commented out]
SMFDEL [Not coded or commented out]
SMFEXIT [Not coded or commented out]
SMFLOGN [Not coded or commented out]
SMFREN [Not coded or commented out]
SMFRETR [Not coded or commented out]
SMFSTOR [Not coded or commented out]
Note: SMF, SMFJES, and SMFSQL may be duplicated in configuration, but one of the entries must specify TYPE119. |
| | The permission bits and user audit bits for HFS objects that are part of the FTP Server component will be properly configured. | HFS directories and files of the FTP Server provide the configuration and executable properties of this product. Failure to properly secure these objects may lead to unauthorized access resulting in the compromise of the integrity and availability of the operating system environment, ACP, and customer data. | | Refer to the following report produced by the UNIX System Services Data Collection:
- USSCMDS.RPT(IFTP0070)
Refer to the following report produced by the IBM Communications Server Data Collection:
- PDI(IFTP0070)
The HFS permission bits and user audit bits for each directory and file match or are more restrictive than the specified settings listed in the table. If the guidance is true, this is not a finding.
FTP Server HFS Object Security Settings
File Permission Bits User Audit Bits
/usr/sbin/ftpd 1740 fff
/usr/sbin/ftpdns 1755 fff
/usr/sbin/tftpd 0644 faf
/etc/ftp.data 0744 faf
/etc/ftp.banner 0744 faf
NOTES: Some of the files listed above are not used in every configuration. The absence of a file is not considered a finding.
The /usr/sbin/ftpd and /usr/sbin/ftpdns objects are symbolic links to /usr/lpp/tcpip/sbin/ftpd and /usr/lpp/tcpip/sbin/ftpdns respectively. The permission and user audit bits on the targets of the symbolic links must have the required settings.
The /etc/ftp.data file may not be the configuration file the server uses. It is necessary to check the SYSFTPD DD statement in the FTP started task JCL to determine the actual file.
The TFTP Server does not perform any user identification or authentication, allowing any client to connect to the TFTP Server. Due to this lack of security, the TFTP Server will not be used. The TFTP Client is not secured from use. The permission bits for /usr/sbin/tftpd should be set to 644.
The /etc/ftp.banner file may not be the banner file the server uses. It is necessary to check the BANNER statement in the FTP Data configuration file to determine the actual file. Also, the permission bit setting for this file must be set as indicated in the table above. A more restrictive set of permissions is not permitted.
The following represents a hierarchy for permission bits from least restrictive to most restrictive:
7 rwx (least restrictive)
6 rw-
3 -wx
2 -w-
5 r-x
4 r--
1 --x
0 --- (most restrictive)
The possible audit bits settings are as follows:
f log for failed access attempts
a log for failed and successful access
- no auditing |
| | MVS data sets for the FTP Server are not properly protected. | MVS data sets of the FTP Server provide the configuration and operational characteristics of this product. Failure to properly secure these data sets may lead to unauthorized access resulting in the compromise of the integrity and availability of customer data and some system services. | | a) Refer to the following report produced by the ACF2 Data Collection:
- SENSITVE.RPT(FTPRPT)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(IFTP0080)
b) Ensure the following data set controls are in effect for the FTP Server:
1) WRITE and ALLOCATE access to the data set containing the FTP Data configuration file is restricted to systems programming personnel.
NOTE: READ access to all authenticated users is permitted.
2) WRITE and ALLOCATE access to the data set containing the FTP Data configuration file is logged.
3) WRITE and ALLOCATE access to the data set containing the FTP banner file is restricted to systems programming personnel.
4) READ access to the data set containing the FTP banner file is permitted to all authenticated users.
NOTES: The MVS data sets mentioned above are not used in every configuration. Absence of a data set will not be considered a FINDING.
The data set containing the FTP Data configuration file is determined by checking the SYSFTPD DD statement in the FTP started task JCL.
The data set containing the FTP banner file is determined by checking the BANNER statement in the FTP Data configuration file.
b) If all of the items in (b) are true, there is NO FINDING.
c) If any item in (b) is untrue, this is a FINDING. |
| | The TFTP Server program is not properly protected. | The Trivial File Transfer Protocol (TFTP) Server, known as tftpd, supports file transfer according to the industry standard Trivial File Transfer Protocol. The TFTP Server does not perform any user identification or authentication, allowing any client to connect to the TFTP Server. Due to this lack of security, the TFTP Server will not be used. Failure to restrict the use of the TFTP Server may result in unauthorized access to the host. This exposure may impact the integrity, availability, and privacy of application data. | | a) Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(PROGRAM)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(IFTP0090)
b) Ensure the following program controls are in effect for the TFTP Server:
1) Program resources TFTPD and EZATD are defined to the PROGRAM resource class with a UACC(NONE). The library name where these programs are located is SYS1.TCPIP.SEZALOAD.
2) No access to the program resources TFTPD and EZATD is permitted.
c) If both the items in (b) are true, there is NO FINDING.
d) If any item in (b) is untrue, this is a FINDING. |
| | The Syslog daemon is not started at z/OS initialization. | The Syslog daemon, known as SYSLOGD, is a z/OS UNIX daemon that provides a central processing point for log messages issued by other z/OS UNIX processes. The messages may be of varying importance levels including general process information, diagnostic information, critical error notification, and audit-class information. It is important that SYSLOGD be started during the initialization phase of the z/OS system to ensure that significant messages are not lost. Failure to collect and retain audit data may contribute to the loss of accountability and hamper security audit activities. | | a) Refer to the following report produced by the UNIX System Services Data Collection:
- USSCMDS.RPT(ERC)
Refer to the following report produced by the z/OS Data Collection:
- EXAM.RPT(PARMLIB)
NOTE: SYSLOGD may be started from the shell, a cataloged procedure (STC), or the BPXBATCH program. Additionally, other mechanisms (e.g., CONTROL-O) may be used to automatically start the Syslog daemon. To thoroughly analyze this PDI you may need to view the OS SYSLOG using SDSF, find the last IPL, and look for the initialization of SYSLOGD.
b) If the Syslog daemon SYSLOGD is started automatically during the initialization of the z/S/ system, there is NO FINDING.
c) If (b) is untrue, this is a FINDING. |
| | The Syslog daemon must be properly defined and secured. | The Syslog daemon, known as syslogd, is a zOS UNIX daemon that provides a central processing point for log messages issued by other zOS UNIX processes. It is also possible to receive log messages from other network-connected hosts. Some of the IBM Communications Server components that may send messages to syslog are the FTP, TFTP, zOS UNIX Telnet, DNS, and DHCP servers. The messages may be of varying importance levels including general process information, diagnostic information, critical error notification, and audit-class information. Primarily because of the potential to use this information in an audit process, there is a security interest in protecting the syslogd process and its associated data.
The Syslog daemon requires special privileges and access to sensitive resources to provide its system services. Failure to properly define and control the Syslog daemon could lead to unauthorized access. This exposure may result in the compromise of the integrity and availability of the operating system environment, ACP, and customer data. | | Refer to the following reports produced by the RACF Data Collection:
- RACFCMDS.RPT(LISTUSER)
- DSMON.RPT(RACSPT)
Refer to the following report produced by the UNIX System Services Data Collection:
- USSCMDS.RPT(ERC) - Refer to this report if the Syslog daemon is started from /etc/rc.
Refer to the JCL procedure libraries defined to JES2.
Ensure that the Syslog daemon is properly defined and protected as stated below. If the following guidance is true, this is not a finding.
___ The Syslog daemon userid is SYSLOGD.
___ The SYSLOGD userid is defined as a PROTECTED userid.
___ The SYSLOGD userid has UID(0), HOME('/'), and PROGRAM('/bin/sh') specified in the OMVS segment.
___ A matching entry mapping the SYSLOGD started proc to the SYSLOGD userid is in the STARTED resource class.
___ If Syslog daemon is started from /etc/rc then ensure that the _BPX_JOBNAME and _BPX_USERID environment variables are assigned a value of SYSLOGD. |
| | The permission bits and user audit bits for HFS objects that are part of the Syslog daemon component will be configured properly. | HFS directories and files of the Syslog daemon provide the configuration and executable properties of this product. Failure to properly secure these objects could lead to unauthorized access. This exposure may result in the compromise of the integrity and availability of the operating system environment, ACP, and customer data. | | Refer to the following report produced by the UNIX System Services Data Collection:
- USSCMDS.RPT(ISLG0030)
Refer to the following report produced by the IBM Communications Server Data Collection:
- PDI(ISLG0030)
The HFS permission bits and user audit bits for each directory and file match or are more restrictive than the specified settings listed in the table. If the guidance is true, this is not a finding.
SYSLOG Daemon HFS Object Security Settings
File Permission Bits User Audit Bits
/usr/sbin/syslogd 1740 fff
[Configuration File]
/etc/syslog.conf 0744 faf
[Output log file defined in the configuration file]
0744 fff
NOTES:
The /usr/sbin/syslogd object is a symbolic link to /usr/lpp/tcpip/sbin/syslogd. The permission and user audit bits on the target of the symbolic link must have the required settings.
The /etc/syslog.conf file may not be the configuration file the daemon uses. It is necessary to check the script or JCL used to start the daemon to determine the actual configuration file. For example, in /etc/rc:
_BPX_JOBNAME='SYSLOGD' /usr/sbin/syslogd -f /etc/syslog.conf
For example, in the SYSLOGD started task JCL:
//SYSLOGD EXEC PGM=SYSLOGD,REGION=30M,TIME=NOLIMIT
// PARM='POSIX(ON) ALL31(ON)/ -f /etc/syslogd.conf'
//SYSLOGD EXEC PGM=SYSLOGD,REGION=30M,TIME=NOLIMIT
// PARM='POSIX(ON) ALL31(ON) /-f //''SYS1.TCPPARMS(SYSLOG)'''
The following represents a hierarchy for permission bits from least restrictive to most restrictive:
7 rwx (least restrictive)
6 rw-
3 -wx
2 -w-
5 r-x
4 r--
1 --x
0 --- (most restrictive)
The possible audit bits settings are as follows:
f log for failed access attempts
a log for failed and successful access
- no auditing |
| | User accounts defined to the ACP do not uniquely identify system users. | System users must be uniquely identified to the operating system. To accomplish this, each user must have an individual account defined to the ACP. If user accounts are not associated with specific individuals and are shared among multiple users, individual accountability is lost. This could hamper security audit activities and lead to unauthorized user access of system resources and customer data.
. Scope of, ownership of and responsibility over users shall be based upon the specifics of appointment, role, responsibilities and level of authority. Such as a domain/system level IAO is responsible for the Domain/system level users, whereas normally a application user would be the responsibility of the DoD AIS application security team unless SLA indicates otherwise. | | a) The IAO will provide a list of all userids that are shared among multiple users(i.e not uniquely identified system users).
b) If there are no shared userids on this domain, there is NO FINDING.
c) If there are shared userids on this domain, this is a FINDING.
NOTE: Userids should be able to be traced back to a current DD2875 or a Vendor Requirement (example: A Started Task). |
| | DFSMS control data sets must be protected in accordance with security requirements. | DFSMS control data sets provide the configuration and operational characteristics of the system-managed storage environment. Failure to properly protect these data sets may result in unauthorized access. This exposure could compromise the availability and integrity of some system services and customer data. | | a) Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(SMSRPT)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ZSMS0020)
b) Review the logical parmlib data sets, example: SYS1.PARMLIB(IGDSMSxx), to identify the fully qualified file names for the following SMS data sets:
Source Control Data Set (SCDS)
Active Control Data Set (ACDS)
Communications Data Set (COMMDS)
Automatic Class Selection Routine Source Data Sets (ACS)
ACDS Backup
COMMDS Backup
c) If the RACF data set rules for the SCDS, ACDS, COMMDS, and ACS data sets restrict UPDATE and ALTER access to only systems programming personnel, this is not a finding.
d) If the RACF data set rules for the SCDS, ACDS, COMMDS, and ACS data sets do not restrict UPDATE and ALTER access to only systems programming personnel, this is a finding.
Note: At the discretion of the ISSM, DASD administrators are allowed UPDATE access to the control datasets. |
| | SYS(x).Parmlib(IEFSSNxx) SMS configuration parameter settings are not properly specified. | Configuration properties of DFSMS are specified in various members of the system parmlib concatenation (e.g., SYS1.PARMLIB). Statements within these PDS members provide the execution, operational, and configuration characteristics of the system-managed storage environment. Missing or inappropriate configuration values may result in undesirable operations and degraded security. This exposure could potentially compromise the availability and integrity of some system services and customer data. | | a) Review the SYS1.PARMLIB(IEFSSNxx) data set for the following SMS parameter settings:
1) Keyword syntax:
SUBSYS SUBNAME(SMS) INITRTN(IGDSSIIN)
2) Positional syntax:
SMS, IGDSSIIN
b) If the required parameters are defined, there is NO FINDING.
c) If the required parameters are not defined, this is a FINDING. |
| | MVS data sets for the WebSphere Application Server are not protected in accordance with the proper security requirements. | MVS data sets provide the configuration, operational, and executable properties of the WebSphere Application Server (WAS) environment. Failure to properly protect these data sets may lead to unauthorized access. This exposure could compromise the integrity and availability of system services, applications, and customer data. | | a) Refer to the following reports produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(HTTPRPT)
- SENSITVE.RPT(WASRPT)
b) Ensure the following data set controls are in effect for WAS:
___ The ACP data set rules restrict UPDATE and ALTER access to HTTP product data sets (i.e., SYS1.IMW.AIMW** and SYS1.IMW.SIMW**) is restricted to systems programming personnel.
NOTE: If the HTTP server is not used with WAS, this check can be ignored.
___ The ACP data set rules restrict UPDATE and ALTER access to WAS product data sets and associated product data sets are restricted to systems programming personnel.
SYS*.EJS.V3500108.** (WebSphere 3.5)
SYS*.WAS.V401.** (WebSphere 4.0.1)
SYS*.OE.** (Java)
SYS*.JAVA** (Java)
SYS*.DB2.V710107.** (DB2)
SYS*.GLD.** (LDAP)
SYS1.LE.** (Language Environment)
c) If all of the items in (b) are true, there is NO FINDING.
d) If any item in (b) is untrue, this is a FINDING. |
| | The CBIND Resource Class for the WebSphere Application Server is not configured in accordance with security requirements. | SAF resources provide the ability to control access to functions and services of the WebSphere Application Server (WAS) environment. Many of these resources provide operational and administrative support for WAS. Failure to properly protect these resources may lead to unauthorized access. This exposure could compromise the integrity and availability of application services and customer data. | | a) Refer to the following reports produced by the RACF Data Collection:
- SENSITVE.RPT(CBIND)
- RACFCMDS.RPT(SETROPTS)
- DSMON.RPT(RACCDT) - Alternate list of active resource classes
b) Ensure the following items are in effect for CBIND resource protection:
1) The CBIND resource class is active.
2) The CB.BIND.server_name resource is defined to the CBIND resource class with a UACC(NONE).
3) Access to the CB.BIND.server_name resource is restricted to WAS server (STC) userids and systems management userids (e.g., WebSphere administrator ID).
c) If all items in (b) are true, there is NO FINDING.
b) If any item in (b) is untrue, this is a FINDING. |
| | Vendor-supplied user accounts for the WebSphere Application Server must be defined to the ACP. | Vendor-supplied user accounts are defined to the ACP with factory-set passwords during the installation of the WebSphere Application Server (WAS). These user accounts are common to all WAS environments and have access to restricted resources and functions. Failure to delete vendor-supplied user accounts from the ACP may lead to unauthorized access. This exposure could compromise the integrity and availability of system services, applications, and customer data. | | a) Refer to the following report produced by the ACP Data Collection:
ACF2
- ACF2CMDS.RPT(LOGONIDS)
RACF
- RACFCMDS.RPT(LISTUSER)
TSS
- TSSCMDS.RPT(@ACIDS)
Automated Analysis requires Additional Analysis.
Refer to the following report produced by the z/OS Data Collection:
- PDI(ZWAS0040)
b) If the CBADMIN user account is not defined to the ACP, there is NO FINDING.
c) If the CBADMIN user account is defined to ACP and the password has NOT been changed from the vendor default of CBADMIN, this is a FINDING with a severity code of CAT I.
d) If the CBADMIN user account is defined to the ACP and the password has been changed from the vendor default of CBADMIN, this is a FINDING with a severity code of
CAT II. |
| | User timeout parameter values for WebSphere MQ queue managers are not specified in accordance with security requirements. | Users signed on to a WebSphere MQ queue manager could leave their terminals unattended for long periods of time. This may allow unauthorized individuals to gain access to WebSphere MQ resources and application data. This exposure could compromise the availability, integrity, and confidentiality of some system services and application data. | | a) Refer to the following report produced by the z/OS Data Collection:
- MQSRPT(ssid)
NOTE: ssid is the queue manager name (a.k.a., subsystem identifier).
Automated Analysis
Refer to the following report produced by the z/OS Data Collection:
- PDI(ZWMQ0020)
b) Review the ssid report(s) and perform the following steps:
1) Find the DISPLAY SECURITY command to locate the start of the security parameter settings.
