JES2 output devices must be properly controlled for Classified Systems.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-6922	ZJES0032	SV-7223r3_rule		Medium

Description
JES2 output devices provide a variety of channels to which output can be processed. Failure to properly control these output devices could result in unauthorized personnel accessing output. This exposure may compromise the confidentiality of customer data on a classified System..

STIG	Date
z/OS ACF2 STIG	2017-03-22

Details

Check Text ( C-3321r2_chk )
Refer to the following report produced by the Data Set and Resource Data Collection: - Classification of System - SENSITVE.RPT(WRITER) If the Classification of the system is unclassified, this is not applicable. Verify that the accesses for WRITER resources are restricted. If the following guidance is true, this is not a finding. ___ The ACF2 resources and/or generic equivalent are defined with a default access of PREVENT. ___ The ACF2 resources and/or generic equivalent identified below will be defined with access restricted to the operators and system programming personnel: JES2.LOCAL.devicename JES2.LOCAL.OFFn.* JES2.LOCAL.OFFn.JT JES2.LOCAL.OFFn.ST JES2.LOCAL.PRTn JES2.LOCAL.PUNn JES2.NJE.nodename JES2.RJE.devicename NOTE: Common sense should prevail during the analysis. For example, access to the offload output destinations should be limited to only systems personnel (e.g., operations staff/system programmers) on a classified system.

Check Text ( C-3321r2_chk )

Refer to the following report produced by the Data Set and Resource Data Collection:

- Classification of System
- SENSITVE.RPT(WRITER)

If the Classification of the system is unclassified, this is not applicable.

Verify that the accesses for WRITER resources are restricted. If the following guidance is true, this is not a finding.

___ The ACF2 resources and/or generic equivalent are defined with a default access of PREVENT.

___ The ACF2 resources and/or generic equivalent identified below will be defined with access restricted to the operators and system programming personnel:

JES2.LOCAL.devicename
JES2.LOCAL.OFFn.*
JES2.LOCAL.OFFn.JT
JES2.LOCAL.OFFn.ST
JES2.LOCAL.PRTn
JES2.LOCAL.PUNn
JES2.NJE.nodename
JES2.RJE.devicename

NOTE: Common sense should prevail during the analysis. For example, access to the offload output destinations should be limited to only systems personnel (e.g., operations staff/system programmers) on a classified system.

Fix Text (F-18934r2_fix)
Verify with the ISSO to see that access authorization for resources defined to the WRITER resource class is restricted to the operators and system programmers on a classified system only. Define resources in the ACP’s respective WRITER class for each of the following output destinations: JES2.LOCAL.devicename JES2.LOCAL.OFFn.* JES2.LOCAL.OFFn.JT JES2.LOCAL.OFFn.ST JES2.LOCAL.PRTn JES2.LOCAL.PUNn JES2.NJE.nodename JES2.RJE.devicename The resource definition will be generic if all of the resources of the same type have identical access controls (e.g., if all off load transmitters are equivalent). If all users are permitted to route output to a specific destination, the resource controlling it may be defined with a default access of either NONE or READ. Otherwise it will be defined with a default access of NONE.

Fix Text (F-18934r2_fix)

Verify with the ISSO to see that access authorization for resources defined to the WRITER resource class is restricted to the operators and system programmers on a classified system only.

Define resources in the ACP’s respective WRITER class for each of the following output destinations:

JES2.LOCAL.devicename
JES2.LOCAL.OFFn.*
JES2.LOCAL.OFFn.JT
JES2.LOCAL.OFFn.ST
JES2.LOCAL.PRTn
JES2.LOCAL.PUNn
JES2.NJE.nodename
JES2.RJE.devicename

The resource definition will be generic if all of the resources of the same type have identical access controls (e.g., if all off load transmitters are equivalent). If all users are permitted to route output to a specific destination, the resource controlling it may be defined with a default access of either NONE or READ. Otherwise it will be defined with a default access of NONE.