IBM RACF DASD volume-level protection must be properly defined.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-98031	RACF-ES-000150	SV-107135r1_rule		Medium

Description
To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.

Description

To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.

STIG	Date
IBM z/OS RACF Security Technical Implementation Guide	2020-06-29

Details

Check Text ( C-96867r2_chk )
From the ISPF Command Shell enter: RLIST DASDVOL AUTHUSER If a profile of "**" is defined for the "DASDVOL" resource class, this is not finding. If access authorization to "DASDVOL" profiles is restricted to Storage Management Personnel, Storage Management Batch Userids, and Systems Programmers, this is not a finding. If all (i.e., failures and successes) access is logged, this is not a finding.

Check Text ( C-96867r2_chk )

From the ISPF Command Shell enter:
RLIST DASDVOL AUTHUSER

If a profile of "**" is defined for the "DASDVOL" resource class, this is not finding.

If access authorization to "DASDVOL" profiles is restricted to Storage Management Personnel, Storage Management Batch Userids, and Systems Programmers, this is not a finding.

If all (i.e., failures and successes) access is logged, this is not a finding.

Fix Text (F-103707r1_fix)
Develop a plan of action to implement the required changed. Define profiles in the "DASDVOL" class. A sample command is provided here: RDEF DASDVOL ** UACC(NONE) OWNER() AUDIT(ALL(READ)). More specific "DASDVOL" profiles should be defined to protect groups of "DASDVOLs". A sample command to create a profile protecting all DASDVOLs beginning with "SYS" is provided here: RDEF DASDVOL SYS* UACC(NONE) OWNER() AUDIT(ALL(READ)). Permission can be granted to "DASDVOL" profiles. A sample command is provided here: PE SYS* CLASS(DASDVOL) ID() ACCESS(ALTER) If any profiles are in "WARN" mode, they should be reset. A sample command is provided here: RALT DASDVOL NOWARN. Note that the "GDASDVOL" class can also be used. See the RACF Security Admin Guide for more information.

Fix Text (F-103707r1_fix)

Develop a plan of action to implement the required changed.

Define profiles in the "DASDVOL" class. A sample command is provided here:
RDEF DASDVOL ** UACC(NONE) OWNER() AUDIT(ALL(READ)).

More specific "DASDVOL" profiles should be defined to protect groups of "DASDVOLs". A sample command to create a profile protecting all DASDVOLs beginning with "SYS" is provided here:
RDEF DASDVOL SYS* UACC(NONE) OWNER() AUDIT(ALL(READ)).

Permission can be granted to "DASDVOL" profiles. A sample command is provided here:
PE SYS* CLASS(DASDVOL) ID() ACCESS(ALTER)

If any profiles are in "WARN" mode, they should be reset. A sample command is provided here:
RALT DASDVOL NOWARN.

Note that the "GDASDVOL" class can also be used. See the RACF Security Admin Guide for more information.