IBM z/OS LOGONID with the ACCTPRIV attribute must be restricted to the ISSO.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-223473	ACF2-ES-000550	SV-223473r991589_rule		Medium

Description
The use of security policy filters provides protection for the confidentiality of data by restricting the flow of data. A crucial part of any flow control solution is the ability to configure policy filters. This allows the operating system to enforce multiple and different security policies. Policy filters serve to enact and enforce the organizational policy as it pertains to controlling data flow.

Description

The use of security policy filters provides protection for the confidentiality of data by restricting the flow of data. A crucial part of any flow control solution is the ability to configure policy filters. This allows the operating system to enforce multiple and different security policies. Policy filters serve to enact and enforce the organizational policy as it pertains to controlling data flow.

STIG	Date
IBM z/OS ACF2 Security Technical Implementation Guide	2024-06-24

Details

Check Text ( C-25146r500551_chk )
From the ACF Command screen enter: SET LID LIST IF(ACCTPRIV) If logonids with the ACCTPRIV attribute specified are not assigned to the security administrator, this is a finding.

Fix Text (F-25134r500552_fix)
Configure logonids with the ACCTPRIV attribute to be only reserved for use by the Security manager. The ACCTPRIV attribute cannot be scoped, and will be restricted exclusively to a site security administrator: Example: SET LID CHANGE logonid ACCTPRIV