2) Review the CSQH015I and CSQH016I messages to determine the Timeout and Interval parameter settings respectively.
3) Repeat these steps for each queue manager ssid.
The standard values are:
TIMEOUT(15)
INTERVAL(5)
c) If the Timeout and Interval values conform to the standard values, there is NO FINDING.
d) If the Timeout and/or Interval values do not conform to the standard values, this is a FINDING. |
| | WebSphere MQ started tasks are not defined in accordance with the proper security requirements. | Started tasks are used to execute WebSphere MQ queue manager services. Improperly defined WebSphere MQ started tasks may result in inappropriate access to application resources and the loss of accountability. This exposure could compromise the availability of some system services and application data. | | a) Refer to the following reports produced by the RACF Data Collection:
- DSMON.RPT(RACSPT)
- RACFCMDS.RPT(LISTUSER)
Provide a list of all WebSphere MQ Subsystem Ids (Queue managers) and Release levels.
b) Review WebSphere MQ started tasks and ensure the following items are in effect:
NOTE: ssid is the queue manager name (a.k.a., subsystem identifier).
ssidMSTR is the name of a queue manager STC.
ssidCHIN is the name of a distributed queuing (a.k.a., channel initiator) STC.
1) Each ssidMSTR and ssidCHIN started task is associated with a unique userid.
2) All ssidMSTR and ssidCHIN started tasks are defined to the STARTED resource class.
3) All ssidMSTR and ssidCHIN started tasks userid are defined as a PROTECTED.
c) If both of the items in (b) are true, there is NO FINDING.
d) If either item in (b) is untrue, this is a FINDING. |
| | WebSphere MQ all update and alter access to MQSeries/WebSphere MQ product and system data sets are not properly restricted | MVS data sets provide the configuration, operational, and executable properties of WebSphere MQ. Some data sets are responsible for the security implementation of WebSphere MQ. Failure to properly protect these data sets may lead to unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data. | | a) Refer to the following report produced by the ACP Data Collection:
- SENSITVE.RPT(MQSRPT)
b) Ensure ACP data sets rules for MQSeries/WebSphere MQ system data sets (e.g., SYS2.MQM.) restrict access as follows:
NOTE: ssid is the queue manager name (a.k.a., subsystem identifier).
___ READ access to data sets referenced by the following DDnames is restricted to MQSeries/WebSphere MQ STCs, MQSeries/WebSphere MQ administrators, and system programming personnel. All access to these data sets is logged.
DDname Procedure Description
CSQINP1 ssidMSTR Input parameters
CSQINP2 ssidMSTR Input parameters
CSQXLIB ssidCHIN User exit library
NOTE: WRITE/UPDATE and/or ALLOCATE/ALTER access to these data sets is restricted to MQSeries/WebSphere MQ administrators and systems programming personnel.
___ WRITE/UPDATE and/or ALLOCATE/ALTER access to data sets referenced by the following DDnames is restricted to MQSeries/WebSphere MQ STCs, MQSeries/WebSphere MQ administrators, and systems programming personnel. All WRITE and ALLOCATE access to these data sets is logged.
DDname Procedure Description
CSQPxxxx ssidMSTR Page data sets
BSDSx ssidMSTR Bootstrap data sets
CSQOUTx ssidMSTR SYSOUT data sets
CSQSNAP ssidMSTR DUMP data set
(See note) ssidMSTR Log data sets
NOTE: To determine the log data set names, review the JESMSGLG file of the ssidMSTR active task(s). Find CSQJ001I messages to obtain DSNs.
___ ALLOCATE/ALTER access to archive data sets is restricted to MQSeries/WebSphere MQ STCs, MQSeries/WebSphere MQ administrator, and system programming personnel. All ALLOCATE/ALTER access to these data sets is logged.
NOTE: To determine the archive data sets names, review the JESMSGLG file of the ssidMSTR active task(s). Find the CSQY122I message to obtain the ARCPRFX1 and ARCPRFX2 DSN HLQs.
___ Except for the specific data set requirements just mentioned, WRITE/UPDATE and/or ALLOCATE/ALTER access to all other MQSeries/WebSphere MQ system data sets is restricted to the MQSeries/WebSphere MQ administrator and system programming personnel.
c) If all the items in (b) are true, there is NO FINDING.
d) If any item in (b) is untrue, this is a FINDING. |
| | Allocate access to system user catalogs must be limited to system programmers only. | System catalogs are the basis for locating all files on the system. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data. | | a) Refer to the following reports produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(CATURPT) - User Catalogs
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ACP00135)
___ The ESM data set rules for System Catalogs allow inappropriate access.
___ The ESM data set rules for User Catalogs do not restrict ALTER access / ALTER and SCRATCH (TSS) to only z/OS systems programming personnel.
Access greater than "READ" for User Catalog is allowed to a batch job ID in the following specific case:
The batch job must reside in a data set that is restricted to systems programmers only.
___ The ESM data set rules for User Catalogs do not specify that all (i.e., failures and successes) ALTER access will be logged.
b) If all of the above are untrue, this is not a finding.
c) If any of the above is true, this is a finding. |
| | Non-existent or inaccessible Link Pack Area (LPA) libraries. | LPA libraries give a common access point for the general usage of modules. Many of the subsystems installed on a domain rely upon these modules for proper execution. If the list of libraries found in this LPA member is not properly maintained, the integrity of the operating environment is subject to compromise. | | STIG ID: AAMV0325 Default Severity: Category III Refer to the following reports produced by the z/OS Data Collection:
- PARMLIB.ACCESS(LPALSTxx)
- PARMLIB.ACCESS(IEAFIXxx)
- PARMLIB.ACCESS(IEALPAxx)
NOTE: The LPALSTxx, IEAFIXxx, and IEALPAxx reports are only produced if inaccessible libraries exist. The report names represent the actual SYS1.PARMLIB members where inaccessible libraries are found. If these reports do not exist, there is NO FINDING.
Automated Analysis
Refer to the following report produced by the z/OS Data Collection:
- PDI(AAMV0325)
b) If no inaccessible LPA libraries exist, there is NO FINDING.
c) If inaccessible LPA libraries do exist, this is a FINDING. |
| | CICS regions are improperly protected to prevent unauthorized propagation of the region userid. | CICS is a transaction-processing product that provides programmers with the facilities to develop interactive applications. Improperly defined or controlled CICS userids (i.e., region, default, and terminal users) may provide an exposure and vulnerability within the CICS environment. This could result in the compromise of the confidentiality, integrity, and availability of the CICS region, applications, and customer data. | | a) Refer to the following report produced by the RACF Data Collection:
- SENSITVE.RPT(PROPCNTL)
Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010.
b) Ensure the CICS region is defined to the PROPCNTL resource class.
c) If (b) are true, there is NO FINDING.
d) If (b) is untrue, this is a FINDING. |
| | NCP (Net Work Control Program) Data set access authorization does not restricts UPDATE and/or ALLOCATE access to appropriate personnel. | If components of the FEPs are not properly protected they can be stolen, damaged, or disturbed. Without adequate physical security, unauthorized users can access the control panel, the operator console, and the diskette drive of the service subsystem. Therefore, they can interfere with the normal operations of the FEPs. Improper control of FEP components could compromise network operations. | | a) Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(NCPRPT)
___ The ACP data set rules for NCP data sets allow inappropriate access.
___ The ACP data set rules for NCP data sets does not restrict UPDATE and/or ALL access to authorized personnel (e.g., systems programming personnel).
b) If both of the above are untrue, there is NO FINDING.
c) If either of the above is true, this is a FINDING. |
| | RJE workstations and NJE nodes are not controlled in accordance with security requirements. | JES2 RJE workstations and NJE nodes provide a method of sending and receiving data (e.g., jobs, job output, and commands) from remote locations. Failure to properly identify and control these remote facilities could result in unauthorized sources transmitting data to and from the operating system. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data. | | RJE Userids
Note that this guidance addresses RJE Workstations that are "Dedicated". If an RJE workstation is dedicated, the assumption is that the RJE to host connection is hard-wired between the RJE and host. In this case the RMT definition statement will contain the keyword LINE= which specifies that this RJE is only connected via that one LINE statement.
There are no known non-dedicated RJE Workstations in use within CSD. If such devices are used, the site should open a ticket with the FSO and jointly develop proper security controls.
a) Refer to the following report produced by the z/OS Data Collection:
- PARMLIB(JES2 parameters)
Refer to the following report produced by the RACF Data Collection:
- RACFCMDS.RPT(LISTUSER)
b) Review the JES2 parameters for RJE workstation definitions by searching for RMT( in the report.
c) Ensure the RJE workstation userids are defined as follows:
1) A userid of RMTnnnn is defined to RACF for each RJE workstation, where nnnn is the number on the RMT statement.
2) No userid segments (e.g., TSO, CICS, etc.) are defined.
3) Restricted from accessing all data sets and resources with exception of the corresponding JESINPUT class profile for that remote.
NOTE: Execute the JCL in CNTL(IRRUT100) using the RACF RMTnnnn userids as SYSIN input. This report lists all occurrences of these userids within the RACF database, including data set and resource access lists.
d) Ensure that a FACILITY-Class profile exists in the format RJE.RMTnnnn where nnn identifies the remote number.
e) If all of the above are true, there is NO FINDING.
f) If any of the above are untrue, this is a FINDING. |
| | RJE workstations and NJE nodes are not controlled in accordance with STIG requirements. | JES2 RJE workstations and NJE nodes provide a method of sending and receiving data (e.g., jobs, job output, and commands) from remote locations. Failure to properly identify and control these remote facilities could result in unauthorized sources transmitting data to and from the operating system. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data. | | a) Refer to the following report produced by the OS/390 Data Collection:
- PARMLIB(JES2 parameters)
Refer to the following report produced by the RACF Data Collection:
- SENSITVE.RPT(FACILITY)
b) Review the following resource definitions in the FACILITY resource class:
NJE.*
RJE.*
NJE.nodename
RJE.workstation
NOTE 1: Nodename is the NAME parameter value specified on the NODE statement. Review the JES2 parameters for NJE node definitions by searching for NODE( in the report.
NOTE 2: Workstation is RMTnnnn, where nnnn is the number on the RMT statement. Review the JES2 parameters for RJE workstation definitions by searching for RMT( in the report.
c) If all JES2 defined NJE nodes and RJE workstations have a profile defined in the FACILITY resource class, there is NO FINDING.
NOTE: NJE.* and RJE.* profiles will force userid and password protection of all NJE and RJE connections respectively. This method is acceptable in lieu of using discrete profiles.
d) If any JES2 defined NJE node or RJE workstation does not have a profile defined in the FACILITY resource class, this is a FINDING. |
| | JES2 input sources are not controlled in accordance with theh proper security requirements. | JES2 input sources provide a variety of channels for job submission. Failure to properly control the use of these input sources could result in unauthorized submission of work into the operating system. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data. | | a) Refer to the following reports produced by the RACF Data Collection and Data Set and Resource Data Collection:
- SENSITVE.RPT(JESINPUT)
- RACFCMDS.RPT(SETROPTS)
- DSMON.RPT(RACCDT) - Alternate list of active resource classes
Refer to the following report produced by the z/OS Data Collection:
- PARMLIB(JES2 parameters)
b) Review the following resources in the JESINPUT resource class:
INTRDR (internal reader for batch jobs)
nodename (NJE node)
OFFn.* (spool offload receiver)
Rnnnn (RJE workstation)
RDRnn (local card reader)
STCINRDR (internal reader for started tasks)
TSUINRDR (internal reader for TSO logons)
NOTE: If any of the following are not defined within the JES2 parameters, the resource in the JESINPUT resource class does not have to be defined.
NOTE 1: Nodename is the NAME parameter in the NODE statement. Review the NJE node definitions by searching for NODE( in the report.
NOTE 2: OFFn, where n is the number of the offload receiver. Review the spool offload receiver definitions by searching for OFF( in the report.
NOTE 3: Rnnnn, where nnnn is the number of the remote workstation. Review the RJE node definitions by searching for RMT( in the report.
NOTE 4: RDRnn, where nn is the number of the reader. Review the reader definitions by searching for RDR( in the report.
c) Ensure the following items are in effect:
1) The JESINPUT resource class is active.
2) The resources mentioned in (b) are protected by generic and/or fully qualified profiles defined to the JESINPUT resource class.
3) UACC(NONE) is specified for all resources.
NOTE: UACC(READ) is allowed for input sources that are permitted to submit jobs for all users. No guidance on which input sources are appropriate for UACC(READ). However, common sense should prevail during the analysis. For example, UACC(READ) would typically be inappropriate for RJE, NJE, offload, and STC input sources.
d) If all of the items mentioned in (c) are true, there is NO FINDING.
e) If any of the items mentioned in (c) is untrue, this is a FINDING. |
| | JES2 input sources must be properly controlled. | JES2 input sources provide a variety of channels for job submission. Failure to properly control the use of these input sources could result in unauthorized submission of work into the operating system. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data. | | Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(JESINPUT)
Verify that the accesses for JESINPUT resources are restricted. If the guidance is true, this is not a finding.
___ The RACF resources and/or generic equivalent are defined with a default access of NONE.
___ The RACF resources and/or generic equivalent identified below will be defined with access restricted to the appropriate personnel:
INTRDR
nodename
OFFn.*
OFFn.JR
OFFn.SR
Rnnnn.RDm
RDRnn
STCINRDR
TSUINRDR and/or TSOINRDR
NOTE: Use common sense during the analysis. For example, access to the offload input sources should be limited to systems personnel (e.g., operations staff).
___ The RACF resource access authorizations are defined with UACC(NONE) and NOWARNING. |
| | JES2 output devices are not controlled in accordance with the proper security requirements. | JES2 output devices provide a variety of channels to which output can be processed. Failure to properly control these output devices could result in unauthorized personnel accessing output. This exposure may compromise the confidentiality of customer data. | | WRITER Resource Definitions
a) Refer to the following reports produced by the RACF Data Collection:
- SENSITVE.RPT(WRITER)
- RACFCMDS.RPT(SETROPTS)
- DSMON.RPT(RACCDT) - Alternate list of active resource classes
Refer to the following reports produced by the z/OS Data Collection:
- EXAM.RPT(SUBSYS)
- PARMLIB(JES2 parameters)
b) Review the following resources in the WRITER resource class:
JES2.** (backstop profile)
JES2.LOCAL.OFFn.* (spool offload transmitter)
JES2.LOCAL.OFFn.ST (spool offload SYSOUT transmitter)
JES2.LOCAL.OFFn.JT (spool offload job transmitter)
JES2.LOCAL.PRTn (local printer)
JES2.LOCAL.PUNn (local punch)
JES2.NJE.nodename (NJE node)
JES2.RJE.Rnnnn.PRm (remote printer)
JES2.RJE.Rnnnn.PUm (remote punch)
NOTE 1: JES2 is typically the name of the JES2 subsystem. Refer to the SUBSYS report and locate the entry with the description of PRIMARY JOB ENTRY SUBSYSTEM. The SUBSYSTEM NAME of this entry is the name of the JES2 subsystem.
NOTE 2: OFFn, where n is the number of the offload transmitter. Determine the numbers by searching for OFF( in the JES2 parameters.
NOTE 3: PRTn, where n is the number of the local printer. Determine the numbers by searching for PRT( in the JES2 parameters.
NOTE 4: PUNn, where n is the number of the local card punch. Determine the numbers by searching for PUN( in the JES2 parameters.
NOTE 5: Nodename is the NAME parameter value specified on the NODE statement. Review the JES2 parameters for NJE node definitions by searching for NODE( in the report.
NOTE 6: Rnnnn.PRm, where nnnn is the number of the remote workstation and m is the number of the printer. Determine the numbers by searching for .PR in the JES2 parameters.
NOTE 7: Rnnnn.PUm, where nnnn is the number of the remote workstation and m is the number of the punch. Determine the numbers by searching for .PU in the JES2 parameters.
c) Ensure the following items are in effect:
1) The WRITER resource class is active.
2) The profile JES2.** is defined to the WRITER resource class with a UACC(NONE).
3) The other resources mentioned in (b) are protected by generic and/or fully qualified profiles defined to the WRITER resource class with UACC(NONE).
NOTE: UACC(READ) is allowed for output destinations that are permitted to route output for all users. Currently, there is no guidance on which output destinations are appropriate for UACC(READ). However, common sense should prevail during the analysis. For example, UACC(READ) would typically be inappropriate for RJE, NJE, and offload output destinations.
d) If all of the items mentioned in (c) are true, there is NO FINDING.
e) If any item mentioned in (c) is untrue, this is a FINDING. |
| | JES2 output devices must be properly controlled for Classified Systems. | JES2 output devices provide a variety of channels to which output can be processed. Failure to properly control these output devices could result in unauthorized personnel accessing output. This exposure may compromise the confidentiality of customer data on a classified System.. | | Refer to the following report produced by the Data Set and Resource Data Collection:
- Classification of System
- SENSITVE.RPT(WRITER)
If the Classification of the system is unclassified, this is not applicable.
