ACF2 TSOTWX GSO record values must be set to obliterate the logon password on TWX devices.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-223509	ACF2-ES-000920	SV-223509r958470_rule		Medium

Description
To prevent the compromise of authentication information, such as passwords during the authentication process, the feedback from the operating system must not provide any information allowing an unauthorized user to compromise the authentication mechanism. Obfuscation of user-provided information that is typed into the system is a method used when addressing this risk. Displaying asterisks when a user types in a password is an example of obscuring feedback of authentication information.

Description

To prevent the compromise of authentication information, such as passwords during the authentication process, the feedback from the operating system must not provide any information allowing an unauthorized user to compromise the authentication mechanism. Obfuscation of user-provided information that is typed into the system is a method used when addressing this risk. Displaying asterisks when a user types in a password is an example of obscuring feedback of authentication information.

STIG	Date
IBM z/OS ACF2 Security Technical Implementation Guide	2024-06-24

Details

Check Text ( C-25182r695442_chk )
From the ISPF Command Shell enter: ACF SET CONTROL(GSO) LIST TSOTWX If the GSO TSOTWX record values conform to the following requirements, this is not a finding. CR(15) IDLE(17) LENGTH(8) M1(X) M2(N) M3(Z) M4(M) STRING()

Fix Text (F-25170r500661_fix)
Define a cross out mask to obliterate the logon password on TWX devices. CR(15) IDLE(17) LENGTH(8) M1(X) M2(N) M3(Z) M4(M) STRING() Example: SET C(GSO) INSERT TSOTWX CR(15) IDLE(17) LENGTH(8) M1(X) M2(N) M3(Z) M4(M) STRING() F ACF2,REFRESH(TSOTWX)