JESNEWS resources are not protected in accordance with security requirements.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-6924	ZJES0042	SV-7225r2_rule	DCCS-1 DCCS-2	Medium

Description
JES2 spool resources include all SYSOUT, SYSLOG, JESTRACE, and JESNEWS data sets. Failure to properly control JES2 spool resources could result in unauthorized personnel accessing job output, system activity logs, and trace data containing userid and password information. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data.

Description

JES2 spool resources include all SYSOUT, SYSLOG, JESTRACE, and JESNEWS data sets. Failure to properly control JES2 spool resources could result in unauthorized personnel accessing job output, system activity logs, and trace data containing userid and password information. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data.

STIG	Date
z/OS ACF2 STIG	2019-12-12

Details

Check Text ( C-3322r1_chk )
JESSPOOL Resource Controls a) Refer to the following reports produced by the ACF2 Data Collection and Data Set and Resource Data Collection: - SENSITVE.RPT(OPERCMDS) - ACF2CMDS.RPT(RESOURCE) – Alternate report NOTE: Review the ACFGSO report. If CLASMAP defines OPERCMDS as anything other than TYPE(OPR), replace OPR below with the appropriate three letters. Refer to the following report produced by the z/OS Data Collection: - EXAM.RPT(SUBSYS) Automated Analysis Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(ZJES0042) b) Review the resource rules for the OPERCMDS resource class (i.e., TYPE(OPR)) and ensure the following items are in effect: 1) The JES2.UPDATE.JESNEWS resource is defined to the OPERCMDS resource class with a default access of PREVENT. NOTE: JES2 is typically the name of the JES2 subsystem. Refer to the SUBSYS report and locate the entry with the description of PRIMARY JOB ENTRY SUBSYSTEM. The SUBSYSTEM NAME of this entry is the name of the JES2 subsystem. 2) Access authorization to the JES2.UPDATE.JESNEWS resource in the OPERCMDS class restricts DELETE service to the appropriate personnel (i.e., users responsible for maintaining the JES News data set) and all access is logged. c) If both of the items in (b) are true, there is NO FINDING. d) If either item in (b) is untrue, this is a FINDING.

Check Text ( C-3322r1_chk )

JESSPOOL Resource Controls

a) Refer to the following reports produced by the ACF2 Data Collection and Data Set and Resource Data Collection:

- SENSITVE.RPT(OPERCMDS)
- ACF2CMDS.RPT(RESOURCE) – Alternate report

NOTE: Review the ACFGSO report. If CLASMAP defines OPERCMDS as anything other than TYPE(OPR), replace OPR below with the appropriate three letters.

Refer to the following report produced by the z/OS Data Collection:

- EXAM.RPT(SUBSYS)

Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:

- PDI(ZJES0042)

b) Review the resource rules for the OPERCMDS resource class (i.e., TYPE(OPR)) and ensure the following items are in effect:

1) The JES2.UPDATE.JESNEWS resource is defined to the OPERCMDS resource class with a default access of PREVENT.

NOTE: JES2 is typically the name of the JES2 subsystem. Refer to the SUBSYS report and locate the entry with the description of PRIMARY JOB ENTRY SUBSYSTEM. The SUBSYSTEM NAME of this entry is the name of the JES2 subsystem.

2) Access authorization to the JES2.UPDATE.JESNEWS resource in the OPERCMDS class restricts DELETE service to the appropriate personnel (i.e., users responsible for maintaining the JES News data set) and all access is logged.

c) If both of the items in (b) are true, there is NO FINDING.

d) If either item in (b) is untrue, this is a FINDING.

Fix Text (F-18586r1_fix)
The IAO will ensure that access authorization for the JESNEWS resource in the OPERCMDS resource class is restricted to the appropriate personnel and , and all access is logged. Note: If CLASMAP defines OPERCMDS as anything other than TYPE(OPR), replace OPR below with the appropriate three letters. Review the resource rules for the OPERCMDS resource class (i.e., TYPE(OPR)) and ensure the following items are in effect: 1) The JES2.UPDATE.JESNEWS resource is defined to the OPERCMDS resource class with a default access of PREVENT. 2) Access authorization to the JES2.UPDATE.JESNEWS resource in the OPERCMDS class restricts DELETE service to the appropriate personnel (i.e., users responsible for maintaining the JES News data set) and all access is logged. Example: $KEY(JES2) TYPE(OPR) UPDATE.JESNEWS UID(SYSPROG) SERVICE(READ,UPDATE) LOG UPDATE.JESNEWS UID(*) PREVENT

Fix Text (F-18586r1_fix)

The IAO will ensure that access authorization for the JESNEWS resource in the OPERCMDS resource class is restricted to the appropriate personnel and , and all access is logged.

Note: If CLASMAP defines OPERCMDS as anything other than TYPE(OPR), replace OPR below with the appropriate three letters.

Review the resource rules for the OPERCMDS resource class (i.e., TYPE(OPR)) and ensure the following items are in effect:

1) The JES2.UPDATE.JESNEWS resource is defined to the OPERCMDS resource class with a default access of PREVENT.

2) Access authorization to the JES2.UPDATE.JESNEWS resource in the OPERCMDS class restricts DELETE service to the appropriate personnel (i.e., users responsible for maintaining the JES News data set) and all access is logged.

Example:

$KEY(JES2) TYPE(OPR)
UPDATE.JESNEWS UID(SYSPROG) SERVICE(READ,UPDATE) LOG
UPDATE.JESNEWS UID(*) PREVENT