Verify that the accesses for WRITER resources are restricted. If the following guidance is true, this is not a finding.
___ The RACF resources and/or generic equivalent are defined with a default access of NONE.
___ The RACF resources and/or generic equivalent identified below will be defined with access restricted to the operators and system programming personnel:
JES2.LOCAL.devicename
JES2.LOCAL.OFFn.*
JES2.LOCAL.OFFn.JT
JES2.LOCAL.OFFn.ST
JES2.LOCAL.PRTn
JES2.LOCAL.PUNn
JES2.NJE.nodename
JES2.RJE.devicename
NOTE: Common sense should prevail during the analysis. For example, access to the offload output destinations should be limited to only systems personnel (e.g., operations staff/system programmers) on a classified system.
___ The RACF resource access authorizations are defined with UACC(NONE) and NOWARNING. |
| | JESSPOOL resources are not protected in accordance with security requirements. | JES2 spool resources include all SYSOUT, SYSLOG, JESTRACE, and JESNEWS data sets. Failure to properly control JES2 spool resources could result in unauthorized personnel accessing job output, system activity logs, and trace data containing userid and password information. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data. | | a) Refer to the following reports produced by the RACF Data Collection and Data Set and Resource Data Collection:
- RACFCMDS.RPT(SETROPTS)
- DSMON.RPT(RACCDT) - Alternate list of active resource classes
Automated Analysis
Refer to the following report produced by the RACF Data Collection:
- PDI(ZJES0041)
b) Ensure that the JESSPOOL resource class is active:
c) If all of the items in (b) are true, there is NO FINDING.
d) If any item in (b) is untrue, this is a FINDING. |
| | JESNEWS rewsources are not protected in accordance with security requirements. | JES2 spool resources include all SYSOUT, SYSLOG, JESTRACE, and JESNEWS data sets. Failure to properly control JES2 spool resources could result in unauthorized personnel accessing job output, system activity logs, and trace data containing userid and password information. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data. | | JESNEWS Access Controls
a) Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(OPERCMDS)
Refer to the following report produced by the z/OS Data Collection:
- EXAM.RPT(SUBSYS)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ZJES0042)
b) Ensure the following items are in effect:
1) The JES2.UPDATE.JESNEWS resource is defined to the OPERCMDS resource class with a default access of NONE and all access is logged.
NOTE: JES2 is typically the name of the JES2 subsystem. Refer to the SUBSYS report and locate the entry with the description of PRIMARY JOB ENTRY SUBSYSTEM. The SUBSYSTEM NAME of this entry is the name of the JES2 subsystem.
2) Access authorization to the JES2.UPDATE.JESNEWS resource in the OPERCMDS class restricts CONTROL access to the appropriate personnel (i.e., users responsible for maintaining the JES News data set) and all access is logged.
c) If both of the items in (b) are true, there is NO FINDING.
d) If either item in (b) is untrue, this is a FINDING. |
| | JESTRACE and/or SYSLOG resources are not protected in accordance with security requirements. | JES2 spool resources include all SYSOUT, SYSLOG, JESTRACE, and JESNEWS data sets. Failure to properly control JES2 spool resources could result in unauthorized personnel accessing job output, system activity logs, and trace data containing userid and password information. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data. | | Refer to the following report produced by the RACF Data Collection and Data Set and Resource Data Collection:
- SENSITVE.RPT(JESSPOOL)
- RACFCMDS.RPT(JESSPOOL)
Refer to the following report produced by the z/OS Data Collection:
- PARMLIB(JES2 parameters)
Review the following resources defined to the JESSPOOL resource class:
localnodeid.JES2.$TRCLOG.taskid.*.JESTRACE
localnodeid.+MASTER+.SYSLOG.jobid.*.SYSLOG or
localnodeid.+BYPASS+.SYSLOG.jobid.-.SYSLOG
NOTE: These resource profiles may be more generic as long as they pertain directly to the JESTRACE and SYSLOG data sets. For example:
localnodeid.JES2.*.*.*.JESTRACE
localnodeid.+MASTER+.*.*.*.SYSLOG or
localnodeid.+BYPASS+.*.*.*.SYSLOG
NOTE: Review the JES2 parameters to determine the localnodeid by searching for OWNNODE in the NJEDEF statement, and then searching for NODE(nnnn) (where nnnn is the value specified by OWNNODE). The NAME parameter value specified on this NODE statement is the localnodeid. Another method is to issue the JES2 command $D NODE,NAME,OWNNODE=YES to obtain the NAME of the OWNNODE.
Ensure that access authorization for the resources mentioned above is restricted to the following:
1) Userid(s) associated with external writer(s) can have complete access.
NOTE: An external writer is an STC that removes data sets from the JES spool. In this case, it is responsible for archiving the JESTRACE and SYSLOG data sets. The STC default name is XWTR and the external writer program is called IASXWR00.
2) Systems personnel and security administrators responsible for diagnosing JES2 and z/OS problems can have complete access.
3) Application Development and Application Support personnel responsible for diagnosing application problems can have READ access to the SYSLOG resource. |
| | JES2 spool resources will be controlled in accordance with security requirements. | JES2 spool resources include all SYSOUT, SYSLOG, JESTRACE, and JESNEWS data sets. Failure to properly control JES2 spool resources could result in unauthorized personnel accessing job output, system activity logs, and trace data containing userid and password information. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data. | | Refer to the following reports produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(JESSPOOL)
Verify that the accesses to the JESSPOOL resources are properly restricted. If the following guidance is true, this is not a finding.
Review the JESSPOOL report for resource permissions with the following naming convention. These profiles may be fully qualified, be specified as generic, or be specified with masking as indicated below:
localnodeid.userid.jobname.jobid.dsnumber.name
localnodeid The name of the node on which the SYSIN or SYSOUT data set currently resides.
userid The userid associated with the job. This is the userid RACF uses for validation purposes when the job runs.
jobname The name that appears in the name field of the JOB statement.
jobid The job number JES2 assigned to the job.
dsnumber The unique data set number JES2 assigned to the spool data set. A D is the first character of this qualifier.
name The name of the data set specified in the DSN= parameter of the DD statement. If the JCL did not specify DSN= on the DD statement that creates the spool data set, JES2 uses a question mark (?).
All users have access to their own JESSPOOL resources.
The localnodeid. resource will be restricted to only system programmers, operators, and automated operations personnel with access of ALTER. All access will be logged. (localnodeid. resource includes all generic and/or masked permissions, example: localnodeid.**, localnodeid.*, etc)
The JESSPOOL localnodeid.userid.jobname.jobid.dsnumber.name, whether generic and/or masked, can be made available to users, when approved by the IAO. Access will be identified at the minimum access for the user to accomplish the users function. UPDATE, CONTROL, and ALTER access will be logged. An example is team members within a team, providing the capability to view, help, and/or debug other team member jobs/processes.
CSSMTP will be restricted to localnodeid.userid.jobname.jobid.dsnumber.name, whether generic and/or masked when approved by the IAO. All access will be logged.
Spooling products users (CA-SPOOL, CA View, etc.) will be restricted to localnodeid.userid.jobname.jobid.dsnumber.name, whether generic and/or masked when approved by the IAO. Logging of access is not required. |
| | JES2 system commands are not protected in accordance with security requirements. | JES2 system commands are used to control JES2 resources and the operating system environment. Failure to properly control access to JES2 system commands could result in unauthorized personnel issuing sensitive JES2 commands. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data. | | a) Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(OPERCMDS)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ZJES0052)
b) If the JES2.** resource is defined to the OPERCMDS class with a default access of NONE and all access is logged, there is NO FINDING.
c) If access to JES2 system commands defined in the table entitled Controls on JES2 System Commands, in the z/OS STIG Addendum is restricted to the appropriate personnel (e.g., operations staff, systems programming personnel, general users), there is NO FINDING.
NOTE: Use the GROUP category specified in the table referenced above as a guideline to determine appropriate personnel access to system commands.
d) If access to specific JES2 system commands is logged as indicated in the table entitled Controls on JES2 System Commands, in the z/OS STIG Addendum, there is NO FINDING.
e) If either (b), (c), or (d) above is untrue for any JES2 system command resource, this is a FINDING. |
| | SMS Program Resources must be properly defined and protected. | DFSMS provides data, storage, program, and device management functions for the operating system. Some DFSMS storage administration functions allow a user to obtain a privileged status and effectively bypass all ACP data set and volume controls. Failure to properly protect DFSMS resources may result in unauthorized access. This exposure could compromise the availability and integrity of the operating system environment, system services, and customer data. Configure CustomDsnType to define a custom DSN type for the sens (sensitive data sets) table. | | Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(ZSMS0012)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ZSMS0012)
Ensure that all SMS Program resources and/or generic equivalent are properly protected according to the requirements specified in SMS Program Resources table in the z/OS STIG Addendum. If the following guidance is true, this is not a finding.
___ The RACF resources are defined with a default access of NONE.
___ The RACF resource access authorizations restrict access to the appropriate personnel.
___ The RACF resource access authorizations are defined with UACC(NONE) and NOWARNING. |
| | SYS(x).PARMLIB(IGDSMSxx), SMS parameter settings are not properly specified. | Configuration properties of DFSMS are specified in various members of the system parmlib concatenation (e.g., SYS1.PARMLIB). Statements within these PDS members provide the execution, operational, and configuration characteristics of the system-managed storage environment. Missing or inappropriate configuration values may result in undesirable operations and degraded security. This exposure could potentially compromise the availability and integrity of some system services and customer data. | | a) Review the logical parmlib data sets, example: SYS1.PARMLIB(IGDSMSxx), for the following SMS parameter settings:
Parameter Key
SMS
ACDS(ACDS data set name)
COMMDS(COMMDS data set name)
b) If the required parameters are defined, there is NO FINDING.
c) If the required parameters are not defined, this is a FINDING. |
| | DFSMS-related RACF classes are not active. | DFSMS provides data, storage, program, and device management functions for the operating system. Some DFSMS storage administration functions allow a user to obtain a privileged status and effectively bypass all ACP data set and volume controls. Failure to properly protect DFSMS resources may result in unauthorized access. This exposure could compromise the availability and integrity of the operating system environment, system services, and customer data. | | CLASSACT Resources
a) Refer to the following report produced by the RACF Data Collection:
- RACFCMDS.RPT(SETROPTS)
b) ACTIVE CLASSES lists the MGMTCLAS, STORCLAS, PROGRAM, and FACILITY resources classes.
c) RACLIST CLASSES lists the MGMTCLAS and STORCLAS resource classes.
d) If (b) and (c) are true, there is NO FINDING.
e) If (b) or (c) is not true, this is a FINDING. |
| | z/OS UNIX OMVS parameters in PARMLIB are not properly specified. | Parameter settings in PARMLIB and /etc specify values for z/OS UNIX security controls. The parameters impact HFS data access and operating system services. Undesirable values can allow users to gain inappropriate privileges that could impact data integrity or the availability of some system services. | | a) Refer to the following report produced by the z /OS Data Collection:
- EXAM.RPT(PARMLIB) - Refer to the IEASYSxx listing(s).
Automated Analysis
Refer to the following report produced by the z/OS Data Collection:
- PDI (ZUSS0011)
NOTE: If the OMVS statement is not specified, OMVS=DEFAULT is used. In minimum mode there is no access to permanent file systems or to the shell, and IBM's Communication Server TCP/IP will not run.
b) If the parameter is specified as OMVS=xx or OMVS=(xx,xx,...) in the IEASYSxx member, there is NO FINDING.
c) If the parameter is not specified as OMVS=xx or OMVS=(xx,xx,...), this is a FINDING. |
| | z/OS UNIX BPXPRMxx security parameters in PARMLIB must be properly specified. | Parameter settings in PARMLIB and /etc specify values for z/OS UNIX security controls. The parameters impact HFS data access and operating system services. Undesirable values can allow users to gain inappropriate privileges that could impact data integrity or the availability of some system services. | | a) Review the logical parmlib data sets, example: SYS1.PARMLIB(BPXPRMxx), for the following UNIX Parameter Keywords and Values:
Parameter Keyword Value
SUPERUSER BPXROOT
TTYGROUP TTY
STEPLIBLIST /etc/steplib
USERIDALIASTABLE Will not be specified.
ROOT SETUID will be specified
MOUNT NOSETUID
SETUID (for Vendor-provided files)SECURITY
STARTUP_PROC OMVS
Automated Analysis requires Additional Analysis.
Automated Analysis
Refer to the following report produced by the z/OS Data Collection:
- PDI(ZUSS0012)
b) If the required parameter keywords and values are defined, there is NO FINDING.
c) If the required parameter keywords and values are not defined, this is a FINDING. |
| | z/OS UNIX HFS MapName files security parameters are not properly specified. | Parameter settings in PARMLIB and /etc specify values for z/OS UNIX security controls. The parameters impact HFS data access and operating system services. Undesirable values can allow users to gain inappropriate privileges that could impact data integrity or the availability of some system services. | | a) Review the logical parmlib data sets, example: SYS1.PARMLIB(BPXPRMxx), for the following FILESYSTYPE entry:
FILESYSTYPE TYPE(AUTOMNT) ENTRYPOINT(BPXTAMD)
If the above entry is not found or is commented out in the BPXPRMxx member(s), this is NOT APPLICABLE.
b) Refer to the following report produced by the UNIX System Services Data Collection:
- USSCMDS.RPT(EAUTOM)
NOTE: The /etc/auto.master HFS file (and the use of Automount) is optional. If the file does not exist, this is NOT APPLICABLE.
NOTE: The setuid parameter and the security parameter have a significant security impact. For this reason these parameters must be explicitly specified and not allowed to default.
c) If each MapName file specifies the "setuid No" and "security Yes" statements for each automounted directory, there is NO FINDING.
d) If there is any deviation from the required values, this is a FINDING. |
| | z/OS UNIX security parameters for restricted network service(s) in /etc/inetd.conf are not properly specified. | Parameter settings in PARMLIB and /etc specify values for z/OS UNIX security controls. The parameters impact HFS data access and operating system services. Undesirable values can allow users to gain inappropriate privileges that could impact data integrity or the availability of some system services. | | a) Refer to the following reports produced by the UNIX System Services Data Collection:
- USSCMDS.RPT(EINETD)
- USSCMDS.RPT(ESERV)
b) If all the services in the Restricted Network Services Table in the z/OS STIG Addendum are not found in or are commented out of the /etc/inetd.conf file, there is NO FINDING.
c) If any Restricted Network Services are specified, this is a FINDING. |
| | The System datasets used to support the VTAM network are not properly secured. | Ensure that RACF data set rules for all VTAM system data sets restrict access to only network systems programming staff. These data sets include libraries containing VTAM load modules and exit routines, and VTAM start options and definition statements.
Failure to properly control VTAM datasets could potentially compromise the network operations. | | a) Create a list of data set names containing all VTAM start options, configuration lists, network resource definitions, commands, procedures, exit routines, all SMP/E TLIBs, and all SMP/E DLIBs used for installation and in development/production VTAM environments.
Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(VTAMRPT)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ZVTM0018)
b) Ensure that RACF data set rules for all VTAM system data sets restrict access to only network systems programming staff. These data sets include libraries containing VTAM load modules and exit routines, and VTAM start options and definition statements.
c) If (b) above is true, there is NO FINDING.
d) If (b) above is untrue, this is a FINDING. |
| | WebSphere MQ channel security must be implemented in accordance with security requirements. | WebSphere MQ Channel security can be configured to provide authentication, message privacy, and message integrity between queue managers. Secure Sockets Layer (SSL) uses encryption techniques, digital signatures and digital certificates to provide message privacy, message integrity and mutual authentication between clients and servers.
Failure to properly secure a WebSphere MQ channel may lead to unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of some system services, applications, and customer data. | | Refer to the following report produced by the z/OS Data Collection:
- MQSRPT(ssid)
NOTE: ssid is the queue manager name (a.k.a., subsystem identifier).
Collect the following Information for Websphere MQ and MQSeries queue manager.
- If a WebSphere MQ queue manager communicates with a MQSeries queue manager, provide the WebSphere MQ queue manager and channel names used to connect with MQSeries.
- If any WebSphere MQ channels are used to communicate within the enclave, provide a list of channels and provide documentation regarding the sensitivity of the information on the channel.
Automated Analysis requires Additional Analysis.
Automated Analysis
Refer to the following report produced by the z/OS Data Collection:
- PDI(ZWMQ0011)
If the communication lines are controlled by a VPN and are not available in the clear at any point outside the enclave, than this is acceptable and can override the requirement to use SSL. If this is true, this is not a finding.
If the following guidelines are true for each channel definition displayed from the DISPLAY CHANNEL command, this is not a finding.
___ Verify that each WebSphere MQ channel is using SSL by checking for the SSLCIPH parameter, which must specify a FIPS 140-2 compliant value of the following: (Note: Both ends of the channel must specify the same cipher specification.)
