UCF STIG Viewer Logo

IBM Integrated Crypto Service Facility (ICSF) Started task(s) must be properly defined to the STARTED resource class for RACF.


Overview

Finding ID Version Rule ID IA Controls Severity
V-255938 RACF-IC-000050 SV-255938r881306_rule Medium
Description
Access to product resources should be restricted to only those individuals responsible for the application connectivity and who have a requirement to access these resources. Improper control of product resources could potentially compromise the operating system, ACP, and customer data.
STIG Date
IBM z/OS RACF Security Technical Implementation Guide 2022-12-14

Details

Check Text ( C-59615r881304_chk )
Execute the RACF DSMON report for RACSPT

if the IBM Integrated Crypto Service Facility (ICSF) started task(s) is (are) not defined to the STARTED resource class profile and/or ICHRIN03 table entry this is a finding
Fix Text (F-59558r881305_fix)
Ensure that a product's started task(s) is (are) properly identified and/or defined to the System ACP.

A unique userid must be assigned for the IBM Integrated Crypto Service Facility (ICSF) started task(s) thru a corresponding STARTED class entry.

The following sample set of commands is shown here as a guideline:

rdef started CSFSTART.** uacc(none) owner(admin) audit(all(read)) stdata(user(CSFSTART) group(stc))

setr racl(started) ref