FTP / Telnet unencryted transmissions require Acknowledgement of Risk Letter(AORL)

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-8271	IFTP0100	SV-8757r2_rule	DCCS-1 DCCS-2 EBRU-1 ECCT-1 ECCT-2	Medium

Description
In addition to the data transmission being in the clear, the user credentials are also passed in the clear, which violates the control IAIA-1. As mitigation for this vulnerability, special consideration must be given to account maintenance and the types of user privileges associated with these accounts. Interception of the above information could result in the compromise of the operating system environment, ACP, and customer data.

Description

In addition to the data transmission being in the clear, the user credentials are also passed in the clear, which violates the control IAIA-1. As mitigation for this vulnerability, special consideration must be given to account maintenance and the types of user privileges associated with these accounts. Interception of the above information could result in the compromise of the operating system environment, ACP, and customer data.

STIG	Date
z/OS ACF2 STIG	2017-03-22

Details

Check Text ( C-20020r1_chk )
a) Provide a list of all FTP userids defined to the ACP database, including the function and purpose of each FTP userid. b) Refer to the to the above list c) Ensure that an Acknowledgement of Risk Letter exist for all userids utilizing unencrypted communications. d) If (c) is true, there is NO FINDING. e) If (c) is untrue, this is a FINDING.

Fix Text (F-12415r1_fix)
Ensure that an Acknowledgement of Risk Letter exist for all userids utilizing unencrypted communications.