ECDHE_ECDSA_AES_128_CBC_SHA256
ECDHE_ECDSA_AES_256_CBC_SHA384
ECDHE_RSA_AES_128_CBC_SHA256
ECDHE_RSA_AES_256_CBC_SHA384
TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_AES_128_CBC_SHA256
TLS_RSA_WITH_AES_256_CBC_SHA
TLS_RSA_WITH_AES_256_CBC_SHA256
___ Repeat the above step for each queue manager ssid identified. |
| | WebSphere MQ resource classes are not properly actived for security checking by the ACP. | WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to ensure the classes have been made ACTIVE under RACF will prevent RACF from enforcing security rules. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data. | | Refer to the following reports produced by the RACF Data Collection:
- RACFCMDS.RPT(SETROPTS)
- DSMON.RPT(RACCDT) - Alternate list of active resource classes
Automated Analysis
Refer to the following report produced by the RACF Data Collection:
- PDI(ZWMQ0049)
Ensure the following WebSphere MQ resource classes are active:
GMQADMIN
GMQNLIST
GMQPROC
GMQQUEUE
MQADMIN
MQCMDS
MQCONN
MQNLIST
MQPROC
MQQUEUE
For V7.0.0 and above:
GMXADMIN
GMXNLIST
GMXPROC
GMXQUEUE
GMXTOPIC
MXADMIN
MXNLIST
MXPROC
MXQUEUE
MXTOPIC
NOTE: If both MQADMIN and MXADMIN resource classes are not active, no security checking is performed. |
| | WebSphere MQ switch profiles must be properly defined to the MQADMIN class. | WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data. | | a) Refer to the following report produced by the Z/OS Data Collection:
- MQSRPT(ssid)
NOTE: ssid is the queue manager name (a.k.a., subsystem identifier).
Automated Analysis requires Additional Analysis.
Automated Analysis
Refer to the following report produced by the z/OS Data Collection:
- PDI(ZWMQ0051)
b) Review the Security switches identified in response to the DISPLAY SECURITY command in each ssid report(s). If the all of the following switches specify ON, there is NO FINDING.
SUBSYSTEM
CONNECTION
COMMAND
CONTEXT
ALTERNATE USER
PROCESS
NAMELIST
QUEUE
COMMAND RESOURCES
c) If SUBSYSTEM specifies OFF, this is a FINDING with a severity of Category I.
d) If any of the other above switches specify OFF (other than the exception mentioned below), this is a FINDING. Downgrade the severity to a Category II.
e) If COMMAND RESOURCE Security switch specify OFF, there is NO FINDING.
NOTE: At the discretion of the IAO, COMMAND RESOURCE Security switch may specify OFF, by defining ssid.NO.CMD.RESC.CHECKS in the MQADMIN resource class. |
| | z/OS UNIX security parameters in etc/profile are not properly specified. | Parameter settings in PARMLIB and /etc specify values for z/OS UNIX security controls. The parameters impact HFS data access and operating system services. Undesirable values can allow users to gain inappropriate privileges that could impact data integrity or the availability of some system services. | | a) Refer to the following report produced by the UNIX System Services Data Collection:
- USSCMDS.RPT(EPROF)
b) If the final or only instance of the UMASK command in /etc/profile is specified as "umask 077", there is NO FINDING.
c) If the LOGNAME variable is marked read-only (i.e., "readonly LOGNAME") in /etc/profile, there is NO FINDING.
d) If (b) or(c) above is untrue, this is a FINDING. |
| | WebSphere MQ MQCONN Class (Connection) resource definitions must be protected in accordance with security. | WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data. | | a) Refer to the following reports produced by the RACF Data Collection:
- SENSITVE.RPT(MQCONN)
b) Review the following connection resources defined to the MQCONN resource class:
Resource Authorized Users
ssid.BATCH TSO and batch job userids
ssid.CICS CICS region userids
ssid.IMS IMS region userids
ssid.CHIN Channel initiator userids
NOTE: ssid is the queue manager name (a.k.a., subsystem identifier).
c) For all connection resources defined to the MQCONN resource class, ensure the following items are in effect:
NOTE: If you do not have a resource profile defined for a particular security check, and a user issues a request that would involve making that check, MQSeries/WebSphere MQ denies access.
1) Resource profiles are defined with a UACC(NONE).
2) Access authorization to these connections restricts access to the appropriate users as indicated in (b).
3) All access FAILUREs are logged.
d) If all of the items in (c) are true, there is NO FINDING.
e) If any item in (c) is untrue, this is a FINDING. |
| | WebSphere MQ Process resource profiles defined in the MQPROC Class are not protected in accordance with security requirements. | WebSphere MQ Process resources allow for the control of processes. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data. | | a) Refer to the following reports produced by the RACF Data Collection:
- SENSITVE.RPT(MQPROC)
b) For all process resources (i.e., ssid.processname) defined to the MQPROC or GMQPROC resource classes, ensure the following items are in effect:
NOTE 1: ssid is the queue manager name (a.k.a., subsystem identifier).
1) Resource profiles are defined with a UACC(NONE).
2) Access authorization restricts access to users requiring the ability to make process inquires. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list.
c) If both of the items in (b) are true, there is NO FINDING.
d) If either item in (b) is untrue, this is a FINDING. |
| | WebSphere MQ Namelist resource profiles defined in the MQNLIST Class are not protected in accordance with security requirements. | WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data. | | a) Refer to the following reports produced by the RACF Data Collection:
- SENSITVE.RPT(MQNLIST)
b) For all namelist resources (i.e., ssid.namelist) defined to the MQNLIST or GMQNLIST resource classes, ensure the following items are in effect:
NOTE 1: ssid is the queue manager name (a.k.a., subsystem identifier).
1) Resource profiles are defined with a UACC(NONE).
2) Access authorization restricts access to users requiring the ability to make namelist inquires. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list.
c) If both of the items in (b) are true, there is NO FINDING.
d) If either item in (b) is untrue, this is a FINDING. |
| | BPX resource(s)s is(are) not protected in accordance with security requirements. | z/OS UNIX ACP-defined resources consist of sensitive capabilities including SUPERUSER, daemon, and numerous file manipulation privileges. Missing or inaccurate protection of these resources could allow a user to access sensitive data, modify or delete data and operating system controls, or issue commands that could negatively impact system availability. | | a) Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(FACILITY)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ZUSS0021)
b) Review the following items for the FACILITY resource class:
1) The RACF rules for the BPX.** resource specify a default access of NONE.
2) There are no RACF user access to the BPX.** resource.
3) There is no RACF rule for BPX.SAFFASTPATH defined.
4) The RACF rules for each of the BPX resources listed in the General Facility Class BPX Resources Table in the z/OS STIG Addendum, specify a default access of NONE.
5) The RACF rules for each of the BPX resources listed in the General Facility Class BPX Resources Table in the z/OS STIG Addendum, restrict access to appropriate system tasks or systems programming personnel.
c) If any item in (b) is untrue, this is a FINDING.
d) If all items in (b) are true, this is NOT A FINDING. |
| | WebSphere MQ Alternate User resources defined to MQADMIN resource class are not protected in accordance with security requirements. | WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data. | | a) Refer to the following reports produced by the RACF Data Collection:
- SENSITVE.RPT(MQADMIN)
b) For all alternate user resources (i.e., ssid.ALTERNATE.USER.alternateuserid) defined to the MQADMIN resource class, ensure the following items are in effect:
NOTE 1: ssid is the queue manager name (a.k.a., subsystem identifier).
1) Resource profiles are defined with a UACC(NONE).
2) Access authorization restricts access to users requiring the ability to use the alternate userid. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list.
c) If both of the items in (b) are true, there is NO FINDING.
d) If either item in (b) is untrue, this is a FINDING. |
| | z/OS UNIX resources must be protected in accordance with security requirements. | z/OS UNIX ACP-defined resources consist of sensitive capabilities including SUPERUSER, daemon, and numerous file manipulation privileges. Missing or inaccurate protection of these resources could allow a user to access sensitive data, modify or delete data and operating system controls, or issue commands that could negatively impact system availability. | | a) Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(SURROGAT)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ZUSS0022)
b) If the RACF rules for all BPX.SRV.user SURROGAT resources specify a default access of NONE, there is NO FINDING.
c) If the RACF rules for all BPX.SRV.user SURROGAT resources restrict access to system software processes (e.g., web servers) that act as servers under z/OS UNIX, there is NO FINDING.
d) If (b) or (c) above is untrue, this is a FINDING. |
| | WebSphere MQ context resources defined to the MQADMIN resource class are not protected in accordance with security requirements. | Context security validates whether a userid has authority to pass or set identity and/or origin data
for a message. Context security will be active to avoid security exposure.
This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data. | | a) Refer to the following reports produced by the RACF Data Collection:
- SENSITVE.RPT(MQADMIN)
b) For all context resources (i.e., ssid.CONTEXT) defined to the MQADMIN resource class, ensure the following items are in effect:
NOTE 1: ssid is the queue manager name (a.k.a., subsystem identifier).
1) Resource profiles are defined with a UACC(NONE).
2) Access authorization restricts access to users requiring the ability to pass or set identity and/or origin data for a message. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list.
c) If both of the items in (b) are true, there is NO FINDING.
d) If either item in (b) is untrue, this is a FINDING. |
| | z/OS UNIX SUPERUSER resource must be protected in accordance with guidelines. | z/OS UNIX ACP-defined resources consist of sensitive capabilities including SUPERUSER, daemon, and numerous file manipulation privileges. Missing or inaccurate protection of these resources could allow a user to access sensitive data, modify or delete data and operating system controls, or issue commands that could negatively impact system availability. | | a) Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(UNIXPRIV)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ZUSS0023)
b) Review the following items for the UNIXPRIV resource class:
1) The RACF rules for the SUPERUSER resource specify a default access of NONE.
2) There are no RACF rules that allow access to the SUPERUSER resource.
3) There is no RACF rule for CHOWN.UNRESTRICTED defined.
4) The RACF rules for each of the SUPERUSER resources listed in the UNIXPRIV CLASS RESOURCES Table in the z/OS STIG Addendum, specify a default access of NONE.
5) The RACF rules for each of the SUPERUSER resources listed in the UNIXPRIV CLASS RESOURCES Table in the z/OS STIG Addendum, restrict access to appropriate system tasks or systems programming personnel.
c) If any item in (b) is untrue, this is a FINDING.
d) If all items in (b) are true, this is NOT A FINDING. |
| | WebSphere MQ command resources defined to MQCMDS resource class are not protected in accordance with security requirements. | WebSphere MQ resources allow for the control of commands. Failure to properly protect WebSphere MQ Command resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data. | | a) Refer to the following reports produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(MQCMDS)
b) For all command resources (i.e., ssid.command) defined to the MQCMDS resource class, ensure the following items are in effect:
NOTE: ssid is the queue manager name (a.k.a., subsystem identifier).
1) Resource profiles are defined with a UACC(NONE).
2) Access authorization restricts access to the appropriate personnel as designated in the Websphere MQ COMMAND SECURITY CONTROLS Table in the z/OS STIG Addendum.
3) All command access is logged as designated in the Websphere MQ COMMAND SECURITY CONTROLS Table in the z/OS STIG Addendum.
c) If all of the items in (b) are true, there is NO FINDING.
d) If any item in (b) is untrue, this is a FINDING. |
| | z/OS UNIX MVS data sets or HFS objects are not properly protected. | For the z/OS UNIX environment, there are MVS data sets that contain operating system components, MVS data sets that contain HFS file systems with operating system components, and MVS data sets that contain HFS file systems with application system and user data. All of these MVS data sets require definitions in the ACP to enforce desired access controls. In addition, the UNIX permission bits must be properly set on the HFS directories and files to enforce desired access controls. | | a) Refer to the following report produced by the UNIX System Services Data Collection:
- PARMLIB(BPXPRMxx)
Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(HFSRPT)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ZUSS0031)
b) If the ACP data set rules for the data sets referenced in the ROOT and the MOUNT statements in BPXPRMxx restrict update access to the z/OS UNIX kernel (i.e., OMVS or OMVSKERN) there is NO FINDING.
c) If the ACP data set rules for the data set referenced in the ROOT and the MOUNT statements in BPXPRMxx restrict update and/or allocate access to systems programming personnel there is NO FINDING.
d) If (b) or (c) above is untrue, this is a FINDING. |
| | WebSphere MQ RESLEVEL resources in the MQADMIN resource class are not protected in accordance with security requirements. | RESLEVEL security profiles control the number of userids checked for API-resource security.
RESLEVEL is a powerful option that can cause the bypassing of all security checks.
RESLEVEL security will not be implemented. | | a) Refer to the following reports produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(MQADMIN)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ZWMQ0060)
b) Ensure the following items are in effect:
NOTE: ssid is the queue manager name (a.k.a., subsystem identifier).
1) A RESLEVEL resource (i.e., ssid.RESLEVEL) is defined for each queue manager to the MQADMIN resource class with a UACC(NONE).
2) Access authorization to these RESLEVEL resources restricts all access. No users or groups must be specified in the access list.
c) If both of the items in (b) are true, there is NO FINDING.
d) If either item in (b) is untrue, this is a FINDING. |
| | z/OS UNIX MVS data sets WITH z/OS UNIX COMPONENTS are not properly protected | For the z/OS UNIX environment, there are MVS data sets that contain operating system components, MVS data sets that contain HFS file systems with operating system components, and MVS data sets that contain HFS file systems with application system and user data. All of these MVS data sets require definitions in the ACP to enforce desired access controls. In addition, the UNIX permission bits must be properly set on the HFS directories and files to enforce desired access controls. Configure CustomDsnType to define a custom DSN type for the sens (sensitive data sets) table. | | a) Refer to the following report produced by the ACP Data Collection:
- SENSITVE.RPT(USSRPT)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ZUSS0032)
b) If the ACP data set rules for each of the data sets listed in the MVS DATA SETS WITH z/OS UNIX COMPONENTS Table in the z/OS STIG Addendum restrict UPDATE and ALLOCATE access to systems programming personnel, there is NO FINDING.
c) If (b) above is untrue, this is a FINDING. |
| | z/OS UNIX MVS data sets used as step libraries in /etc/steplib are not properly protected | For the z/OS UNIX environment, there are MVS data sets that contain operating system components, MVS data sets that contain HFS file systems with operating system components, and MVS data sets that contain HFS file systems with application system and user data. All of these MVS data sets require definitions in the ACP to enforce desired access controls. In addition, the UNIX permission bits must be properly set on the HFS directories and files to enforce desired access controls. | | a) Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(STLLRPT)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ZUSS0033)
___ The ACP data set rules for libraries specified in the STEPLIBLIST file allow inappropriate access.
___ The ACP data set rules for libraries specified in the STEPLIBLIST file do not restrict UPDATE and/or ALTER/ALLOCATE access to only systems programming personnel.
___ The ACP data set rules for libraries specified in the STEPLIBLIST file do not specify that all (i.e., failures and successes) UPDATE and/or ALTER/ALLOCATE access will be logged.
b) If all of the above are untrue, there is NO FINDING.
c) If any of the above is true, this is a FINDING. |
| | z/OS UNIX HFS permission bits and audit bits for each directory will be properly protected or specified. | For the z/OS UNIX environment, there are MVS data sets that contain operating system components, MVS data sets that contain HFS file systems with operating system components, and MVS data sets that contain HFS file systems with application system and user data. All of these MVS data sets require definitions in the ACP to enforce desired access controls. In addition, the UNIX permission bits must be properly set on the HFS directories and files to enforce desired access controls. | | Refer to the following report produced by the UNIX System Services Data Collection:
- USSCMDS.RPT(SDPERM)
Refer to the following report produced by the IBM Communications Server Data Collection:
- PDI(ZUSS0034)
The HFS permission bits and user audit bits for each directory and file match or are more restrictive than the specified settings listed in the SYSTEM DIRECTORY SECURITY SETTINGS Table in the z/OS STIG Addendum. If the guidance is true, this is not a finding.
The following represents a hierarchy for permission bits from least restrictive to most restrictive:
7 rwx (least restrictive)
6 rw-
3 -wx
2 -w-
5 r-x
4 r--
1 --x
0 --- (most restrictive)
The possible audit bits settings are as follows:
f log for failed access attempts
a log for failed and successful access
- no auditing |
| | z/OS UNIX SYSTEM FILE SECURITY SETTINGS will be properly protected or specified. | For the z/OS UNIX environment, there are MVS data sets that contain operating system components, MVS data sets that contain HFS file systems with operating system components, and MVS data sets that contain HFS file systems with application system and user data. All of these MVS data sets require definitions in the ACP to enforce desired access controls. In addition, the UNIX permission bits must be properly set on the HFS directories and files to enforce desired access controls. | | Refer to the following reports produced by the UNIX System Services Data Collection:
- USSCMDS.RPT(SFPERM)
- USSCMDS.RPT(EAUTOM)
Refer to the following report produced by the IBM Communications Server Data Collection:
- PDI(ZUSS0035)
The HFS permission bits and user audit bits for each directory and file match or are more restrictive than the specified settings listed in the SYSTEM FILE SECURITY SETTINGS Table in the z/OS STIG Addendum. If the guidance is true, this is not a finding.
