Site does not maintain documented procedures to apply security related software patches to their system and does not maintain a log of when these patches were applied.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-15209	AAMV0018	SV-15984r2_rule	DCAR-1 DCCS-1 DCCS-2	High

Description
Vendors' code may contain vulnerabilities that may be exploited to cause denial of service or to violate the integrity of the system or data on the System. Most vendors develop patches to correct these vulnerabilities. These patches must be applied and documented.

STIG	Date
z/OS ACF2 STIG	2017-03-22

Details

Check Text ( C-20499r1_chk )
a) Refer to Vulnerability Questions within the SRRAUDIT Dialog Management document. Check with the Information Assurance Officer to make sure that documented procedures exist for security related software patches to be scheduled, applied and documented. Automated Analysis Refer to the following report produced by the z/OS Data Collection: - PDI(AAMV0018) b) If documented procedures exist to monitor, apply and document software patches, there is NO FINDING. c) If documented procedures do not exist to monitor, apply and document software patches, this is a FINDING.

Check Text ( C-20499r1_chk )

a) Refer to Vulnerability Questions within the SRRAUDIT Dialog Management document.

Check with the Information Assurance Officer to make sure that documented procedures exist for security related software patches to be scheduled, applied and documented.

Automated Analysis
Refer to the following report produced by the z/OS Data Collection:

- PDI(AAMV0018)

b) If documented procedures exist to monitor, apply and document software patches, there is NO FINDING.

c) If documented procedures do not exist to monitor, apply and document software patches, this is a FINDING.

Fix Text (F-16967r1_fix)
The IAO will ensure that all security related software patches are scheduled to be applied and documented. System Programmers and IAOs should regularly check OS vendor web sites for information on new security patches that are applicable to their site. All applicable security patches will be scheduled to be applied to the system. A security patch is deemed applicable if the product is installed, even if it is not used or is disabled. FSO does not test or approve patches or service packs. It is the site’s responsibility to test vendor patches within their test environment.

Fix Text (F-16967r1_fix)

The IAO will ensure that all security related software patches are scheduled to be applied and documented.

System Programmers and IAOs should regularly check OS vendor web sites for information on new security patches that are applicable to their site. All applicable security patches will be scheduled to be applied to the system. A security patch is deemed applicable if the product is installed, even if it is not used or is disabled.

FSO does not test or approve patches or service packs. It is the site’s responsibility to test vendor patches within their test environment.