The ACP security data sets and/or databases must be properly protected.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-118	ACP00120	SV-118r6_rule	DCCS-1 DCCS-2 ECAR-1 ECAR-2 ECAR-3 ECCD-1 ECCD-2	High

Description
The Access Control Program (ACP) database files contain all access control information for the operating system environment and system resources. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data.

STIG	Date
z/OS ACF2 STIG	2016-01-04

Details

Check Text ( C-827r4_chk )
Refer to the following report produced by the Data Set and Resource Data Collection: - SENSITVE.RPT(ACPRPT) Automated Analysis Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(ACP00120) Verify that the accesses to the ACP security data sets and/or databases are properly restricted. If the following guidance is true, this is not a finding. ___ The ACP data set rules for ACP security data sets and/or databases restrict READ access to auditors and DASD batch. ___ The ACP data set rules for ACP security data sets and/or databases restrict READ and/or greater access to z/OS systems programming personnel, security personnel, and/or batch jobs that perform ACP maintenance. ___ All (i.e., failures and successes) data set access authorities (i.e. READ, UPDATE, ALTER, and CONTROL) for ACP security data sets and/or databases are logged.

Check Text ( C-827r4_chk )

Refer to the following report produced by the Data Set and Resource Data Collection:

- SENSITVE.RPT(ACPRPT)

Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:

- PDI(ACP00120)

Verify that the accesses to the ACP security data sets and/or databases are properly restricted. If the following guidance is true, this is not a finding.

___ The ACP data set rules for ACP security data sets and/or databases restrict READ access to auditors and DASD batch.

___ The ACP data set rules for ACP security data sets and/or databases restrict READ and/or greater access to z/OS systems programming personnel, security personnel, and/or batch jobs that perform ACP maintenance.

___ All (i.e., failures and successes) data set access authorities (i.e. READ, UPDATE, ALTER, and CONTROL) for ACP security data sets and/or databases are logged.

Fix Text (F-18706r5_fix)
Review access authorization to critical security database files. Evaluate the impact of correcting the deficiency. Develop a plan of action and implement the changes required to protect the ACP Files. Ensure that READ and/or greater access to all ACP files and/or databases are limited to system programmers and/or security personnel, and/or batch jobs that perform ACP maintenance. READ access can be given to auditors and DASD batch. All accesses to ACP files and/or databases are logged.

Fix Text (F-18706r5_fix)

Review access authorization to critical security database files. Evaluate the impact of correcting the deficiency. Develop a plan of action and implement the changes required to protect the ACP Files.

Ensure that READ and/or greater access to all ACP files and/or databases are limited to system programmers and/or security personnel, and/or batch jobs that perform ACP maintenance. READ access can be given to auditors and DASD batch. All accesses to ACP files and/or databases are logged.