NOTE:
Some of the files listed in the SYSTEM FILE SECURITY SETTINGS Table in the z/OS STIG Addendum are not used in every configuration. Absence of any of the files is not considered a finding.
NOTE: The names of the MapName files are site-defined. Refer to the listing in the EAUTOM report.
The following represents a hierarchy for permission bits from least restrictive to most restrictive:
7 rwx (least restrictive)
6 rw-
3 -wx
2 -w-
5 r-x
4 r--
1 --x
0 --- (most restrictive)
The possible audit bits settings are as follows:
f log for failed access attempts
a log for failed and successful access
- no auditing |
| | z/OS UNIX MVS HFS directory(s) with "other" write permission bit set are not properly defined. | For the z/OS UNIX environment, there are MVS data sets that contain operating system components, MVS data sets that contain HFS file systems with operating system components, and MVS data sets that contain HFS file systems with application system and user data. All of these MVS data sets require definitions in the ACP to enforce desired access controls. In addition, the UNIX permission bits must be properly set on the HFS directories and files to enforce desired access controls. | | a) Refer to the following report produced by the UNIX System Services Data Collection:
- USSCMDS.RPT(OWDIR)
b) If there are no directories that have the other write permission bit set on without the sticky bit set on, there is NO FINDING.
NOTE: In the symbolic permission bit display, the sticky bit is indicated as a “t” or “T” in the execute portion of the other permissions. For example, a display of the permissions of a directory with the sticky bit on could be “drwxrwxrwt”.
c) If all directories that have the other write permission bit set on do not contain any files with the setuid bit set on, there is NO FINDING.
NOTE: In the symbolic permission bit display, the setuid bit is indicated as an “s” or “S” in the execute portion of the owner permissions. For example, a display of the permissions of a file with the setuid bit on could be “-rwsrwxrwx”.
d) If all directories that have the other write permission bit set on do not contain any files with the setgid bit set on, there is NO FINDING.
NOTE: In the symbolic permission bit display, the setgid bit is indicated as an “s” or “S” in the execute portion of the group permissions. For example, a display of the permissions of a file with the setgid bit on could be “-rwxrwsrwx”.
e) If (b), (c), or (d) above is untrue, this is a FINDING. |
| | Attributes of z/OS UNIX user accounts are not defined properly | User identifiers (ACF2 logonids, RACF userids, and Top Secret ACIDs), groups, and started tasks that use z/OS UNIX facilities are defined to an ACP with attributes including UID and GID. If these attributes are not correctly defined, data access or command privilege controls could be compromised. | | Refer to the following report produced by the ACP Data Collection:
ACF2
- ACF2CMDS.RPT(OMVSGRP)
RACF
- RACFCMDS.RPT(LISTGRP)
TSS
- TSSCMDS.RPT(OMVSUSER)
Automated Analysis
Refer to the following report produced by the z/OS Data Collection:
- PDI(ZUSS0041)
NOTE: A site can choose to have both an OMVSGRP group and an STCOMVS group or combine the groups under one of these names.
Ensure that the OMVSGRP and/or STCOMVS groups are defined and have a unique GID in the range of 1-99. |
| | z/OS UNIX each group is not defined with a unique GID. | User identifiers (ACF2 logonids, RACF userids, and Top Secret ACIDs), groups, and started tasks that use z/OS UNIX facilities are defined to an ACP with attributes including UID and GID. If these attributes are not correctly defined, data access or command privilege controls could be compromised. | | Refer to the following report produced by the ACP Data Collection:
ACF2
- ACF2CMDS.RPT(OMVSGRP)
RACF
- RACFCMDS.RPT(LISTGRP)
Automated Analysis
Refer to the following report produced by the z/OS Data Collection:
- PDI(ZUSS0042)
For ACF2 and RACF ensure that each GID is unique to a specific group.
For TSS this is Not Applicable. |
| | The user account for the z/OS UNIX kernel (OMVS) is not properly defined to the security database. | User identifiers (ACF2 logonids, RACF userids, and Top Secret ACIDs), groups, and started tasks that use z/OS UNIX facilities are defined to an ACP with attributes including UID and GID. If these attributes are not correctly defined, data access or command privilege controls could be compromised. | | a) Refer to the following reports produced by the ACP Data Collection:
ACF2
- ACF2CMDS.RPT(OMVSUSER)
- ACF2CMDS.RPT(LOGONIDS)
RACF
- RACFCMDS.RPT(LISTUSER)
TSS
- TSSCMDS.RPT(@ACIDS)
b) If OMVS is defined as follows, there is NO FINDING:
1) No access to interactive on-line facilities (e.g., TSO, CICS, etc.)
2) Default group specified as OMVSGRP or STCOMVS
3) UID(0)
4) HOME directory specified as "/"
5) Shell program specified as "/bin/sh"
c) If OMVS is not defined as specified in (b) above, this is a FINDING |
| | The user account for the z/OS UNIX SUPERSUSER userid must be properly defined. | User identifiers (ACF2 logonids, RACF userids, and Top Secret ACIDs), groups, and started tasks that use z/OS UNIX facilities are defined to an ACP with attributes including UID and GID. If these attributes are not correctly defined, data access or command privilege controls could be compromised. | | Refer to system PARMLIB member BPXPRMxx (xx is determined by OMVS entry in IEASYS00.)
Determine the user ID identified by the SUPERUSER parameter. (BPXROOT is the default).
From a command input screen enter:
LISTUSER (superuser userid) TSO CICS OMVS
Alternately,
- RACFCMDS.RPT(LISTUSER)
If the SUPERUSER userid is defined as follows, this is not a finding:
- No access to interactive on-line facilities (e.g., TSO, CICS, etc.)
- Default group specified as OMVSGRP or STCOMVS
- UID(0)
- HOME directory specified as "/"
- Shell program specified as "/bin/sh" |
| | The user account for the z/OS UNIX (RMFGAT) must be properly defined. | User identifiers (ACF2 logonids, RACF userids, and Top Secret ACIDs), groups, and started tasks that use z/OS UNIX facilities are defined to an ACP with attributes including UID and GID. If these attributes are not correctly defined, data access or command privilege controls could be compromised. | | RMFGAT is the userid for the Resource Measurement Facility (RMF) Monitor III Gatherer. If RMFGAT is not define this is not applicable.
From a command input screen enter:
LISTUSER (RMFGAT) OMVS
Alternately:
Refer to the following reports produced by the ACP Data Collection:
- RACFCMDS.RPT(LISTUSER)
If RMFGAT is defined as follows, this is not a finding:
- Default group specified as OMVSGRP or STCOMVS
- A unique, non-zero UID
- HOME directory specified as "/"
Shell program specified as "/bin/sh" |
| | UID(0) must be properly assigned. | User identifiers (ACF2 logonids, RACF userids, and Top Secret ACIDs), groups, and started tasks that use z/OS UNIX facilities are defined to an ACP with attributes including UID and GID. If these attributes are not correctly defined, data access or command privilege controls could be compromised. | | a) Refer to the following report produced by the ACP Data Collection:
ACF2
- ACF2CMDS.RPT(OMVSUSER)
RACF
- RACFCMDS.RPT(LISTUSER)
TSS
- TSSCMDS.RPT(OMVSUSER)
Automated Analysis requires Additional Analysis.
Refer to the following report produced by the z/OS Data Collection:
- PDI(ZUSS0046)
b) If UID(0) is assigned only to system tasks such as the z/OS/ UNIX kernel (i.e., OMVS), z/OS UNIX daemons (e.g., inetd, syslogd, ftpd), and other system software daemons, there is NO FINDING.
c) If UID(0) is assigned to security administrators who create or maintain user account definitions; and to systems programming accounts dedicated to maintenance (e.g., SMP/E) of HFS-based components, there is NO FINDING.
NOTE: The assignment of UID(0) confers full time superuser privileges. This is not appropriate for personal user accounts. Access to the BPX.SUPERUSER resource is used to allow personal user accounts to gain short-term access to superuser privileges.
d) If UID(0) is assigned to non-systems or non-maintenance accounts, this is a FINDING. |
| | z/OS UNIX user accounts are not properly defined. | User identifiers (ACF2 logonids, RACF userids, and Top Secret ACIDs), groups, and started tasks that use z/OS UNIX facilities are defined to an ACP with attributes including UID and GID. If these attributes are not correctly defined, data access or command privilege controls could be compromised. | | a) Refer to the following report produced by the ACP Data Collection:
ACF2
- ACF2CMDS.RPT(OMVSUSER)
RACF
- RACFCMDS.RPT(LISTUSER)
TSS
- TSSCMDS.RPT(OMVSUSER)
NOTE: This check only applies to users of z/OS UNIX (i.e., users with an OMVS profile defined).
b) If each user account is defined as follows, there is NO FINDING:
1) A unique UID number (except for UID(0) users)
2) A unique HOME directory (except for UID(0) and other system task accounts)
3) Shell program specified as "/bin/sh", "/bin/tcsh", "/bin/echo", or "/bin/false"
NOTE: The shell program must have one of the specified values. The HOME directory must have a value (i.e., not be allowed to default).
c) If any user account is not defined as specified in (b) above, this is a FINDING. |
| | The z/OS Default profiles must not be defined in the corresponding FACILITY Class Profile for classified systems. | The RACF FACILITY Class BPX. UNIQUE.USER profile contains the userid or the userid/group ID of the default profiles to be used for a user without a z/OS UNIX profile (i.e., OMVS Segment). In classified system user access will not be determined by default. | | If the system is not classified this is not applicable.
From a command input screen enter:
RLIST FACILITY (BPX.UNIQUE.USER) ALL
Examine APPLICATION DATA for userid
Alternately:
Refer to the following report produced by the RACF Data Collection:
- RACFCMDS.RPT(FACILITY)
- System Classification
Automated Analysis:
Refer to the following report produced by the RACF Data Collection:
- PDI(ZUSSR050)
If system is classified and a userid is are not defined in the Application Data field in the BPX.UNIQUE.USER resource in the FACILITY report, there is no finding. |
| | The RACF Classes required to properly security the z/OS UNIX environment are not ACTIVE. | The FACILITY, SURROGAT, and UNIXPRIV Class support profiles used to secure the z/OS UNIX (OMVS) environment. Without these classes being in an ACTIVE status, system integrity can be compromised. | | a) Refer to the following report produced by the RACF Data Collection:
- RACFCMDS.RPT(SETROPTS)
Automated Analysis
Refer to the following report produced by the RACF Data Collection:
- PDI(ZUSSR060)
b) If the ACTIVE CLASSES list includes entries for the FACILITY, SURROGAT, and UNIXPRIV resource classes, there is NO FINDING.
c) If (b) above is untrue, this is a FINDING. |
| | RACF Classes required to support z/OS UNIX security are not properly implemented with the SETROPTS RACLIST command. | RACF provides the ability to load certain class profiles into memory for better performance thru the use of the SETR RACLIST command. For some classes, RACLISTing is strongly recommended and should be implemented. By not following vendor recommendations, unpredictable results could occur that compromise the integrity of the z/OS system. | | a) Refer to the following report produced by the RACF Data Collection:
- RACFCMDS.RPT(SETROPTS)
Automated Analysis
Refer to the following report produced by the RACF Data Collection:
- PDI(ZUSSR070)
b) If the SETR RACLIST CLASSES list includes entries for the FACILITY, SURROGAT, and UNIXPRIV resource classes, there is NO FINDING.
c) If (b) above is untrue, this is a FINDING. |
| | Attributes of z/OS UNIX user accounts used for account modeling must be defined in accordance with security requirements. | RACF userids that use z/OS UNIX must be properly configured. If these attributes are not correctly defined, data access or command privilege controls could be compromised. | | If this is a classified system, this is not applicable.
From a command input screen enter:
RLIST FACILITY (BPX.UNIQUE.USER) ALL
Examine APPLICATION DATA for userid
Enter:
List User (<userid>)
Alternately:
Refer to the following report produced by the RACF Data Collection:
- RACFCMDS.RPT(FACILITY)
- RACFCMDS.RPT(LISTUSER)
Note: This check applies to any user id used to model OMVS access on the mainframe. This includes the OMVS default user and BPX.UNIQUE.USER. If the OMVS default user or BPX.UNIQUE.USER is not defined in the FACILITY report, this is not applicable.
If user account used for OMVS account modeling is defined as follows, this is not a finding:
A non-writable HOME directory:
Shell program specified as "/bin/echo" or "/bin/false"
Note: The shell program must have one of the specified values. The HOME directory must have a value (i.e., not be allowed to default). |
| | CICS default logonid(s) must be defined and/or controlled in accordance with the security requirements. | CICS is a transaction-processing product that provides programmers with the facilities to develop interactive applications. An improperly defined or controlled CICS default userid may provide an exposure and vulnerability within the CICS environment. This could result in the compromise of the confidentiality, integrity, and availability of the CICS region, applications, and customer data. | | a) Refer to the following report produced by the z/OS Data Collection:
- EXAM.RPT(CICSPROC)
Refer to the following reports produced by the RACF Data Collection:
- RACFCMDS.RPT(LISTUSER)
- SENSITVE.RPT(TCICSTRN)
- SENSITVE.RPT(GCICSTRN)
NOTE: If a CICS region is using a site-defined transaction resource class pair, execute a RACF RLIST command against these resource classes.
Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010.
b) Ensure the following items are in effect for the CICS default userid (i.e., DFLTUSER=default userid):
1) Not granted the RACF OPERATIONS attribute.
2) No access to interactive on-line facilities (e.g., TSO) other than CICS.
3) TIMEOUT parameter in the CICS segment is set to 15 minutes.
4) A system's default time for terminal lock-out or session termination may be lengthened to 30 minutes at the discretion of the IAM. The IAM will maintain the documentation for each system with a time-out adjusted beyond the 15-minute recommendation to explain the basis for this decision.
5) Restricted from accessing all data sets and resources with the following exceptions:
(a) Non-restricted CICS transactions (e.g., CESF, CESN, ‘good morning’ transaction, etc.)
(b) If applicable, resources necessary to operate in an intersystem communication (ISC) environment (i.e., LU6.1, LU6.2, and MRO)
NOTE: Execute the JCL in CNTL(IRRUT100) using the CICS default userid as SYSIN input. This report lists all occurrences of this userid within the RACF database, including data set and resource access lists.
c) If all items in (b) are true, this not a finding.
d) If any item in (b) is untrue, this is a finding. |
| | z/OS system commands must be properly protected. | z/OS system commands provide a method of controlling the operating environment. Failure to properly control access to z/OS system commands could result in unauthorized personnel issuing sensitive system commands. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data. | | From a command input screen enter:
RLIST OPERCMDS * ALL
Alternately:
Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(ACP00282)
- SENSITVE.RPT(OPERCMDS) (Alternate report)
Automated Analysis:
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ACP00282)
The MVS.** resource is defined to the OPERCMDS class with a default access of NONE and all (i.e., failures and successes) access logged.
Access to z/OS system commands defined in the table entitled Required Controls on z/OS System Commands, in the z/OS STIG Addendum, is restricted to the appropriate personnel (e.g., operations staff, systems programming personnel, general users).
NOTE: Use the GROUP category specified in the table referenced above as a guideline to determine appropriate personnel access to system commands.
NOTE: The (MVS.SEND) Command will not be a finding if used by all.
All access (i.e., failures and successes) to specific z/OS system commands is logged as indicated in the table entitled Required Controls on z/OS System Commands, in the z/OS STIG Addendum.
If any of the above is untrue for any z/OS system command resource, this is a FINDING.
If all of the above are true, there is NO FINDING. |
| | CONSOLxx members must be properly configured. | MCS consoles can be used to issue operator commands. Failure to properly control access to MCS consoles could result in unauthorized personnel issuing sensitive operator commands. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data. | | Refer to the following report produced by the z/OS Data Collection:
- EXAM.RPT(PARMLIB)
Automated Analysis
Refer to the following report produced by the z/OS Data Collection:
- PDI(ACP00291)
Review each CONSOLxx parmlib member. If the following guidance is true, this is not a finding.
____ The "DEFAULT" statement for each CONSOLxx member specifies "LOGON(REQUIRED)" or "LOGON(AUTO)".
____ The "CONSOLE" statement for each console assigns a unique name using the "NAME" parameter.
____ The "CONSOLE" statement for each console specifies "AUTH(INFO)". Exceptions are the "AUTH" parameter is not valid for consoles defined with "UNIT(PRT)" and specifying "AUTH(MASTER)" is permissible for the system console.
Note: The site should be able to determine the system consoles. However, it is imperative that the site adhere to the "DEFAULT" statement requirement. |
| | MCS console userid(s) will be properly protected. | MCS consoles can be used to issue operator commands. Failure to properly control access to MCS consoles could result in unauthorized personnel issuing sensitive operator commands. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data. | | Refer to the following report produced by the z/OS Data Collection:
- EXAM.RPT(PARMLIB)
Refer to the following report produced by the RACF Data Collection and Data Set and Resource Data Collection:
- RACFCMDS.RPT(LISTUSER)
- RACFCMDS.RPT(LISTGRP)
- SENSITVE.RPT(OPERCMDS)
- RACFCMDS.RPT(DATASET)
Verify that the MCS console userids are properly restricted. If the following guidance is true, this is not a finding.
