Access to zSecure installation data must be properly restricted and logged.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-259728	ZSEC-00-000040	SV-259728r943218_rule		Medium

Description
If the zSecure application were to allow any user to make changes to software libraries, those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to applications with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs that execute with escalated privileges. Only qualified and authorized individuals must be allowed to obtain access to information system components to initiate changes, including upgrades and modifications.

Description

If the zSecure application were to allow any user to make changes to software libraries, those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement applies to applications with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs that execute with escalated privileges. Only qualified and authorized individuals must be allowed to obtain access to information system components to initiate changes, including upgrades and modifications.

STIG	Date
IBM zSecure Suite Security Technical Implementation Guide	2024-01-18

Details

Check Text ( C-63467r943216_chk )
Verify the accesses to zSecure installation data sets are properly restricted. - The RACF profile(s) protecting zSecure installation data sets must not allow general access by means of UACC, ID(*), WARNING, or global access. - The RACF profile(s) protecting zSecure installation data sets must restrict READ access to auditors, security administrators , decentralized security administrators, batch jobs that perform External Security Manager (ESM) maintenance, and trusted STC users. - The RACF profile(s) protecting zSecure installation data sets must restrict UPDATE and higher access to systems programmers. - All failures and successful UPDATE and higher access must be logged. If all of the above restrictions are true, this is not a finding.

Check Text ( C-63467r943216_chk )

Verify the accesses to zSecure installation data sets are properly restricted.

- The RACF profile(s) protecting zSecure installation data sets must not allow general access by means of UACC, ID(*), WARNING, or global access.
- The RACF profile(s) protecting zSecure installation data sets must restrict READ access to auditors, security administrators , decentralized security administrators, batch jobs that perform External Security Manager (ESM) maintenance, and trusted STC users.
- The RACF profile(s) protecting zSecure installation data sets must restrict UPDATE and higher access to systems programmers.
- All failures and successful UPDATE and higher access must be logged.

If all of the above restrictions are true, this is not a finding.

Fix Text (F-63374r943217_fix)
Ensure ALTER access to zSecure installation data sets is restricted to systems programmers, and all failures and successful UPDATE and higher access is logged. READ access can be permitted to auditors, security administrators (domain level and decentralized), batch jobs that perform ESM maintenance, and trusted STC users. The installing systems programmer will identify and document the product data sets and categorize them according to who will require UPDATE and higher access and if required that all successful UPDATE and higher access is logged. The installing systems programmer will identify if any additional groups need READ access for specific zSecure installation data sets, and once documented will work with the information system security officer (ISSO) to ensure they are properly restricted to the ESM active on the system. The following commands are provided as a sample for implementing zSecure installation data set controls: ad 'hlq.zsec.inst.dsn' uacc(none) owner(zSecure owner) - audit(success(update) failures(read)) pe 'hlq.zsec.inst.dsn' id(AUDTAUDT, SECAAUDT, SECBAUDT, SECDAUDT, TSTCAUDT) access(READ) pe 'hlq.zsec.inst.dsn' id(SYSPAUDT) access(ALTER)

Fix Text (F-63374r943217_fix)

Ensure ALTER access to zSecure installation data sets is restricted to systems programmers, and all failures and successful UPDATE and higher access is logged.

READ access can be permitted to auditors, security administrators (domain level and decentralized), batch jobs that perform ESM maintenance, and trusted STC users.

The installing systems programmer will identify and document the product data sets and categorize them according to who will require UPDATE and higher access and if required that all successful UPDATE and higher access is logged. The installing systems programmer will identify if any additional groups need READ access for specific zSecure installation data sets, and once documented will work with the information system security officer (ISSO) to ensure they are properly restricted to the ESM active on the system.

The following commands are provided as a sample for implementing zSecure installation data set controls:

ad 'hlq.zsec.inst.dsn' uacc(none) owner(zSecure owner) -
audit(success(update) failures(read))
pe 'hlq.zsec.inst.dsn' id(AUDTAUDT, SECAAUDT, SECBAUDT, SECDAUDT, TSTCAUDT) access(READ)
pe 'hlq.zsec.inst.dsn' id(SYSPAUDT) access(ALTER)