There are key ACF2/CICS parameters that are not properly coded.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-7554	ZCICA023	SV-8031r2_rule	DCCS-1 DCCS-2 ECCD-1 ECCD-2	Medium

Description
The ACF2/CICS parameters define the security controls in effect for CICS regions. Failure to code the appropriate values could result in degraded security. This exposure may result in unauthorized access impacting the confidentiality, integrity, and availability of the CICS region, applications, and customer data.

STIG	Date
z/OS ACF2 STIG	2015-06-24

Details

Check Text ( C-20563r1_chk )
a) Refer to the following report produced by the z/OS Data Collection: - EXAM.RPT(CICSPROC) Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010. Refer to the CICS region SYSLOG – (Alternate source of SIT parameters) b) Browse the ACF2/CICS data set allocated by the ACF2PARM DD statement in the JCL of each CICS procedure. c) If all key ACF2/CICS parameters for every CICS region are coded as stated in the table entitled ACF2/CICS Parameters in the z/OS STIG Addendum, there is NO FINDING. NOTE: The DEFAULT TERMINAL=CICSUSER must be specified. CICSKEY OPTION=VALIDATE,TYPE=resource type,RESOURCE=TRANS will specify a unique resource type for each CICS region. d) If any key ACF2/CICS parameter is not coded as referenced in (c), this is a FINDING.

Check Text ( C-20563r1_chk )

a) Refer to the following report produced by the z/OS Data Collection:

- EXAM.RPT(CICSPROC)

Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010.

Refer to the CICS region SYSLOG – (Alternate source of SIT parameters)

b) Browse the ACF2/CICS data set allocated by the ACF2PARM DD statement in the JCL of each CICS procedure.

c) If all key ACF2/CICS parameters for every CICS region are coded as stated in the table entitled ACF2/CICS Parameters in the z/OS STIG Addendum, there is NO FINDING.

NOTE: The DEFAULT TERMINAL=CICSUSER must be specified.
CICSKEY OPTION=VALIDATE,TYPE=resource type,RESOURCE=TRANS will specify a unique resource type for each CICS region.

d) If any key ACF2/CICS parameter is not coded as referenced in (c), this is a FINDING.

Fix Text (F-18522r1_fix)
The Systems Programmer and IAO will ensure the ACF2/CICS parameters are coded with values specified in the table entitled ACF2/CICS Parameters, in the zOS STIG Addendum. Browse the ACF2/CICS data set allocated by the ACF2PARM DD statement in the JCL of each CICS procedure. Ensure that all key ACF2/CICS parameters for every CICS region are coded as stated in the table entitled ACF2/CICS Parameters, in the zOS STIG Addendum.

Fix Text (F-18522r1_fix)

The Systems Programmer and IAO will ensure the ACF2/CICS parameters are coded with values specified in the table entitled ACF2/CICS Parameters, in the zOS STIG Addendum.

Browse the ACF2/CICS data set allocated by the ACF2PARM DD statement in the JCL of each CICS procedure.

Ensure that all key ACF2/CICS parameters for every CICS region are coded as stated in the table entitled ACF2/CICS Parameters, in the zOS STIG Addendum.