____ Each console defined in the currently active CONSOLxx parmlib member in EXAM.RPT(PARMLIB) is associated with a valid RACF userid.
____ Each console userid has no special privileges and/or attributes (e.g., SPECIAL, OPERATIONS, etc.).
____ Each console userid has no accesses to interactive on-line facilities (e.g., TSO, CICS, etc.).
____ Each console userid will be restricted from accessing all data sets and resources except MVS.MCSOPER.consolename in the OPERCMDS resource class and consolename in the CONSOLE resource class.
____ Each console userid has the RACF default group that is an appropriate console group profile.
NOTE: If LOGON(AUTO) is specified in the currently active CONSOLxx parmlib member, additional access may be required. Permissions for the console userids and/or console group may be given with access READ to MVS.CONTROL, MVS.DISPLAY, MVS.MONITOR, and MVS.STOPMN OPERCMDS resource.
NOTE: Execute the JCL in CNTL(IRRUT100) using the RACF console userids as SYSIN input. This report lists all occurrences of these userids within the RACF database, including data set and resource access lists. |
| | MCS consoles access authorization(s) for CONSOLE resource(s) must be properly protected. | MCS consoles can be used to issue operator commands. Failure to properly control access to MCS consoles could result in unauthorized personnel issuing sensitive operator commands. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data. | | Refer to the following report produced by the z/OS Data Collection:
- EXAM.RPT(CONSOLE)
Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(CONSOLE)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ACP00293)
Ensure the following items are in effect for all MCS consoles identified in the EXAM.RPT(CONSOLE):
1) Each console is defined to RACF with a corresponding profile in the CONSOLE resource class.
2) Each CONSOLE profile is defined with UACC(NONE).
3) The userid associated with each console has READ access to the corresponding resource defined in the CONSOLE resource class.
4) Access authorization for CONSOLE resources restricts READ access to operations and system programming personnel. |
| | Users that have access to the CONSOLE resource in the TSOAUTH resource class are not properly defined. | MCS consoles can be used to issue operator commands. Failure to properly control access to MCS consoles could result in unauthorized personnel issuing sensitive operator commands. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data. | | a) Refer to the following reports produced by the RACF Data Collection:
- RACFCMDS.RPT(LISTUSER)
- SENSITVE.RPT(OPERCMDS)
- SENSITVE.RPT(TSOAUTH)
b) If the CONSOLE privilege is not defined to the TSOAUTH resource class, there is NO FINDING.
c) At the discretion of the IAO, users may be allowed to issue z/OS system commands from a TSO session. With this in mind, ensure the following items are in effect for users granted the CONSOLE resource in the TSOAUTH resource class:
1) Userids are restricted to the INFO level on the AUTH parameter specified in the OPERPARM segment of their userid.
2) Userids are restricted to READ access to the MVS.MCSOPER.userid resource defined in the OPERCMDS resource class.
3) Userids and/or group IDs are restricted to READ access to the CONSOLE resource defined in the TSOAUTH resource class.
d) If all of the above in (c) are true, there is NO FINDING.
e) If any of the above in (c) are untrue, this is a FINDING. |
| | FACILITY resource class is inactive. | IBM Provides the FACILITY Class for use in protecting a variety of features/functions/products both IBM and third party. The FACILITY Class is not dedicated to any one specific use and is intended as a multi-purpose RACF Class. Failure to activate this class will result in unprotected resources. This exposure may threaten the integrity of the operating system environment, and compromise the confidentiality of customer data. | | a) Refer to the following reports produced by the RACF Data Collection:
- RACFCMDS.RPT(SETROPTS)
- DSMON.RPT(RACCDT) - Alternate list of active resource classes
Automated Analysis
Refer to the following report produced by the RACF Data Collection:
- PDI(RACF0244)
b) If the FACILITY resource class is active, there is NO FINDING.
c) If the FACILITY resource class is not active, this is a FINDING. |
| | MCS consoles are not active. | (RACF0248: CAT II) MCS consoles can be used to issue operator commands. Failure to properly control access to MCS consoles could result in unauthorized personnel issuing sensitive operator commands. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data. | | a) Refer to the following reports produced by the RACF Data Collection:
- RACFCMDS.RPT(SETROPTS)
- DSMON.RPT(RACCDT) - Alternate list of active resource classes
Automated Analysis
Refer to the following report produced by the RACF Data Collection:
- PDI(RACF0248)
b) If the CONSOLE resource class is active, there is NO FINDING.
c) If the CONSOLE resource class is not active, this is a FINDING. |
| | The OPERCMDS resource class is not active. | z/OS system commands provide a method of controlling the operating environment. Failure to properly control access to z/OS system commands could result in unauthorized personnel issuing sensitive system commands. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data. | | a) Refer to the following reports produced by the RACF Data Collection:
- RACFCMDS.RPT(SETROPTS)
- DSMON.RPT(RACCDT) - Alternate list of active resource classes
Automated Analysis
Refer to the following report produced by the RACF Data Collection:
- PDI(RACF0246)
b) If the OPERCMDS resource class is active, there is NO FINDING.
c) If the OPERCMDS resource class is not active, this is a FINDING. |
| | CICS system data sets are not properly protected. | CICS is a transaction-processing product that provides programmers with the facilities to develop interactive applications. Unauthorized access to CICS system data sets (i.e., product, security, and application libraries) could result in the compromise of the confidentiality, integrity, and availability of the CICS region, applications, and customer data. | | a) Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(CICSRPT)
Since it is possible to have multiple CICS regions running on an LPAR, it is recommended that you go into the z/OS STIG Addendum and fill out all the information in the "CICS System Programmers Worksheet" for each CICS region running on your LPAR. It is recommended that you save this information for any other CICS vulnerabilities that will require it.
b) WRITE and/or ALLOCATE access to CICS system data sets is restricted to systems programming personnel.
c) If (b) is true, there is NO FINDING.
d) If (b) is untrue, this is a FINDING. |
| | Batch job user Ids must be properly defined. | Batch jobs are submitted to the operating system under their own USERID. This will identify the batch job with the user for the purpose of accessing resources. BATCHALLRACF ensures that a valid USERID is associated with batch jobs. Jobs that are submitted to the operating system via a scheduling facility must also be identified to the system. Without a batch job having an associated USERID, access to system resources will be limited. | | Refer to the documentation of the processes used for submission of batch jobs via an automated process (i.e., scheduler or other sources) and each of the associated user IDs.
From a command input screen enter:
LISTUSER(each identified batch job)
Alternately:
Refer to the following report produced by the RACF Data Collection:
- RACFCMDS.RPT(LISTUSER)
The following USERID record fields/attributes must be specified:
NAME
PROTECTED
No USERID has the LAST-ACCESS field set to UNKNOWN.
If both of the above are true, this is not a finding.
If either of the USERID record fields/attributes (NAME and/or PROTECTED) are blank and/or the LAST ACCESS field is set to unknown, this is a finding. |
| | z/OS USS Software owning Shared accounts do not meet strict security and creation restrictions. | Shared accounts by nature are a violation of proper audit trail and proper user authentication. If not properly controlled, could cause system corruption without an audit trail tracking session
activity to an individual user's identity. | | z/OS Software owning "Shared accounts" maybe created for the installation and upgrades on the z/OS Mainframe products that require the use of USS (UNIX System Services) as long as all IA requirements are met. "z/OS USS Software Owning Shared Accounts" shall be referenced within this VUL as the full name or abbreviated "Shared accounts" for all references within this VUL.
Rules and requirements for z/OS USS Software Owning Shared Accounts.
1) Shall include a statement from the responsible SA requesting the "shared account", stating specific justification for the z/OS USS Software Owning shared account. Responsible SA shall be responsible for maintaining all documentation concerning account, usage, control, annual review, etc and shall provide upon request by IA staff or auditors as requested.
2) A separate "z/OS USS Software Owning shared account" userid will be created for each application and/or product that requires USS for separation of duties for product support. This "shared account" shall be used for the sole purpose of file/directory ownership based upon the UID assigned to the "shared account".
3) The "shared accounts" shall only be used within/for USS (UNIX System Services). The "shared account" userids shall have no special privileges, will not be granted access to interactive on-line facilities, batch facility, and will not be granted access to datasets and resources outside of the USS environment.
4) The "shared account" userids shall adhere to the same complex password syntax rules and shall be assigned a non-expiring complex password or be set up as protected under RACF.
5) Authorized user(s) shall only access "shared account" via the USS "SU" Command (switch user: su -s userid ) and not utilize any password. When the ACP IAO creates the account with a complex password, such password shall not be written down or shared with others.
6) The responsible documented z/OS system programmer shall be granted specific limited and temporary access based upon submitted security service requests identifying project, duration required and justification for accessing "shared account" via the "su" command on a specific z/OS domain, example: initial software installation or upgrade of specific vendor software.
7) Responsible individual z/OS System programmer shall be granted temporary access to the specific BPX.SRV.userid ("userid" shall be the single "shared account" requested) in the surogate user class with full logging of the permission to BPX.SRV.userid for the specific period of time required to perform functional requirements via the "su" command and appropriate usage of the "shared account".
8) Standard procedure for all updates within USS Directories/files shall be performed based upon the direct authority granted to the z/OS system programmer individual userids. Shared accounts shall only be utilized for initial software installation or vendor software upgrades.
If all the above requirements are not met for the z/OS USS Software Owning shared account, this is a finding. |
| | IEASYMUP resource will be protected in accordance with proper security requirements. | Failure to properly control access to the IEASYMUP resource could result in unauthorized
personnel modifying sensitive z/OS symbolics. This exposure may threaten the integrity and
availability of the operating system environment. | | Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(FACILITY)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ACP00350)
Verify that the accesses for IEASYMUP resources and/or generic equivalent are properly restricted. If the following guidance is true, this is not a finding.
___ The RACF resources are defined with a default access of NONE.
___ The RACF resource access authorizations restrict UPDATE and/or greater access to DASD administrators, Tape Library personnel, and system programming personnel.
___ The RACF resource logging requirements are specified.
___ The RACF resource access authorizations are defined with UACC(NONE) and NOWARNING. |
| | FTP Control cards will be properly stored in a secure PDS file. | FTP control cards carry unencrypted information such as userids, passwords and remote IP Addresses. Without a requirement to store this information separate from the JCL and in-stream JCL, it allows a security exposure by allowing read exposure to this information from anyone having access to the JCL libraries. Configure CustomDsnType to define a custom DSN type for the sens (sensitive data sets) table. | | Provide a list(s) of the locations for all FTP Control cards within a given application/AIS, ensuring no FTP control cards are within in-stream JCL, JCL libraries or any open access datasets. List shall indicate which application uses the PDS, and access requirements for those PDS's (who and what level of access). Lists/spreadsheet used for documenting the meeting of this requirement shall be maintained by the responsible Application/AIS Team, available upon request and not maintained by DISA Mainframe IAO.
Refer to the to the above list
Access to FTP scripts and/or data files located on host system(s) that contain FTP userid and or password will be restricted to those individuals responsible for the application connectivity and who have a legitimate requirement to know the userid and password on a remote system.
FTP Control Cards within In-stream JCL, within JCL libraries or open access libraries/datasets is a finding.
Anyone having access of read or greater to the FTP control cards not listed within the spreadsheet by userid is a finding. |
| | Sensitive and critical system data sets exist on shared DASD. | Any time a sensitive or critical system data set is allocated on a shared DASD device, it is critical to validate that it is properly protected on any additional systems that are sharing that device. Without proper review and adequate restrictions to access of these data sets on all systems sharing them, can lead to corruption, integrity and availability of the operating system, ACP, and customer data. | | Check HMC, VM, and z/OS on how to validate and determine a DASD volume(s) is shared.
Note: In VM issue the command 'QUEUE DASD SYSTEM' this display will show shared volume(s) and indicates the number of systems sharing the volume.
Validate all machines that require access to these shared volume(s) have the volume(s) mounted.
Obtain a map or list VTOC of the shared volume(s).
Check if shared volume(s) contain any critical or sensitive data sets.
Identify shared and critical or sensitive data sets on the system being audited. These data sets can be APF, LINKLIST, LPA, Catalogs, etc, as well as product data sets.
If all of the critical or sensitive data sets identified on shared volume(s) are protected and justified to be on shared volume(s), this is not a finding.
List critical or sensitive data sets are possible security breaches, if not justified and not protected on systems having access to the data set(s) and on shared volume(s). |
| | RACF exit ICHPWX01 must be installed and properly configured. | Password complexity, or strength, is a measure of the effectiveness of a password in resisting guessing and brute-force attacks. Password complexity is one factor of several that determine how long it takes to crack a password. The more complex the password is, the greater the number of possible combinations that need to be tested before the password is compromised. Use of a complex password helps to increase the time and resources required to compromise the password.
The RACF exit ICHPWX01 will allow for additional checks not available in RACF SETROPTS whenever a user selects a new password. Improper setting of any of these fields, individually or in combination with another, can result in weakened passwords and compromise the security of the processing environment. | | From a system console screen issue the following modify command:
F AXR,IRRPWREX LIST
Automated Analysis
Refer to the following report produced by the RACF Data Collection:
- PDI(RACF0462)
Review the results of the modify command. If the following options are listed, this is not a finding.
The number of required character types is 4
(assures that at least 1 upper case, 1 lower case, 1 number, and 1 special character is used in Password)
The user's name cannot be contained in the password
Only 3 consecutive characters of the user's name are allowed
The minimum word length checked is 8
The user ID cannot be contained in the password
Only 3 consecutive characters of the user ID are allowed
Only 3 unchanged positions of the current password are allowed
These positions need to be consecutive to cause a failure
This check is not case sensitive
No more than 0 pairs of repeating characters are allowed
This check is not case sensitive
A minimum list of 33 restricted prefix strings is being checked:
APPL APR AUG ASDF BASIC CADAM DEC DEMO FEB FOCUS GAME IBM JAN JUL
JUN LOG MAR MAY NET NEW NOV OCT PASS ROS SEP SIGN SYS TEST TSO
VALID VTAM XXX 1234
If the modify command fails or returns the following message in the system log, this is a finding.
IRX0406E REXX exec load file REXXLIB does not contain exec member IRRPWREX. |
| | The RACF System REXX IRRPWREX security data set must be properly protected. | The RACF System REXX named IRRPWREX contains sensitive access control and password information for the operating system environment and system resources. Unauthorized access could result in the compromise of passwords, the operating system environment, ACP (Access Control Program), and customer data. | | Refer to the following report produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(RACFREXX)
Alternate source
Refer to the zOS system REXXLIB concatenation found in SYS1. PARMLIB (AXR) for the data set that contains the REXX for Password exit named IRRPWREX and the defined AXRUSER.
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(RACF0465)
Verify that the data set that contains IRRPWREX is properly restricted. If the following guidance is true, this is not a finding.
___ RACF data set access authorizations restrict READ to AXRUSER, z/OS systems programming personnel, security personnel, and auditors.
___ RACF data set access authorizations restrict UPDATE to security personnel using a documented change management procedure to provide a mechanism for access and revoking of access after use.
___ All (i.e., failures and successes) data set access authorities (i.e. READ, UPDATE, and CONTROL) is logged.
___ RACF data set access authorizations specify UACC(NONE) and NOWARNING. |
| | NIST FIPS-validated cryptography must be used to protect passwords in the security database. | Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. Cryptographic modules must adhere to the higher standards approved by the federal government since this provides assurance they have been tested and validated. | | From the ISPF Command Shell enter
SETRopts List
Alternately:
Refer to the following report produced by the RACF Data Collection:
- RACFCMDS.RPT(SETROPTS)
Automated Analysis
Refer to the following report produced by the RACF Data Collection:
- PDI(RACF0467)
If the following is specified under "PASSWORD PROCESSING OPTIONS:
"THE ACTIVE PASSWORD ENCRYPTION ALGORITHM IS KDFAES" , this is not a finding. |
| | The SSH daemon must be configured to only use the SSHv2 protocol. | SSHv1 is not a DoD-approved protocol and has many well-known vulnerability exploits. Exploits of the SSH daemon could provide immediate root access to the system. | | Locate the SSH daemon configuration file.
May be found in /etc/ssh/ directory.
Alternately:
From UNIX System Services ISPF Shell navigate to ribbon select tools.
Select option 1 - Work with Processes.
If SSH Daemon is not active there is no finding.
Examine SSH daemon configuration file. If the variables 'Protocol 2,1’ or ‘Protocol 1’ are defined on a line without a leading comment, this is a finding. |
| | The SSH daemon must be configured to use a FIPS 140-2 compliant cryptographic algorithm. | Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. Cryptographic modules must adhere to the higher standards approved by the federal government since this provides assurance they have been tested and validated. | | Locate the SSH daemon configuration file.
May be found in /etc/ssh/ directory.
Alternately:
From UNIX System Services ISPF Shell navigate to ribbon select tools.
Select option 1 - Work with Processes.
If SSH Daemon is not active there is no finding.
