NCP (Net Work Control Program) Data set access authorization does not restricts UPDATE and/or ALLOCATE access to appropriate personnel.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-6904	ZFEP0015	SV-7199r2_rule	DCCS-1 DCCS-2	Medium

Description
If components of the FEPs are not properly protected they can be stolen, damaged, or disturbed. Without adequate physical security, unauthorized users can access the control panel, the operator console, and the diskette drive of the service subsystem. Therefore, they can interfere with the normal operations of the FEPs. Improper control of FEP components could compromise network operations.

STIG	Date
z/OS ACF2 STIG	2018-10-04

Details

Check Text ( C-20297r1_chk )
a) Refer to the following report produced by the Data Set and Resource Data Collection: - SENSITVE.RPT(NCPRPT) ___ The ACP data set rules for NCP data sets allow inappropriate access. ___ The ACP data set rules for NCP data sets does not restrict UPDATE and/or ALL access to authorized personnel (e.g., systems programming personnel). b) If both of the above are untrue, there is NO FINDING. c) If either of the above is true, this is a FINDING.

Check Text ( C-20297r1_chk )

a) Refer to the following report produced by the Data Set and Resource Data Collection:

- SENSITVE.RPT(NCPRPT)

___ The ACP data set rules for NCP data sets allow inappropriate access.

___ The ACP data set rules for NCP data sets does not restrict UPDATE and/or ALL access to authorized personnel (e.g., systems programming personnel).

b) If both of the above are untrue, there is NO FINDING.

c) If either of the above is true, this is a FINDING.

Fix Text (F-18253r1_fix)
Identify Names of the following data sets used for installation and in development/production environments: - NCP system data sets - NCP source definition data sets - NCP load modules - NCP host dump data sets - NCP utility programs Have the IAO validate that they are properly protected by the ACP. And that only authorized personnel are permitted UPDATE and/or ALLOCATE access (e.g., z/OS systems programming personnel).

Fix Text (F-18253r1_fix)

Identify Names of the following data sets used for installation and in development/production environments:

- NCP system data sets
- NCP source definition data sets
- NCP load modules
- NCP host dump data sets
- NCP utility programs
Have the IAO validate that they are properly protected by the ACP. And that only authorized personnel are permitted UPDATE and/or ALLOCATE access (e.g., z/OS systems programming personnel).