The Mainframe Product must provide the capability for authorized users to capture, record, and log all content related to a user session.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-68237	SRG-APP-000093-MFP-000138	SV-82727r1_rule		Medium

Description
Without the capability to capture, record, and log all content related to a user session, investigations into suspicious user activity would be hampered. This requirement does not apply to Mainframe Products that do not have a concept of a user session (e.g., calculator).

STIG	Date
Mainframe Product Security Requirements Guide	2019-10-08

Details

Check Text ( C-68797r1_chk )
If the Mainframe Product has no function or capability for session operations, this is not applicable. Examine installation and configuration settings. If the Mainframe Product does not have the capability to capture, record, and audit user sessions, this is a finding. If the Mainframe Product does not restrict the ability to capture, record, and audit user sessions to system programmers or security administrators, this is a finding. If an external security manager (ESM) is in use, examine the configuration and rules to determine if the ability to capture, record, and audit user sessions is restricted to system programmers or security administrators. If it is not, this is a finding.

Check Text ( C-68797r1_chk )

If the Mainframe Product has no function or capability for session operations, this is not applicable.

Examine installation and configuration settings.

If the Mainframe Product does not have the capability to capture, record, and audit user sessions, this is a finding.

If the Mainframe Product does not restrict the ability to capture, record, and audit user sessions to system programmers or security administrators, this is a finding.

If an external security manager (ESM) is in use, examine the configuration and rules to determine if the ability to capture, record, and audit user sessions is restricted to system programmers or security administrators.

If it is not, this is a finding.

Fix Text (F-74351r1_fix)
Configure the Mainframe Product to permit authorized users to capture, record, and log all content related to a user session. If an ESM is in use, configure the rules to restrict the ability to capture, record, and audit user sessions to system programmers and security administrators.