Examine SSH daemon configuration file.
sshd_config
If there are no Ciphers lines or the ciphers list contains any cipher not starting with "3des" or "aes", this is a finding.
If the MACs line is not configured to "hmac-sha1" or greater this is a finding.
Examine the z/OS-specific sshd server system-wide configuration
zos_sshd_config
If any of the following is untrue this is a finding.
FIPSMODE=YES
CiphersSource=ICSF
MACsSource=ICSF |
| | The SSH daemon must be configured to use SAF keyrings for key storage. | The use of SAF Key Rings for key storage enforces organizational access control policies and assures the protection of cryptographic keys in storage. | | Locate the SSH daemon configuration file.
May be found in /etc/ssh/ directory.
Alternately:
From UNIX System Services ISPF Shell navigate to ribbon select tools.
Select option 1 - Work with Processes.
If SSH Daemon is not active there is no finding.
Examine the file.
Ensure the following are either not coded or commented out:
#HostKey for protocol version 1
#HostKey /etc/ssh/ssh_host_key
#HostKeys for protocol version 2
#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_dsa_key
Locate the z/OS-specific sshd server system-wide configuration file.
zos_sshd_config
May be found in /etc/ssh/ directory.
Ensure that a HostKeyRingLabel line is coded and not commented out.
If either of the above is not true this is a finding. |
| | SMF recording options for the SSH daemon must be configured to write SMF records for all eligible events. | SMF data collection is the basic unit of tracking of all system functions and actions. Included in this tracking data are the audit trails from each of the ACPs. If the control options for the recording of this tracking are not properly maintained, then accountability cannot be monitored, and its use in the execution of a contingency plan could be compromised. | | Locate the SSH daemon configuration file.
May be found in /etc/ssh/ directory.
Alternately:
From UNIX System Services ISPF Shell navigate to ribbon select tools.
Select option 1 - Work with Processes.
If SSH Daemon is not active there is no finding.
Examine SSH daemon configuration file.
If ServerSMF is not coded with ServerSMF TYPE119_U83 or is commented out this is a finding. |
| | The SETROPTS LOGOPTIONS must be properly configured. | Audit records are central to after-the-fact investigations of security incidents. Every effort should be taken to collect as much information as productively feasible for these investigative processes. The SETROPTS LOGOPTIONS option serves as a default auditing requirement. Auditing 'Failures' as a minimum will assure a base level of information is available for investigations. | | From the ISPF Command Shell enter:
SETRopts List
Alternately:
Refer to the following report produced by the RACF Data Collection:
RACFCMDS.RPT(SETROPTS)
Automated Analysis
Refer to the following report produced by the RACF Data Collection:
PDI(RACF0540)
If the following options are specified at a minimum, this is not a finding.
LOGOPTIONS "FAILURES" CLASSES = <all the classes listed in the "ACTIVE" class as a minimum>
LOGOPTIONS "NEVER" CLASSES = NONE |
| | Libraries included in the system REXXLIB concatenation must be properly protected. | The libraries included in the system REXXLIB concatenation can contain program modules which possess a significant level of security bypass capability. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data. | | Refer to the following reports produced by the Data Set and Resource Data Collection:
- SENSITVE.RPT(REXXRPT)
Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:
- PDI(ACP00062)
The ACP data set rules for libraries in the REXXLIB concatenation restrict inappropriate (e.g., GLOBAL read) access.
The ACP data set rules for libraries in the REXXLIB concatenation restrict WRITE or greater access to only z/OS systems programming personnel.
The ACP data set rules for libraries in the REXXLIB concatenation restrict READ access to the following:
Appropriate Started Tasks
Auditors
The user-id defined in PARMLIB member AXR00 AXRUSER(user-id)
The ACP data set rules for libraries in the REXXLIB concatenation specify that all (i.e., failures and successes) WRITE or greater access will be logged.
If all of the above are true, this is not a finding.
If any of the above is not true, this is a finding. |
| | The RACF SERVAUTH resource class must be active for TCP/IP resources. | IBM Provides the SERVAUTH Class for use in protecting a variety of TCP/IP features/functions/products both IBM and third-party. Failure to activate this class will result in unprotected resources. This exposure may threaten the integrity of the operating system environment, and compromise the confidentiality of customer data. | | From a command input screen enter
SETROPTS LIST
Alternately,
Refer to the following reports produced by the RACF Data Collection:
RACFCMDS.RPT (SETROPTS)
DSMON.RPT (RACCDT) - Alternate list of active resource classes
Automated Analysis:
Refer to the following report produced by the RACF Data Collection:
- PDI(ITCPR052)
If there are TCP/IP resources defined and the SERVAUTH resource class is not active, this is a finding. |
| | RACF Global Access Checking must be restricted to appropriate classes and resources | RACF Global access checking can be used to improve the performance of RACF authorization checking for selected resources. The global access checking table is maintained in storage and is checked early in the RACF authorization checking sequence. If an entry in the global access checking table allows the requested access to a resource, RACF performs no further authorization checking. This can eliminate the need for I/O to the RACF database to retrieve a resource profile, which can result in substantial performance improvements. However, if an entry in the global access checking table allows a requested access to a resource, no auditing is done for the request. Capture of audit data ensure a historical checking of individual user accountability. This accountability is basic for forensic purposes. | | From a command input screen enter:
RL Global *
Alternately this can be viewed by following steps:
Refer to the following reports produced by the RACF Data Collection:
- DSMON.RPT(RACGAC) –
Examine the Global Access Checking entries.
If Global * is specified in SETROPTS this is a finding.
The following entries may be allowed with the approval of the ISSM:
Dataset Class – ALTER access level to &RACUID.** (Allows users all access to their own datasets)
OPERCMDS Class – READ access to MVS.MCSOPER.&RACUID (Allows users access to console for their jobs)
JESJOBS Class – ALTER access to CANCEL.*.*.&RACUID (Allows users to cancel their own jobs)
JESJOBS Class – ALTER access to SUBMIT.*.*.&RACUID (Allows users to submit their own jobs)
The ISSM may allow other classes to be included after evaluation with the system programmer.
If any other members are included for Global Access Checking this is a finding.
If written approval by the ISSM is not provided this is a finding. |
| | IBM RACF DASD volume-level protection must be properly defined. | To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement. | | From the ISPF Command Shell enter:
RLIST DASDVOL AUTHUSER
If a profile of "**" is defined for the "DASDVOL" resource class, this is not finding.
If access authorization to "DASDVOL" profiles is restricted to Storage Management Personnel, Storage Management Batch Userids, and Systems Programmers, this is not a finding.
If all (i.e., failures and successes) access is logged, this is not a finding. |
| | IBM RACF must limit Write or greater access to SYS1.UADS to system programmers only, and WRITE or greater access must be limited to system programmer personnel and/or security personnel. | To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.
Satisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000324-GPOS-00125 | | The ESM data set rules for SYS1.UADS restrict WRITE or Greater access to only z/OS systems programming personnel.
The ESM data set rules for SYS1.UADS restrict READ and/or UPDATE access to z/OS systems programming personnel and/or security personnel.
The ESM data set rules for SYS1.UADS restrict READ access to auditors as documented in Security Plan.
The ESM data set rules for SYS1.UADS specify that all (i.e., failures and successes) data set access authorities (i.e., READ, UPDATE, ALTER, and CONTROL) will be logged.
If all of the above are untrue, this is not a finding.
If any of the above is true, this is a finding. |
| | IBM z/OS must protect dynamic lists in accordance with proper security requirements. | To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.
Satisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000324-GPOS-00125 | | Execute RACF command:
RLIST FACILITY *
If the RACF resources and/or generic equivalent identified below are defined with AUDIT(ALL(READ)) and WRITE or greater access restricted to system programming personnel, this is not a finding.
CSVAPF.
CSVAPF.MVS.SETPROG.FORMAT.DYNAMIC
CSVAPF.MVS.SETPROG.FORMAT.STATIC
CSVDYLPA.
CSVDYNEX.
CSVDYNEX.LIST
CSVDYNL.
CSVDYNL.UPDATE.LNKLST
CSVLLA.
If the RACF CSVDYNEX.LIST resource and/or generic equivalent is defined with AUDIT(FAILURE(READ)SUCCESS(UPDATE)) and WRITE or greater access restricted to system programming personnel, this is not a finding.
If the RACF CSVDYNEX.LIST resource and/or generic equivalent is defined with READ access restricted to auditors, this is not a finding.
If the products CICS and/or CONTROL-O are on the system, the RACF access to the CSVLLA resource and/or generic equivalent will be defined with AUDIT(ALL) and UPDATE access restricted to the CICS and CONTROL-O STC userids.
If any software product requires access to dynamic LPA updates on the system, the RACF access to the CSVDYLPA resource and/or generic equivalent will be defined with LOG and SERVICE(UPDATE) only after the product has been validated with the appropriate STIG or SRG for compliance AND receives documented and filed authorization that details the need and any accepted risks from the site ISSM or equivalent security authority.
Note: In the above, UPDATE access can be substituted with ALTER or CONTROL. Review the permissions in the IBM documentation when specifying UPDATE. |
| | IBM RACF access to SYS1.LINKLIB must be properly protected. | To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.
Satisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000259-GPOS-00100, SRG-OS-000324-GPOS-00125, SRG-OS-000362-GPOS-00149 | | Execute a dataset list of access to SYS1.LINKLIB.
If the ESM data set rules for SYS1.LINKLIB allow inappropriate (e.g., global READ) access, this is a finding.
If data set rules for SYS1.LINKLIB do not restrict READ, UPDATE, and ALTER access to only systems programming personnel, this is a finding.
If data set rules for SYS1.LINKLIB do not restrict READ and UPDATE access to only domain level security administrators, this is a finding.
If data set rules for SYS1.LINKLIB do not restrict READ access to only system Level Started Tasks, authorized Data Center personnel, and auditors, this is a finding.
If data set rules for SYS1.LINKLIB do not specify that all (i.e., failures and successes) UPDATE and/or ALTER access will be logged, this is a finding. |
| | IBM RACF must limit access to System page data sets (i.e., PLPA, COMMON, and LOCALx) to system programmers. | To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.
Satisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000324-GPOS-00125 | | Execute a dataset list of access for System page data sets (i.e., PLPA, COMMON, and LOCALx).
If ESM data set rules for system page data sets (PLPA, COMMON, and LOCAL) restrict access to only systems programming personnel, this is not a finding.
If ESM data set rules for system page data sets (PLPA, COMMON, and LOCAL) restrict auditors to READ only, this is not a finding. |
| | The IBM z/OS IEASYMUP resource must be protected in accordance with proper security requirements. | Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges. | | From the ISPF Command Shell enter:
Search all Class(Facility) MASK(ieasymup)
For each entity found enter:
RL facility <entity>
If RACF resources are defined with a default access of NONE, this is not a finding.
If RACF resource access authorizations restrict UPDATE and/or greater access to appropriate personnel (i.e., DASD administrators, Tape Library personnel, and system programming personnel), this is not a finding.
If RACF resource logging requirements are specified for UPDATE and/or greater access, this is not a finding. |
| | The IBM RACF PASSWORD(REVOKE) SETROPTS value must be set to automatically lock an account until the locked account is released by an administrator when three unsuccessful logon attempts occur. | By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-force attacks, is reduced. Limits are imposed by locking the account. | | From the ISPF Command Shell enter:
SETRopts List
If the PASSWORD(REVOKE) value shows "AFTER <n> CONSECUTIVE UNSUCCESSFUL PASSWORD ATTEMPTS, A USERID WILL BE REVOKED." where <n> is either "1" or "2", this is not a finding.
If the PASSWORD(REVOKE) value is not enabled and is not set to either "1" or "2", this is a finding. |
| | IBM RACF must define WARN = NO on all profiles. | Failure to restrict system access to authenticated users negatively impacts operating system security. | | Review all Dataset and resource profiles in the RACF database.
If any are not defined with WARN = NO, this is a finding. |
| | IBM interactive USERIDs defined to RACF must have the required fields completed. | Interactive users are considered to be users of CICS, IMS, TSO/E, NetView, or other products that support logging on at a terminal. Improper assignments of attributes in the LOGONID record for interactive users may allow users excessive privileges resulting in unauthorized access. | | From a z/OS command screen enter:
ListUser *
Examine each user entry that has either TSO, CICS, ROSCOE, IMS, or any other products that support logging on at a terminal.
If every user is fully identified with all of the following condition, this is not a finding.
-Each interactive userid has a valid LAST-ACCESS date that does not contain the value UNKNOWN.
-Each interactive userid has PASS-INTERVAL define and set to a value of 60 days.
Note: FTP only process and server to server userids may have PASSWORD(NOINTERVAL) specified. These users must be identified in the FTPUSERS group in the Dialog Process or FTP in the name field. Additionally these users must change their passwords on an annual basis. |
| | The IBM RACF PASSWORD(HISTORY) SETROPTS value must be set to 5 or more. | Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. HISTORY specifies the number of previous passwords that RACF saves for each USERID and compares with an intended new password. If there is a match with one of the previous passwords, or with the current password, RACF rejects the intended new password. | | From the ISPF Command Shell enter:
SETRopts List
If the PASSWORD(HISTORY) value is set properly then the message x GENERATIONS OF PREVIOUS PASSWORDS BEING MAINTAINED, where x is a minimum of "5", this is not a finding. |
| | IBM z/OS FTP.DATA configuration statements for the FTP server must specify the BANNER statement. | Display of a standardized and approved use notification before granting access to the publicly accessible operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.
System use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist.
The banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters:
"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.
By using this IS (which includes any device attached to this IS), you consent to the following conditions:
-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.
-At any time, the USG may inspect and seize data stored on this IS.
-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.
-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.
-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details."
Use the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:
"I've read & consent to terms in IS user agreem't." | | Refer to the Data configuration file specified on the SYSFTPD DD statement in the FTP started task JCL.
If the BANNER statement is coded, this is not a finding. |
| | IBM z/OS FTP.DATA configuration statements for the FTP Server must be specified in accordance with requirements. | This requirement is intended to cover both traditional interactive logons to information systems and general accesses to information systems that occur in other types of architectural configurations (e.g., service-oriented architectures). | | Refer to the Data configuration file specified on the SYSFTPD DD statement in the FTP started task JCL.
If the UMASK statement is coded with a value of 077, this is not a finding. |
| | IBM FTP.DATA configuration for the FTP server must have the INACTIVE statement properly set. | Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition, quickly terminating an idle session will also free up resources committed by the managed network element.
Terminating network connections associated with communications sessions includes, for example, de-allocating associated TCP/IP address/port pairs at the operating system level, and de-allocating networking assignments at the application level if multiple application sessions are using a single operating system-level network connection. This does not mean that the operating system terminates all sessions or network access; it only ends the inactive session and releases the resources associated with that session. | | Refer to the Data configuration file specified on the SYSFTPD DD statement in the FTP started task JCL.
If the INACTIVE statement is coded with a value between 1 and 900 (seconds), this is not a finding. |
| | IBM z/OS JES2 input sources must be controlled in accordance with the proper security requirements. | To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.
Access control policies include: identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include: access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system. | | Refer the JES2PARM member of SYS1.PARMLIB.
Review the following resources in the RACF JESINPUT resource class:
INTRDR (internal reader for batch jobs)
nodename (NJE node)
OFFn.* (spool offload receiver)
Rnnnn (RJE workstation)
RDRnn (local card reader)
STCINRDR (internal reader for started tasks)
TSUINRDR (internal reader for TSO logons)
Note: If any of the following are not defined within the JES2 parameters, the resource in the JESINPUT resource class does not have to be defined.
-Nodename is the NAME parameter in the NODE statement. Review the NJE node definitions by searching for NODE( in the report.
-OFFn, where n is the number of the offload receiver. Review the spool offload receiver definitions by searching for OFF( in the report.
-Rnnnn, where nnnn is the number of the remote workstation. Review the RJE node definitions by searching for RMT( in the report.
-RDRnn, where nn is the number of the reader. Review the reader definitions by searching for RDR( in the report.
If the JESINPUT resource class is active, this is not a finding.
If the resources detailed above are protected by generic and/or fully qualified profiles defined to the JESINPUT resource class, this is not a finding. |
| | IBM z/OS JES2 input sources must be properly controlled. | To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.
Access control policies include: identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include: access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system. | | From the ISPF Command Shell enter:
RL JESINPUT *
If the RACF resources and/or generic equivalent identified below are defined with access restricted to the appropriate personnel, this is not a finding.
INTRDR
nodename
OFFn.*
OFFn.JR
OFFn.SR
Rnnnn.RDm
RDRnn
STCINRDR
TSUINRDR and/or TSOINRDR
Note: Examples of appropriate might be access to the offload input sources is limited to systems personnel (e.g., operations staff) as directed by site operations and the site security plan. |
| | IBM z/OS JES2 output devices must be properly controlled for classified systems. | To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.
Access control policies include: identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include: access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system. | | From the ISPF Command Shell enter:
RL WRITER *
If the RACF resources and/or generic equivalent identified below are defined with access restricted to the appropriate personnel, this is not a finding.
