UCF STIG Viewer Logo

IBM z/OS Policy Agent must employ a deny-all, allow-by-exception firewall policy for allowing connections to other systems.


Overview

Finding ID Version Rule ID IA Controls Severity
V-223560 ACF2-OS-000240 SV-223560r853547_rule Medium
Description
Failure to restrict network connectivity only to authorized systems permits inbound connections from malicious systems. It also permits outbound connections that may facilitate exfiltration of DoD data.
STIG Date
IBM z/OS ACF2 Security Technical Implementation Guide 2022-12-14

Details

Check Text ( C-25233r504707_chk )
Examine the Policy Agent policy statements.

If it can be determined that the policy agent employs a deny-all, allow-by exception firewall policy for allowing connections to other systems, this is not a finding.
Fix Text (F-25221r504708_fix)
Develop a policy application and policy agent to employ a deny-all, allow-by-exception firewall policy for allowing connections to other systems.