IBM z/OS must have the RULEVLD and RSRCVLD attributes specified for LOGONIDs with the SECURITY attribute.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-223471	ACF2-ES-000530	SV-223471r533198_rule		Medium

Description
The use of security policy filters provides protection for the confidentiality of data by restricting the flow of data. A crucial part of any flow control solution is the ability to configure policy filters. This allows the operating system to enforce multiple and different security policies. Policy filters serve to enact and enforce the organizational policy as it pertains to controlling data flow.

Description

The use of security policy filters provides protection for the confidentiality of data by restricting the flow of data. A crucial part of any flow control solution is the ability to configure policy filters. This allows the operating system to enforce multiple and different security policies. Policy filters serve to enact and enforce the organizational policy as it pertains to controlling data flow.

STIG	Date
IBM z/OS ACF2 Security Technical Implementation Guide	2021-03-29

Details

Check Text ( C-25144r504531_chk )
From the ACF Command screen enter: SET LID LIST IF(SECURITY) If all logonids with the SECURITY attribute also have the RULEVLD and RSRCVLD attributes specified, this not a finding. If any logonid with the SECURITY attribute does not have the RULEVLD and/or RSRCVLD attributes specified, this is a finding.

Fix Text (F-25132r504532_fix)
Configure Logonids with the SECURITY attribute to have the RULEVLD and RSRCVLD attributes specified. If a logonid is granted the SECURITY privilege, it is mandatory that RULEVLD and RSRCVLD attributes will also be specified for the logonid. Example: SET LID CHANGE logonid RULEVLD RSRCVLD