JES2.LOCAL.devicename
JES2.LOCAL.OFFn.*
JES2.LOCAL.OFFn.JT
JES2.LOCAL.OFFn.ST
JES2.LOCAL.PRTn
JES2.LOCAL.PUNn
JES2.NJE.nodename
JES2.RJE.devicename
Note: Examples of appropriate might be access to the offload input sources is limited to systems personnel (e.g., operations staff) as directed by site operations and the site security plan. |
| | IBM z/OS must configure system wait times to protect resource availability based on site priorities. | Automatic session termination addresses the termination of user-initiated logical sessions in contrast to the termination of network connections that are associated with communications sessions (i.e., network disconnect). A logical session (for local, network, and remote access) is initiated whenever a user (or process acting on behalf of a user) accesses an organizational information system. Such user sessions can be terminated (and thus terminate user access) without terminating network sessions.
Session termination terminates all processes associated with a user's logical session except those processes that are specifically created by the user (i.e., session owner) to continue after the session is terminated.
Conditions or trigger events requiring automatic session termination can include, for example, organization-defined periods of user inactivity, targeted responses to certain types of incidents, and time-of-day restrictions on information system use.
This capability is typically reserved for specific operating system functionality where the system owner, data owner, or organization requires additional assurance. | | Refer to IEASYS00 member in SYS1.PARMLIB Concatenation. Determine proper SMFPRMxx member.
Examine the JWT, SWT, and TWT values.
If the JWT parameter is greater than "15" minutes, and the system is processing unclassified information, review the following items.
If any of these items is true, this is not a finding.
-If a session is not terminated, but instead is locked out after "15" minutes of inactivity, a process must be in place that requires user identification and authentication before the session is unlocked. Session lock-out will be implemented through system controls or terminal screen protections.
-A system’s default time for terminal lock-out or session termination may be lengthened to "30" minutes at the discretion of the ISSM or ISSO. The ISSA and/or ISSO will maintain the documentation for each system with a time-out adjusted beyond the 15-minute recommendation to explain the basis for this decision.
-The ISSM and/or ISSO may set selected userids to have a time-out of up to "60" minutes in order to complete critical reports or transactions without timing out. Each exception must meet the following criteria:
-The time-out exception cannot exceed "60" minutes.
-A letter of justification fully documenting the user requirement(s) must be submitted and approved by the site ISSM or ISSO. In addition, this letter must identify an alternate means of access control for the terminal(s) involved (e.g., a room that is locked at all times, a room with a cipher lock to limit access, a password protected screen saver set to "30" minutes or less, etc.).
-The requirement must be revalidated on an annual basis.
If the TWT and SWT values are equal or less than the JWT value, this is not a finding. |
| | The IBM z/OS BPX.SMF resource must be properly configured. | Remote access services, such as those providing remote access to network devices and information systems, which lack automated monitoring capabilities, increase risk and make remote user access management difficult at best.
Remote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.
Automated monitoring of remote access sessions allows organizations to detect cyber attacks and also ensure ongoing compliance with remote access policies by auditing connection activities of remote access capabilities, such as Remote Desktop Protocol (RDP), on a variety of information system components (e.g., servers, workstations, notebook computers, smartphones, and tablets). | | Review the FACILITY resource class for BPX.SMF.
If the RACF rules are as follows this is not a finding.
BPX.SMF.119.94 — READ allowed for users running the ssh, sftp, or scp client commands.
BPX.SMF.119.96 — READ allowed for users running the scp or sftp-server server commands.
BPX.SMF.119.97 — READ allowed for users running the scp or sftp client commands.
The following profile grants the permitted users the authority to write or test for any SMF record being recorded. Access should be permitted as follows:
BPX.SMF — READ access only when documented and justified in Site Security Plan. Documentation should include a reason why a more specific profile is not acceptable. |
| | IBM RACF must be installed and active on the system. | Enterprise environments make account management for operating systems challenging and complex. A manual process for account management functions adds the risk of a potential oversight or other errors. IBM z/OS requires an external security manager to assure proper account management. | | Refer to IEASYS00 member in SYS1.PARMLIB Concatenation. Determine proper IEFSSnxx member.
If RACF is defined in the SubSystem member, this is not a finding. |
| | IBM z/OS BUFUSEWARN in the SMFPRMxx must be properly set. | It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected.
Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded.
This requirement applies to each audit data storage repository (i.e., distinct information system component where audit records are stored), the centralized audit storage capacity of organizations (i.e., all audit data storage repositories combined), or both.
Satisfies: SRG-OS-000343-GPOS-00134, SRG-OS-000344-GPOS-00135, SRG-OS-000046-GPOS-00022 | | Refer to IEASYS00 member in SYS1.PARMLIB Concatenation. Determine proper SMFPRMxx member in SYS1.PARMLIB.
If BUFUSEWARN is set for "75" (75%) or less, this is not a finding. |
| | IBM z/OS NOBUFFS in SMFPRMxx must be properly set (default is MSG). | It is critical that when the operating system is at risk of failing to process audit logs as required, it takes action to mitigate the failure. Audit processing failures include: software/hardware errors; failures in the audit capturing mechanisms; and audit storage capacity being reached or exceeded. Responses to audit failure depend upon the nature of the failure mode.
When availability is an overriding concern, other approved actions in response to an audit failure are as follows:
If the failure was caused by the lack of audit record storage capacity, the operating system must continue generating audit records if possible (automatically restarting the audit service if necessary), overwriting the oldest audit records in a first-in-first-out manner.
If audit records are sent to a centralized collection server and communication with this server is lost or the server fails, the operating system must queue audit records locally until communication is restored or until the audit records are retrieved manually. Upon restoration of the connection to the centralized collection server, action should be taken to synchronize the local audit data with the collection server. | | Refer to IEASYS00 member in SYS1.PARMLIB Concatenation. Determine proper SMFPRMxx member in SYS1.PARMLIB.
If NOBUFFS is set to "HALT", this is not a finding.
Note: If availability is an overriding concern NOBUFFS can be set to MSG. |
| | The IBM z/OS SNTP daemon (SNTPD) must be active. | Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Sources outside the configured acceptable allowance (drift) may be inaccurate.
Synchronizing internal information system clocks provides uniformity of time stamps for information systems with multiple system clocks and systems connected over a network.
Organizations should consider endpoints that may not have regular access to the authoritative time server (e.g., mobile, teleworking, and tactical endpoints). | | From UNIX System Services ISPF Shell navigate to ribbon select tools.
Select option 1 - Work with Processes.
If SNTP Daemon (SNTPD) is not active, this is a finding. |
| | IBM z/OS SNTP daemon (SNTPD) permission bits must be properly configured. | Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time, a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Sources outside the configured acceptable allowance (drift) may be inaccurate.
Synchronizing internal information system clocks provides uniformity of time stamps for information systems with multiple system clocks and systems connected over a network.
Organizations should consider endpoints that may not have regular access to the authoritative time server (e.g., mobile, teleworking, and tactical endpoints). | | From the ISPF Command Shell enter:
cd /usr/sbin
ls -al
If the following File permission and user Audit Bits are true, this is not a finding.
/usr/sbin/sntpd 1740 faf
The following represents a hierarchy for permission bits from least restrictive to most restrictive:
7 rwx (least restrictive)
6 rw-
3 -wx
2 -w-
5 r-x
4 r--
1 --x
0 --- (most restrictive)
The possible audit bits settings are as follows:
f log for failed access attempts
a log for failed and successful access
- no auditing |
| | IBM z/OS PARMLIB CLOCKxx must have the Accuracy PARM properly coded. | Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events.
Synchronizing internal information system clocks provides uniformity of time stamps for information systems with multiple system clocks and systems connected over a network. Organizations should consider setting time periods for different types of systems (e.g., financial, legal, or mission-critical systems).
Organizations should also consider endpoints that may not have regular access to the authoritative time server (e.g., mobile, teleworking, and tactical endpoints). This requirement is related to the comparison done every 24 hours in SRG-OS-000355 because a comparison must be done in order to determine the time difference. | | Refer to the CLOCKxx member of PARMLIB.
If the ACCURACY parm is not coded, this is a finding.
If the ACCURACY parm is coded to "1000", this is not a finding. |
| | IBM RACF must define UACC of NONE on all profiles. | The operating system must employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs. | | Review all Dataset and resource profiles in the RACF database.
If any are not defined with UACC NONE, this is a finding. |
| | IBM zOS inapplicable PPT entries must be invalidated. | It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors.
Operating systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).
Examples of non-essential capabilities include, but are not limited to, games, software packages, tools, and demonstration software, not related to requirements or providing a wide array of functionality not required for every mission, but which cannot be disabled.
Invalid or inapplicable PPT entries exist, a venue is provided for the introduction of trojan horse modules with security bypass capabilities. | | Review program entries in the IBM Program Properties Table (PPT). You may use a third-party product to examine these entries however, to determine program entries issue the following command from an ISPF command line enter:
TSO ISRDDN LOAD IEFSDPPT
Interpret the display as follows:
Examine contents at offset 8
Hex ‘x2’ - Bypass Password Protection
Hex ‘x3’ - Bypass Password Protection
Hex ‘x4’ - No Dataset Integrity
Hex ‘x5’ - No Dataset Integrity
Hex ‘x6’ - Both
Hex ‘x7’ - Both
Determine Privilege Key at offset 9. A value of hex ’70’ or less indicates an elevated privilege.
For each module identified in the "eyecatcher" that has BYPASS Password Protection, No Dataset Integrity, an elevated Privilege Key or any combination thereof, determine if there is a valid loaded module. Again, you may use a third-party product otherwise execute the following steps from an ISPF command line enter:
TSO ISRDDN LOAD <privileged module>
If the return message is "Load Failed" make sure there is an entry in PARMLIB member SCHEDxx that revokes the excessive privilege.
If this is not true, this is a finding. |
| | IBM z/OS, for PKI-based authentication, must use the ESM for key management. | Without mapping the certificate used to authenticate to the user account, the ability to determine the identity of the individual user or group will not be available for forensic analysis. | | From the ISPF Command Shell enter:
OMVS
enter
find / -name *.kdb
If any files are found, this is a finding |
| | IBM z/OS DFSMS Program Resources must be properly defined and protected. | To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.
Access control policies include: identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include: access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system. | | Refer to the load modules residing in the following Load libraries to determine program resource definitions:
SYS1.DGTLLIB for DFSMSdfp/ISMF
SYS1.DGTLLIB for DFSMSdss/ISMF
SYS1.DFQLLIB for DFSMShsm
If the installation moves these modules to another load library the installation-defined load library must be used in the program protection.
If the RACF resources are defined with a default access of NONE, this is not a finding.
If the RACF resource access authorizations restrict access to the appropriate personnel, this is not a finding.
(Refer to the chapter titled “Protecting the Storage Management Subsystem†in the IBM z/OS DFSMSdfp Storage Administration Guide to assist with guidance on appropriate access.) |
| | IBM z/OS must be configured to restrict all TCP/IP ports to ports, protocols, and/or services as defined in the PPSM CAL and vulnerability assessments. | Remote access services, such as those providing remote access to network devices and information systems, which lack automated control capabilities, increase risk and make remote user access management difficult at best.
Remote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.
Operating system functionality (e.g., RDP) must be capable of taking enforcement action if the audit reveals unauthorized activity. Automated control of remote access sessions allows organizations to ensure ongoing compliance with remote access policies by enforcing connection rules of remote access applications on a variety of information system components (e.g., servers, workstations, notebook computers, smartphones, and tablets). | | Refer the TCP/IP PROFILE DD statement to determine the TCP/IP Ports. If the PROFILE DD statement is not supplied, use the default search order to find the PROFILE data set.
See the IP Configuration Guide for a description of the search order for PROFILE.TCPIP.
If the all the Ports included in the configuration are restricted to the ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL) and vulnerability assessments, this is not a finding. |
| | IBM z/OS TCP/IP resources must be properly protected. | To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.
Access control policies include: identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include: access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system. | | From the ISPF Command Shell enter:
RLIST SERVAUTH * ALL
If the following guidance is true, this is not a finding.
The EZA, EZB, and IST resources and/or generic equivalent are defined to the SERVAUTH resource class with a UACC(NONE).
No access is given to the EZA, EZB, and IST high level resources of the SERVAUTH resource class.
If the product CSSMTP is on the system, no access is given to EZB.CSSMTP of the SERVAUTH resource class.
If the product CSSMTP is on the system, EZB.CSSMTP.sysname.writername.JESnode will be specified and made available to the CSSMTP started task and authenticated users that require access to use CSSMTP for e-mail services.
Authenticated users that require access will be permitted access to the second level of the resources in the SERVAUTH resource class. Examples are the network (NETACCESS), port (PORTACCESS), stack (STACKACCESS), and FTP resources in the SERVAUTH resource class.
The EZB.STACKACCESS. resource access authorizations restrict access to those started tasks with valid requirements and users with valid FTP access requirements.
The EZB.FTP.*.*.ACCESS.HFS) resource access authorizations restrict access to FTP users with specific written documentation showing a valid requirement exists to access OMVS files and Directories. |
| | The IBM z/OS TCPIP.DATA configuration statement must contain the DOMAINORIGIN or DOMAIN specified for each TCP/IP defined. | If data origin authentication and data integrity verification are not performed, the resultant response could be forged, it may have come from a poisoned cache, the packets could have been intercepted without the resolver's knowledge, or resource records could have been removed which would result in query failure or denial of service. Data origin authentication verification must be performed to thwart these types of attacks.
Each client of name resolution services either performs this validation on its own or has authenticated channels to trusted validation providers. Information systems that provide name and address resolution services for local clients include, for example, recursive resolving or caching Domain Name System (DNS) servers. DNS client resolvers either perform validation of DNSSEC signatures, or clients use authenticated channels to recursive resolvers that perform such validations.
This is not applicable if DNSSEC is not implemented on the local network. | | Refer to the Data configuration file specified on the SYSTCPD DD statement in the TCPIP started task JCL.
If the DOMAINORIGIN/DOMAIN (The DOMAIN statement is functionally equivalent to the DOMAINORIGIN Statement) is specified in the TCP/IP Data configuration file, this is not a finding. |
| | The IBM z/OS PROFILE.TCPIP configuration for the TN3270 Telnet server must have the INACTIVE statement properly specified. | Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition, quickly terminating an idle session will also free up resources committed by the managed network element. | | Refer to the Profile configuration file specified on the PROFILE DD statement in the TN3270 started task JCL.
Note: If the INCLUDE statement is coded in the TCP/IP Profile configuration file, the data set specified on this statement must be checked for the following items as well.
TELNETGLOBAL Block (only one defined)
TELNETPARMS Block (one defined for each port the server is listening to, typically ports 23 and 992)
If the TELNETPARMS INACTIVE statement is coded either in the TELNETGLOBALS or within each TELNETPARMS statement block and specifies a value between "1" and "900", this is not a finding. |
| | IBM z/OS UNIX Telnet server Startup parameters must be properly specified. | The z/OS UNIX Telnet Server (i.e., otelnetd) provides interactive access to the z/OS UNIX shell. During the initialization process, startup parameters are read to define the characteristics of each otelnetd instance. Some of these parameters have an impact on system security. Failure to specify the appropriate command options could result in degraded security. This exposure may result in unauthorized access impacting data integrity or the availability of some system services. | | From the ISPF Command Shell enter:
ISHELL
Enter /etc/ for a pathname - you may need to issue a CD /etc/
select FILE NAME inetd.conf
If Option -D login is included on the otelnetd command, this is not a finding.
If Option -c 900 is included on the otelnetd command, this is not a finding.
NOTE: "900" indicates a session timeout value of "15" minutes and is currently the maximum value allowed. |
| | The IBM z/OS UNIX Telnet server warning banner must be properly specified. | Display of a standardized and approved use notification before granting access to the publicly accessible operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. | | From the ISPF Command Shell enter:
ISHELL
Enter /etc/ for a pathname - you may need to issue a CD /etc/
select FILE NAME inetd.conf
If Option -h is included on the otelnetd command, this is a finding. |
| | IBM RACF exit ICHPWX11 must be installed and properly configured. | Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.
Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. | | From a system console screen issue the following modify command:
F AXR,IRRPHREX LIST
Review the results of the modify command.
If the following options are listed, this is not a finding.
-The number of required character types is 4
(assures that at least 1 upper case, 1 lower case, 1 number, and 1 special character is used in Password phrase)
-The user's name cannot be contained in the password phrase
(Only 3 consecutive characters of the user's name are allowed)
-The minimum word length checked is 15
-The user ID cannot be contained in the password phrase
(Only 3 consecutive characters of the user ID are allowed)
-At least half of unchanged positions of the current password phrase are allowed
(These positions need to be consecutive to cause a failure and this check is not case sensitive)
-A minimum list of 8 restricted prefix strings is being checked:
'IBM' ,'RACF','PASSWORD','PHRASE','PASSPHRAS’,'SECRET','IBMUSER','SYS1'
If the modify command fails or returns the following message in the system log, this is a finding.
IRX0406E REXX exec load file REXXLIB does not contain exec member IRRPHREX. |
